Email Deliverability in 2026: The Sender Rules You Must Meet and Where Email Fits in a Conversational Stack

Gmail, Yahoo and Microsoft now set firm rules for anyone sending email at volume, and mail that breaks them is filtered or rejected. The rules come down to three things: prove who you are, make leaving easy and keep complaints low. This guide explains each one plainly and shows where email fits next to WhatsApp, SMS and Viber.

What is the short answer?

To reach the inbox in 2026, authenticate your domain, make unsubscribing easy and keep complaints low. Since February 2024, Google (Gmail) and Yahoo have required bulk senders to authenticate with SPF and DKIM, publish a DMARC policy (p=none at minimum) with alignment, support one-click unsubscribe for marketing mail, honour unsubscribes within two days and keep user-reported spam rates below 0.3%. Google defines a bulk sender as one sending close to 5,000 or more messages a day to Gmail addresses.

Smaller senders are not exempt from everything. All senders to Gmail need at least SPF or DKIM, valid forward and reverse DNS (Domain Name System) records, and TLS (Transport Layer Security) encryption. Microsoft introduced similar requirements for high-volume senders, over 5,000 emails a day, to Outlook.com, Hotmail and Live addresses from May 2025. Enforcement tightens over time, so check each provider's current sender guidelines.

These rules exist to protect recipients from unwanted and fake email, and they reward senders who behave well. Meeting them is not only about avoiding penalties: authenticated mail from a sender with few complaints is more likely to land in the inbox, where it can actually be read.

What are SPF, DKIM and DMARC?

SPF, DKIM and DMARC are three records in your domain settings that together prove an email really comes from you. Think of them as a guest list, a wax seal and a house rule:

• SPF (Sender Policy Framework) is the guest list. It names the servers allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail) is the wax seal. It adds a signature to each message that shows it came from your domain and was not altered on the way.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) is the house rule. It tells mailbox providers what to do with mail that fails the checks, and sends you reports. Alignment means the domain your recipients see matches the domain that passed SPF or DKIM.

A DMARC policy of p=none only monitors, which is the minimum the rules require. Once reports show all your legitimate mail passing, many senders tighten the policy so that failing mail is quarantined or rejected.

Every service that sends on your behalf needs to be covered: your main mailbox provider, your newsletter tool, your booking or shop system and anything else that sends email using your domain. A common cause of failed checks is a tool someone added years ago and nobody included in the SPF record or set up for DKIM. Make a list of every sender before you change anything.

Why does one-click unsubscribe protect your reputation?

One-click unsubscribe protects your reputation because people who can leave easily do not mark you as spam instead. The standard, RFC 8058, lets recipients unsubscribe with a single click inside their email app, with no website visit or login. Gmail and Yahoo require it for bulk marketing mail and expect unsubscribes to be honoured within two days.

Every spam report counts against you; every unsubscribe simply removes someone who was not interested. Keep a visible unsubscribe link in the message body as well, and make sure your systems stop sending promptly once someone opts out.

What counts towards your spam rate?

Your spam rate is the share of your delivered mail that recipients report as spam, and Gmail requires bulk senders to keep it below 0.3%. It counts people who press the "report spam" button, not messages that filters send to the junk folder by themselves.

Google Postmaster Tools shows your user-reported spam rate for Gmail, along with your authentication results. Watch it regularly, not just after a problem. Treat 0.3% as a hard ceiling and aim well below it, because a single badly targeted campaign can push you over. If the rate rises, pause and look at who you mailed and why they did not expect it.

Complaints usually rise for predictable reasons: people do not recognise the sender name, they did not expect the message, or they are hearing from you far more often than they agreed to. Use a sender name people know, remind them why they are receiving the email and let them choose how often they hear from you.

Should transactional and marketing email be separate?

Yes, send transactional and marketing email from separate streams, so a marketing problem cannot block a password reset or a receipt. Transactional mail is triggered by something the customer did, such as an order or a booking. Marketing mail is sent to promote something.

The usual approach is to use different subdomains or sending identities for each, for example one for receipts and account messages and another for newsletters. Each stream then builds its own reputation. If a promotion draws complaints, your order confirmations keep arriving.

How do you keep your list healthy?

A healthy list contains people who asked to hear from you and still engage. Three habits matter most:

• Double opt-in where appropriate. Asking new subscribers to confirm by email filters out typos and fake sign-ups.
• Sunset inactive contacts. Stop mailing people who have not opened or clicked for a long time, after a final re-engagement message.
• Never buy lists. Bought addresses did not agree to hear from you, so they produce complaints, bounces and spam traps.

Regular hygiene also improves the figures you rely on. Opens, clicks and conversions are measured against the people you mail, so removing contacts who never engage makes your results more honest and your reputation stronger at the same time.

Where does email fit next to WhatsApp, SMS and Viber?

Email is best for receipts, documents, long-form content and records, while conversational channels are best for time-sensitive, two-way messages. A delivery update, an appointment reminder or a quick question works well on WhatsApp, SMS or Viber, where people reply in the moment. A detailed invoice, a contract or a monthly newsletter belongs in email, where it can be filed and found later.

Email also works well as a fallback: if a conversational message cannot be delivered, an email can carry the same information. For a closer look at the marketing side, see WhatsApp marketing vs email.

Choosing the right channel also helps deliverability. Sending urgent, short updates by email invites people to ignore or report them; moving those messages to a conversational channel keeps your email stream focused on content people want to keep.

What should a deliverability checklist include?

A deliverability checklist should cover authentication, consent, complaints and structure:

1. SPF record published and listing every service that sends for you.
2. DKIM signing turned on for each sending service.
3. DMARC policy published (p=none at minimum) with alignment, and reports reviewed.
4. Valid forward and reverse DNS for your sending servers.
5. TLS encryption in place.
6. One-click unsubscribe (RFC 8058) on all marketing mail.
7. Unsubscribes honoured within two days.
8. Spam rate watched in Google Postmaster Tools and kept well below 0.3%.
9. Transactional and marketing mail sent from separate subdomains or identities.
10. List kept clean: consent recorded, inactive contacts sunset, no bought lists.

How Arino One fits

Arino One runs email alongside WhatsApp, SMS, RCS, voice, live chat and 18+ other channels in one dedicated instance that the client owns, built on Arino Core. You authenticate your sending domain with SPF, DKIM and DMARC, and email conversations appear in the same inbox as your messaging. Reusable branded templates, sending identities per address and one-click unsubscribe handling are covered in the docs. See the email overview and email marketing and templates guides, or email hello@arino.one.

FAQ