Everything else we write about here — the brief, the evidence, the disqualification rules — assumes the message reaches an inbox. That assumption used to be safe. It is not any more, and the failure mode is not a lower open rate. It is a permanent rejection at the door.
What actually changed
Google and Yahoo published requirements for senders above 5,000 messages a day, and enforcement is now active rather than advisory. Non-compliant bulk mail draws a permanent 550 rejection, which is a different category of problem from landing in spam: there is no folder to be rescued from.
| Requirement | The number |
|---|---|
| SPF and DKIM on the sending domain | Both, not either |
| DMARC record present | Policy may be p=none |
| From: header alignment | Must align with the SPF domain or the DKIM domain |
| Spam rate in Postmaster Tools | Below 0.30% required, below 0.10% recommended |
| One-click unsubscribe | RFC 8058, honoured within two days |
| Transport | TLS |
| Sending domain or IP | Valid forward and reverse DNS (PTR) |
None of that is difficult. All of it is checkable before you send, and the reason to check is that the alternative is discovering it from a bounce log after a week of sending.
The 0.10% is the real limit
Two thresholds get quoted, and the gap between them is where people get hurt. 0.30% is where enforcement bites. 0.10% is where you should be operating, because reputation is a lagging indicator: by the time the dashboard shows you have crossed the line, the sends that caused it went out days ago and the recovery is measured in weeks of reduced volume.
At 0.10%, one complaint in a thousand is your entire budget. That is a targeting constraint long before it is a technical one — which is the actual argument for researching a smaller list properly rather than sending a larger one hopefully.
One complaint per thousand is the whole budget. That is a targeting problem wearing a deliverability costume.
The part that has to happen first
Authentication proves identity. It does not create reputation, and a domain with no history has none. Volume arriving suddenly from a domain registered last week is indistinguishable from the thing the filters exist to stop.
- Send from a subdomain, not the domain that carries your corporate mail — a burned reputation should not take your invoices with it.
- Register and let it age before it sends anything of consequence.
- Ramp volume gradually rather than opening at target rate.
- Set up Postmaster Tools before the first campaign, so you have a baseline to compare against rather than only an alarm.
- Keep suppression global across every campaign and every mailbox, not per-sequence.
Where this meets the rest of the work
A one-click unsubscribe honoured within two days is a deliverability requirement. It is also, in the EU, the mechanism behind an Article 21 objection, which we wrote about in what legitimate interest actually covers. The same suppression list satisfies both, and a team that keeps suppression per-campaign fails both at the same time.
The connection worth holding on to is this: every requirement above gets easier as the list gets smaller and better. Authentication is fixed work. Reputation is a function of how many people you contacted who did not want to hear from you — which is a research problem, and the reason our evidence standard drops a company it cannot source rather than sending to it anyway.