If your agency sends cold email at any real volume, 2026 is the year the rules stopped being suggestions.
For years, Gmail and Microsoft published "best practices" for senders — recommendations you could technically ignore and still land in the inbox most of the time. That era is over. Gmail's bulk sender requirements, in force since 2024 and now actively enforced, together with Microsoft's own rules that arrived in May 2025, are applied automatically. Since November 2025, Gmail has scaled up permanent rejections: miss the requirements and your mail doesn't get a warning — it gets refused outright with a 550 error or dropped into spam, with no appeal and no explanation.
For B2B agencies, this hits harder than anyone. You're a volume sender by definition. The moment your authentication is off, or your complaint rate drifts up, or you blast a fresh domain too fast, you're the exact profile these filters were built to catch. And because you're sending on behalf of clients, a burned domain doesn't just cost you deliverability — it costs you the client's results, and often the client.
The frustrating part: most of the agencies we see failing these rules are failing on things that take ten minutes to fix. A DMARC record set to "monitoring only" that they assumed was protecting them. A DKIM signature that was never actually turned on. A second stray SPF record quietly breaking the first. None of these are hard problems — they're just invisible ones, because nothing tells you you're failing until your reply rates quietly collapse.
This post walks through exactly what Gmail and Microsoft now require, the five mistakes we see B2B agencies make most often, and the specific fix for each. No theory, no fluff — the actual records, the actual thresholds, and a two-minute way to check whether your own domain passes before your next campaign goes out.
Because in 2026, the senders who win aren't the ones with the cleverest copy. They're the ones whose mail actually arrives.
The rules changed, and enforcement is now automatic
The shift that matters isn't that Gmail and Microsoft added new rules. It's that they started enforcing the ones they already had.
The turning point was November 2025. Before that, a misconfigured sender might see slightly worse placement, or get a temporary error they could retry. Since then, Gmail has scaled up permanent rejection — non-compliant mail now gets refused outright with a permanent 550 error and never reaches the inbox or even the spam folder. There's no dashboard telling you why, and no support queue to appeal to. The filter decides, and it decides in milliseconds.
Volume senders feel this first and worst. A personal account sending a few dozen mails a day rarely trips these thresholds. An agency sending thousands of cold emails across client domains trips them constantly if the setup isn't right. The rules were written with exactly your traffic pattern in mind.
The three requirements every sender must now pass
Strip away the detail and there are three things Gmail and Microsoft expect from anyone sending at volume.
1. Authenticate your mail — SPF, DKIM, and DMARC
Not one of them. All three.
- SPF tells receivers which servers are allowed to send as your domain.
- DKIM cryptographically signs your mail so receivers can verify it wasn't tampered with.
- DMARC ties the two together and tells receivers what to do when a message fails.
Missing or misconfiguring any one of these is now a common reason mail is rejected rather than merely spam-foldered. Authentication is no longer the "advanced" step — it's the entry ticket.
2. Keep spam complaints under the line
Gmail asks bulk senders to keep their spam complaint rate below 0.3%, and to avoid ever reaching it. In practice, the number you should actually aim for is lower — around 0.1% — because by the time you're brushing against 0.3%, damage to your reputation is already underway.
For an agency, that math is unforgiving. If even a small fraction of a cold list marks you as spam, you cross the line fast. This is why list quality and targeting aren't "nice to have" — they're deliverability infrastructure.
One Microsoft-specific wrinkle worth knowing: Microsoft weighs the reputation of your sending IP heavily, alongside your domain. If you send from a shared IP that someone else has abused, your mail can suffer at Outlook and Hotmail even when your own authentication is perfect. Who you share sending infrastructure with matters.
3. Make unsubscribe one click
Both providers now expect one-click unsubscribe for bulk mail, implemented through the List-Unsubscribe email header — not just a link buried in your footer.
A footer link is a courtesy. The header is a requirement, because it lets the recipient's mail client offer an unsubscribe button directly. Missing it pushes people toward the "report spam" button instead — which feeds straight into the complaint rate you're trying to keep down.
The five mistakes we see B2B agencies make
These are the specific failures we find most often when we audit agency domains. Each one is quiet — nothing warns you — and each one has a fast fix.
Mistake 1: DMARC published at p=none
This is the most common one, and the most deceptive. A DMARC record with p=none exists, so a quick check shows "DMARC: present" and everyone relaxes.
Here's the subtlety: p=none technically satisfies Gmail's bare minimum for bulk senders — they require a DMARC record with a policy of at least p=none. But p=none means monitoring only. It tells receivers to watch, not to act. Spoofed mail using your domain still gets delivered, you get no real protection, and it leaves you exposed exactly where enforcement is heading next. You have the appearance of protection without the protection.
Fix: change p=none to p=quarantine. After a week or two of clean reports, move to p=reject.
Mistake 2: DKIM missing or weak
Plenty of agencies never actually turned DKIM on — they assume their mail platform handles it, but the setting was never enabled. Others are still running a weak 1024-bit key that some receivers now discount.
Unsigned mail can't be verified, and unverifiable mail is a primary reason messages land in spam.
Fix: enable DKIM in your mail platform, generate a 2048-bit key, and publish the TXT record it gives you. The selector and key come from your platform — never copy someone else's.
Mistake 3: Blasting a cold domain
A brand-new sending domain has no reputation. Send ten thousand cold emails from it on day one and receivers read that as exactly what it looks like — a spam operation. The domain's reputation burns before it ever had a chance to build.
Fix: warm up gradually. Start with low volume to engaged recipients and ramp over weeks, not hours. There's no shortcut that doesn't risk the domain.
Mistake 4: No List-Unsubscribe header
The footer link isn't enough anymore. Without the List-Unsubscribe header, recipients who want out have one obvious option: report spam. Every one of those reports pushes you toward the complaint threshold.
Fix: add the List-Unsubscribe header (and its one-click variant) to your sends. Most serious sending platforms support it — it may just need to be switched on.
Mistake 5: Two SPF records
SPF allows exactly one record per domain. We regularly find domains with two — usually because a new service was added and created its own instead of editing the existing one.
Most receivers treat two SPF records as an error and stop evaluating SPF entirely. You didn't strengthen your setup; you broke it.
Fix: merge every include: and ip4: mechanism into a single v=spf1 record and delete the extras.
How to check if your domain passes (in 2 minutes)
You don't have to guess at any of this. A pre-send audit reads your domain's public DNS and tells you, in plain terms, which of these you pass and which you fail — before your next campaign goes out.
You can run yours here: audit.humerly.com. It checks SPF, DKIM, DMARC and the rest, flags exactly what's wrong, and gives you the specific record to fix it. No signup needed to see your score.
Fixing the most common failure: DMARC p=none to enforcing
Since p=none is the mistake we see most, here's the exact fix.
Log in to your DNS provider and find the TXT record at _dmarc.yourdomain.com. You'll see something like:
v=DMARC1; p=none; rua=mailto:[email protected]Change p=none to p=quarantine:
v=DMARC1; p=quarantine; adkim=r; aspf=r; rua=mailto:[email protected]Make sure rua points to a mailbox you actually monitor, so you can see the aggregate reports. Watch those reports for a week or two. Once they show your legitimate mail is aligning correctly, tighten p=quarantine to p=reject for full enforcement.
That single change moves you from "looks protected" to "is protected."
FAQ
Does Gmail require DMARC in 2026?
Yes, for bulk senders (roughly 5,000+ messages a day to Gmail). Gmail's minimum is a DMARC record with a policy of at least p=none, alongside SPF and DKIM. But p=none only monitors — it doesn't protect your domain or enforce anything. Move to p=quarantine or p=reject for real protection.
What spam complaint rate gets you blocked?
Gmail's hard ceiling is 0.3% — reach it and your deliverability takes a serious hit. But the rate to actually aim for is 0.1% or below; Google itself says to stay under 0.1% and never let it reach 0.3%. For cold outreach, that's a tight margin, which is why list quality matters so much.
What happens if I don't comply?
Since November 2025, non-compliant mail to Gmail can be permanently rejected with a 550 error — refused outright, not just sent to spam. There's no warning and no appeal on the individual message.
Is p=none enough for DMARC?
It meets Gmail's bare minimum, but it's not enough for actual protection. p=none is monitoring only — it lets you see reports but tells receivers to take no action on failures. Move to p=quarantine, then p=reject.
How long does domain warmup take?
There's no fixed number, but ramping over several weeks — starting with low volume to engaged recipients — is far safer than a large blast from a fresh domain. Rushing it is the fastest way to burn a new domain's reputation.
Do these rules apply to low-volume senders?
The strictest thresholds (DMARC, one-click unsubscribe) target bulk senders at 5,000+/day. But authentication — SPF, DKIM — is now expected across the board. If you send on behalf of clients or run any real campaign volume, treat all of it as applying to you.
The takeaway
The 2026 rules come down to four things: authenticate your mail with all three of SPF, DKIM and DMARC; keep your complaint rate well under the line; warm up new domains instead of blasting them; and make unsubscribe one click.
None of it is hard. It's just invisible — which is why so many capable agencies are quietly failing on it. The senders who win in 2026 aren't the ones with the best copy. They're the ones who checked before they sent.
Check your domain now: audit.humerly.com