Cold email deliverability in 2026: the sender rules that decide if you reach the inbox

Cold email used to be a copywriting problem. Since 2024 it has been an infrastructure problem first, and 2026 is the year the rules stopped being suggestions.

Google and Yahoo announced their bulk sender requirements in late 2023 and began enforcing them in February 2024. Microsoft followed with equivalent requirements for Outlook.com consumer mailboxes in 2025. Between the three of them, they control the inbox of almost every prospect you will ever email. If your domain does not comply, your sequence does not get read. It gets filtered before a human sees it.

This article explains what the requirements are, why they hit outbound teams harder than marketing teams, and how to build a sending setup that keeps working.

What the sender requirements actually say

The core rules are the same across the major providers, with small differences in thresholds.

The "bulk sender" definition (about 5,000 messages a day to one provider) determines which rules are strictly enforced. But authentication and spam-rate expectations apply to every sender. A small outbound team sending 300 emails a day is still judged on the same reputation signals as a newsletter sending 300,000.

Why outbound teams get hit harder than marketing

A marketing list is opt-in. Recipients asked to be there, so complaint rates are naturally low and unsubscribe links are expected. Cold outbound is the opposite: nobody asked for the email, and the fastest way for a busy prospect to make it stop is the "Report spam" button.

That is why the 0.3% threshold is so brutal for outbound. If you send 1,000 cold emails, three spam reports put you at the limit. Four put you over. And unlike a hard bounce, a spam complaint is a judgment about your domain, not about one address.

There is a second problem. Most outbound tools send from a company's primary domain by default. When that domain's reputation drops, it is not only the sales sequences that land in spam. Invoices, support replies and the CEO's email to an investor go with them.

The setup that survives

The pattern that experienced outbound teams have converged on is boring, and that is the point.

1. Separate sending domains

Buy two or three secondary domains that are clearly related to your brand (for example a .co, a -hq variant or a try- prefix) and forward them to your main site. All cold outbound leaves from those domains. Your primary domain never sends unsolicited mail.

Each secondary domain gets its own SPF, DKIM and DMARC records, its own Google Workspace or Microsoft 365 tenant, and its own Postmaster Tools property so you can see its reputation in isolation.

2. Low volume per mailbox, many mailboxes

A warmed mailbox that sends 20 to 40 personalised messages a day looks like a human. A mailbox that sends 400 looks like a script. Spread volume across mailboxes and domains instead of pushing any single address harder. Two or three mailboxes per domain is a common ceiling.

3. Warm before you send

New domains and mailboxes have no reputation, which providers treat as suspicious. Warming means sending low volumes of legitimate mail that gets opened and replied to, and ramping over three to four weeks. Most sales engagement platforms include a warmup network. Use it, and keep it running at a low level even after the mailbox is live.

4. Authenticate everything, then check alignment

Publish SPF with the exact includes for your provider and sending tool, enable DKIM signing in the mail provider, and publish a DMARC record. Then send a test to a DMARC analyser and confirm that the From domain aligns with the DKIM signing domain. Misalignment is the most common reason a "fully authenticated" setup still fails.

5. Treat the list as the product

Every bounce and every complaint is a data-quality failure that happened before the email was written. Verify addresses with a validation service before they enter a sequence, remove role addresses such as info@ and sales@, and cap sequences at a level where you can genuinely personalise the first line. A tight list of 200 well-qualified contacts will outperform 2,000 scraped ones on every metric that matters, including the reputation of your domain.

6. Make it easy to stop

Cold email is not marketing mail and a list-unsubscribe header can feel out of place in a one-to-one message. But a plain-text line such as "If this is not relevant, reply 'no' and I will not follow up" gives the prospect a way out that is not the spam button. Honour it immediately, across every mailbox and every sequence.

Monitoring: the three numbers to watch weekly

• Spam rate in Postmaster Tools, per domain. Anything above 0.1% is a warning. Above 0.3%, pause the domain.
• Bounce rate, per mailbox. Above 2% usually means the list source is bad.
• Reply rate, positive and negative. A falling reply rate with a stable open rate often means you are landing in the Promotions or Updates tab rather than spam, which is a different problem with a different fix.

What changes in 2026

The direction is clear: mailbox providers are moving from "authenticate or be filtered" to "behave or be blocked". Google has been expanding the metrics visible in Postmaster Tools, Microsoft has aligned its consumer requirements with the others, and enforcement on non-compliant domains has gone from soft filtering to outright rejection.

For outbound teams, that means the era of buying a list, plugging it into a tool and blasting from the company domain is over. The teams that still get replies in 2026 are the ones that treat deliverability as an operational discipline: separate domains, low volume, verified data, and a spam rate they check every Monday.