Cold email deliverability now depends on authentication, a spam complaint rate under 0.3%, and sending only to people with a reason to hear from you. Here is what Gmail, Yahoo and Outlook require, plus a scorecard to check your setup.
Cold email deliverability is the share of your cold emails that reach a prospect’s inbox instead of the spam folder or a rejection bounce. In 2026 it depends on three things you control: authenticated sending domains, a spam complaint rate well under Gmail’s 0.3% limit, and sending only to people with a real reason to hear from you. This guide covers what Gmail, Yahoo and Outlook now require, how to keep complaints low, and a scorecard to check your setup before the next campaign.
Deliverability is whether your email lands where the recipient will see it. It is different from “delivery”, which only means the receiving server accepted the message. An email can be delivered straight into spam, and your sending tool will still report it as sent.
It got harder because the big mailbox providers stopped treating authentication and complaints as suggestions. Google’s sender requirements took effect on February 1, 2024. Yahoo introduced similar requirements in 2024. Microsoft followed for Outlook.com, Hotmail and Live addresses, with non-compliant high-volume mail rejected from May 5, 2025.
Cold outreach is the most exposed kind of email under these rules. Newsletters go to people who signed up. Cold emails go to people who did not, so they are far more likely to be marked as spam. That is the number providers watch most closely.
All three want authenticated mail, low complaint rates and easy unsubscribes. The details differ, mostly in how they define a bulk sender and how strictly they enforce.
| Gmail | Yahoo | Outlook.com | |
|---|---|---|---|
| Who counts as bulk | 5,000+ messages a day to Gmail accounts, counted per primary domain | No volume threshold published | 5,000+ emails a day to outlook.com, hotmail.com and live.com |
| Authentication | SPF and DKIM, plus DMARC (p=none is allowed) | DMARC strongly urged; DKIM keys of 1024 bits or more | SPF and DKIM must pass; DMARC of at least p=none |
| Alignment | From domain must align with SPF or DKIM | Not specified in the FAQ | Must align with SPF or DKIM, both preferred |
| Complaint limit | Below 0.3%, ideally below 0.1% | May defer mail from domains with high complaint rates | Not in the enforced authentication rules |
| Unsubscribe | One-click for marketing mail; fulfil within 48 hours recommended | List-Unsubscribe header for promotional mail; honor within 2 days | Not in the enforced authentication rules |
| What happens if you fail | No mitigation help while above 0.3% | Deferral or rejection | Rejection |
Sources for the table: Google’s sender guidelines and FAQ, Yahoo’s sender FAQ and dmarcian’s summary of Microsoft’s requirements.
Some of them, yes. Google’s baseline for all senders includes SPF or DKIM, valid forward and reverse DNS, TLS, and a spam rate below 0.3%. And Google counts volume by primary domain, so ten inboxes on one domain sending 600 emails each already cross the line. Its FAQ adds that once you hit the threshold, you are permanently considered a bulk sender. Yahoo publishes no threshold at all. The safe assumption is that every rule applies to you.
Yes, you need all three. They are DNS records that prove your mail really comes from your domain, and every major provider checks them.
The common cold email mistake is alignment. If you send through an outreach tool or a third-party provider, it must sign with your domain, not its own. Microsoft’s rules say mail sent through third parties on your domain must also pass DMARC alignment. Check this once per sending tool, not once per company.
Many teams do, so a bad campaign cannot hurt the reputation of the domain their invoices and support replies come from. It is a reasonable precaution. It is not a way around the rules. A secondary domain still needs full authentication, and if its complaint rate is high, its mail still goes to spam.
Send fewer emails to people who are more likely to want them. Google asks senders to keep their rate below 0.10% and to avoid ever reaching 0.30%. Above 0.3%, bulk senders are ineligible for Google’s mitigation help until they stay under it for seven consecutive days.
This is an illustrative scenario, not a real customer. Think of the threshold as a budget. The math is simple:
| Emails sent | Spam reports at 0.1% (target) | Spam reports at 0.3% (limit) |
|---|---|---|
| 500 | 0.5 | 1.5 |
| 1,000 | 1 | 3 |
| 5,000 | 5 | 15 |
| 10,000 | 10 | 30 |
An SDR sends 1,000 generic emails to a purchased list of “VP Sales, 50 to 500 employees”. If just four people hit “report spam”, the campaign is over the limit. Now picture the same SDR sending 200 emails, each to someone who publicly asked about the problem their product solves in the last two weeks. The message references the question. Far fewer of those people feel spammed, because the email answers something they said out loud.
That is the real lever. Warm-up tools and inbox rotation cannot fix a list that does not want your message. Practical steps that lower complaints:
From buying signals: people describing your problem, asking for recommendations or complaining about a current tool. We covered how to spot them in how to find buying signals on Reddit. FindyLeads does this monitoring on Reddit and LinkedIn for you, surfaces the conversations that match your product and drafts a reply you can edit. Often the best first touch is a helpful comment in that thread. Email comes after they respond, which is about the safest cold email there is.
It needs a clear way to opt out, and in the US that is the law, not a deliverability tip. The FTC states that CAN-SPAM makes no exception for business-to-business email. Commercial messages need a clear opt-out method, a valid physical postal address, honest headers and subject lines, and opt-outs honored within 10 business days.
The mailbox providers’ one-click unsubscribe header is a separate rule. Google says it is required only for marketing and promotional messages. Yahoo applies it to promotional mail and expects unsubscribes to be honored within two days. A cold sales email sits close enough to “promotional” that adding the header, where your sending tool supports it, is the cautious choice. Laws differ by country, so check the rules where your prospects are. This is general information, not legal advice.
Watch provider data and your own reply patterns. Open rates alone are unreliable, so do not rely on them.
Run the Inbox Readiness Scorecard. It is our ten-point check that combines the providers’ technical rules with the targeting habits that keep complaints low. Score one point per row.
| # | Check | Pass when |
|---|---|---|
| 1 | SPF | Record lists every tool that sends for the domain |
| 2 | DKIM | Every sending tool signs with your domain, key 1024 bits or more |
| 3 | DMARC | Record published (p=none or stricter) and From domain aligns |
| 4 | DNS and TLS | Valid forward and reverse DNS; mail sent over TLS |
| 5 | Monitoring | Domain verified in Google Postmaster Tools and checked weekly |
| 6 | Complaint rate | Below 0.1% over the last 30 days |
| 7 | Opt-out | Clear opt-out in every email, honored within 2 days |
| 8 | Legal basics | Physical postal address and honest subject lines |
| 9 | Reason to email | Every contact has a written, specific trigger |
| 10 | Sequence length | No more than three follow-ups to a non-responder |
How to read your score:
| Score | What it means | What to do |
|---|---|---|
| 9 to 10 | Ready to send | Scale volume gradually and keep checking rows 5 and 6 |
| 6 to 8 | At risk | Fix the gaps before adding volume |
| 0 to 5 | Likely in spam already | Pause campaigns, fix rows 1 to 4, then rebuild the list |
Rows 1 to 8 are table stakes. Rows 9 and 10 are where most teams lose points, and they are the ones that decide your complaint rate.
Google asks senders to keep their spam rate below 0.1% and never reach 0.3%. For cold email, treat 0.1% as the target, which is about one spam report per 1,000 emails.
Google only requires DMARC for senders of 5,000 or more messages a day, but it counts volume across your whole primary domain. Yahoo strongly urges DMARC for every sending domain, so set it up regardless of volume.
Yes, if it follows the CAN-SPAM Act, which makes no exception for B2B email. You need a clear opt-out, a valid postal address, honest headers and subject lines, and opt-outs honored within 10 business days. This is not legal advice.
Since May 5, 2025, Microsoft rejects mail from high-volume senders to outlook.com, hotmail.com and live.com addresses that fails its SPF, DKIM or DMARC checks. The message bounces instead of going to junk.
Not on its own. Warm-up does not change how real recipients react, and spam reports from real prospects are what providers measure. Better targeting and fewer, more relevant emails do more.
Score your domain on the Inbox Readiness Scorecard today. Fix any failing row from 1 to 4 before you send another campaign, and verify your domain in Google Postmaster Tools so you can see your complaint rate. Then cut your next list down to people with a specific, written reason to hear from you, and send that smaller list first.
Search 1 billion people and 450 million companies, then reach them while they are still looking. 7-day free trial, $0 due today.
