Key takeaways
- Gmail and Yahoo began enforcing SPF, DKIM and DMARC in February 2024; Microsoft followed on May 5, 2025.
- The rules apply at any volume. Buyers behind corporate Microsoft 365 tenants are harder to reach than consumers.
- Industrial outbound fails for four reasons: primary-domain sending, missing or misaligned DMARC, cold domains, and lists that complain.
- The fix is secondary domains, full authentication, three to four weeks of warming, and low steady volume.
- Measure complaint rate, bounce codes and inbox placement. Open rates have been unreliable since 2021.
What changed in the rules for sending email?
Gmail and Yahoo began enforcing sender authentication in February 2024, Microsoft followed for Outlook, Hotmail and Live in May 2025, and all three now reject or junk mail that fails SPF, DKIM and DMARC.
The requirements themselves are not new. What changed is enforcement. Gmail, Yahoo and Outlook now apply the same core rules at the server level: bulk senders must pass SPF, DKIM and DMARC, align the From domain, support one-click unsubscribe, and keep spam complaints under 0.3 percent [1]. Microsoft began rejecting non-compliant bulk mail on May 5, 2025 [3], with the same authentication and complaint-rate expectations Gmail and Yahoo set a year earlier [2].
Feb 2024
Gmail and Yahoo start enforcing sender rules. Courier
May 5, 2025
0.3%
Source type: provider documentation summarized by deliverability vendors. Timeframe: 2024–2025 enforcement dates.
What does a correct outbound sending setup look like?
Two to four secondary domains that resemble the primary brand, each with SPF, DKIM and an aligned DMARC policy, warmed for three to four weeks before any campaign sends, and monitored in Postmaster tools.
Element
Typical industrial setup
What it should be
Sending domain
Primary company domain
Secondary domains, primary kept for business mail
SPF
Present, often with too many lookups
Valid, under the 10-lookup limit, covering every sending service
DKIM
Missing or set up for one tool only
Signed on every sending domain and tool
DMARC
None, or p=none with no reporting
Aligned, with reporting enabled, moving toward quarantine
Warming
None
3–4 weeks of ramping volume before campaigns
Volume per inbox
Whatever the tool allows
Low, steady, across several inboxes
Monitoring
Open rates
Postmaster complaint rate, bounce codes, inbox placement tests
Each of these is checkable in an afternoon. Together they are the difference between replies and silence, and they are why our Commercial Foundation carries an Inbox-Ready Guarantee: domains authenticated and warmed by the end of month one, or we keep working at no charge until they are.
How do you know whether your email is landing?
Stop reading open rates and read the signals providers actually give you: Postmaster complaint rate, bounce codes, and seeded inbox placement tests.
Open rates have been unreliable since Apple’s Mail Privacy Protection in 2021. Gmail’s Postmaster Tools reports your spam complaint rate and domain reputation directly [5]. Bounce logs tell you why mail was refused: Gmail returns codes like 421-4.7.32 for authentication failures and 550-5.7.1 for SPF failures, and Microsoft uses 550 5.7.515 for non-compliant bulk mail [1]. A seeded placement test, sending to a panel of real inboxes across providers, tells you where your message actually landed.
If none of those three are being watched, nobody at your company knows whether the outreach is arriving.
Frequently asked questions
Do SPF, DKIM and DMARC apply to small industrial companies?
Yes. Every sender at any volume needs at least SPF or DKIM, a valid PTR record and a low spam rate. Bulk senders above 5,000 messages a day to one provider must have all three plus one-click unsubscribe.
Should we send outbound from our main company domain?
No. Outbound belongs on secondary domains so a campaign problem never affects the domain your proposals and invoices come from.
How long does domain warming take?
Three to four weeks of gradually increasing volume to engaged recipients before campaign sending begins.
What spam complaint rate is safe?
Providers set the ceiling at 0.3 percent. Google recommends staying under 0.1 percent. Facility-level lists of people who have the problem you solve rarely generate complaints; purchased job-title lists do.
What is the Inbox-Ready Guarantee?
Part of FieldForge’s Commercial Foundation: sending domains authenticated with SPF, DKIM and DMARC aligned, and warmed, by the end of month one, or we keep working at no charge until they are.
Related reading
Find out whether visibility is your constraint
The P.R.O. Index is 21 questions and about five minutes. You get a score across Performance, Ramp and Output, and our read on which one to fix first.
Sources
- 1. https://www.courier.com/blog/email-sender-requirements
- 2. https://mailup.com/?p=4570
- 3. https://dmarcian.com/yahoo-and-google-dmarc-required/
- 4. https://support.wunderkind.co/hc/en-us/articles/24665469388187-Understanding-the-New-Gmail-Yahoo-Email-Protections
- 5. https://capacityinteractive.com/blog/big-changes-are-coming-to-gmail-and-yahoo-are-you-ready/
Wesley Cowley, Founder and CEO, FieldForge Partners