Email Deliverability News: Latest Updates and Changes

Email deliverability changes fast. Gmail tightens enforcement. Microsoft adds new requirements. Yahoo updates thresholds. Miss an update and your emails start bouncing.

This page tracks the changes that matter across Gmail, Yahoo, Microsoft, and the major authentication standards. Updated regularly with provider policy changes, bulk sender enforcement updates, and industry developments that affect whether your emails reach the inbox.

Bookmark this page. When something breaks, check here first.

---

September 2026

Exchange Online deferred external mail for days with 451 4.7.500 errors

Microsoft 365 had a rough start to the month. An outage that began on August 31, which Microsoft attributed to "a core authentication configuration used across services," hit Exchange Online, SharePoint, Teams, and Defender, with availability back above 99% by September 2. Then on September 4 a second incident (EX1467029) left external senders seeing 451 4.7.500 Server busy. Please try again later in both directions of Exchange Online mail flow. Microsoft traced the throttling to "enforcement by a specific anti-spam model affecting a subset of traffic," allowlisted the affected sending IPs, disabled the model, and let the queues drain. Suped has a timeline of both incidents.

A 4.7.500 is a temporary failure, and a burst of them during those days says nothing about your reputation. If your ESP retried, the mail went through once Microsoft cleared the queues. If your own MTA gave up early, or you saw the same code on inbound mail from Microsoft 365 tenants, that is the explanation.

Check your bounce logs for the window before you go hunting for a deliverability problem that isn't there. Our guide to email bounce codes covers how to tell a transient 4xx from a reputation-driven 5xx.

Microsoft will throttle, then block, mail from unpatched Exchange 2016 and 2019

On September 2, the Exchange Team announced that Exchange Online will start enforcing a minimum patch level for on-premises servers that relay through hybrid connectors, beginning the second week of September. The floor is the October 2025 security update: Exchange 2016 CU23 SU19, or Exchange 2019 CU15 SU5 (CU14 with the October 2025 SU also qualifies). Servers below that baseline first appear in an admin center report, then have their mail throttled, then rejected outright. Only mail arriving over inbound connectors of type OnPremises is affected. Franky's Web has a clear walkthrough of the builds and stages.

Microsoft also says the next baseline bump "will be newer than any publicly available update," which means only customers on the Extended Security Update program, or those who have migrated to Exchange Subscription Edition, will keep qualifying. The ESU program for 2016 and 2019 itself ends in October 2026.

If you run hybrid Exchange and outbound mail to Microsoft 365 starts slowing down this month, check the server build before you check anything else.

German court: double opt-in logs alone don't prove consent

In a ruling from July 27 that was published on September 2, the Administrative Court of Düsseldorf upheld a data protection warning against a marketing company that could not prove it had consent to email its list. The company had records of the email address, an IP address with a date, and a double opt-in confirmation IP with a date. The court held that this combination is "unsuitable" as proof. An IP address identifies a device, not the person who owns the mailbox, and the company could not produce the confirmation email it claimed to store. Under GDPR Article 7(1), the burden of proving consent sits with the sender, and describing a compliant process counts for nothing if you cannot show it was followed. emailexpert has an English summary.

If you send to EU recipients, keep the actual confirmation email and the consent wording shown at signup, not just timestamps and IPs. Most ESPs can store this, but few do it by default. Our list hygiene guide covers what a defensible consent record looks like.

---

August 2026

Gmail opens a verified lane for political senders from September 8

On August 18, Google quietly published a help center page describing a verified sender program for US political committees, first reported by the New York Times. From September 8, any candidate, party, PAC, or other 527 committee registered with the FEC or a state, local, or tribal election authority can have its mail bypass Gmail's normal spam filtering, provided it meets a short list of conditions: domain verification through the nonpartisan Campaign Verify service, SPF and DKIM, a verified Postmaster Tools account, and a spam rate below 0.3% on a rolling 14-day average. Break the threshold and the committee gets a seven-day suspension, then permanent removal. Recipients keep their spam, block, and unsubscribe controls.

This is a resurrection of the 2022 pilot, which went through an FEC comment period, drew hundreds of negative responses, and was eventually shut down. This time there was no blog post, no press release, and no FEC petition, just a help page that landed under two months before the midterms. Spam Resource notes that dedicated IPs are not required.

For everyone else, two things matter. It is the first Gmail program that explicitly exempts a class of sender from normal filtering, and it hard-codes a 0.3% complaint rate over 14 days as the gate. Expect that number to become the benchmark people quote. Our complaint rate guide covers how to measure yours.

Apple keeps Hide My Email on icloud.com after all

An update to our July item. On August 24, Apple told developers that "after further consideration and reviewing community feedback, iCloud+ Hide My Email addresses will remain on icloud.com." The other half of the plan stands: new Sign in with Apple relay addresses will still move to private.icloud.com "starting later this year," and existing privaterelay.appleid.com addresses keep working and forwarding.

The reversal followed user backlash that a dedicated alias domain would make Hide My Email addresses trivial for sites to block. For senders, that means Hide My Email addresses stay indistinguishable from ordinary iCloud mailboxes, so there is no way to segment or suppress them by domain, and no reason to try. The only code change left is on the Sign in with Apple side. Make sure signup validation and any allowlists accept both private.icloud.com and privaterelay.appleid.com. Spam Resource has the sender's-eye view.

Microsoft cuts sending limits for new and trial Exchange Online tenants

Microsoft 365 message center post MC1454397, published August 14, sets out a tiered Tenant External Recipient Rate Limit (TERRL) for new tenants, rolling out from mid-September. Tenants under 31 days old get 10% of their calculated external recipient quota, tenants between 31 and 60 days old get 25%, and the full quota only unlocks after 60 days. Trial tenants drop from 5,000 to 500 external recipients per rolling 24 hours, regardless of how many trial licenses are attached. Mail over the limit bounces with 550 5.7.233 Message blocked due to tenant external recipient limit (5.7.232 for trial tenants). Merill's message center mirror has the full text, and emailexpert calls it what it is: a 60-day sending probation.

Microsoft repeats the line that Exchange Online "is not intended for bulk or high-volume email." If you spin up a fresh tenant for outreach, onboarding, or cold email, you will be throttled for two months, and a trial tenant is now useless for volume. Watch the "Tenant Outbound External Recipients Rate" report in the Exchange admin center, and move anything that looks like bulk to a proper ESP or transactional service.

Google Postmaster Tools v1 is gone, and reputation data with it

Google finally switched off the legacy Postmaster Tools interface around August 17. v1 links now redirect to v2 and the v1 API stopped returning data the same week, per Inbox Monster and Spam Resource. The removal was scripted and gradual, so some accounts kept v1 for a few days longer. Google's own help page still says the deprecation is postponed, which it isn't.

The practical loss is domain and IP reputation. The bad, low, medium, and high reputation charts do not exist in v2, which offers Compliance Status and the Deliverability Analysis section added in June instead. If you had dashboards, alerts, or scripts pulling from the v1 API, they are now silently empty. Late August also brought bugs adding new domains and users in v2 ("Unable to add user" on freshly verified domains), which Spam Resource reported were improving by the end of the month.

Rebuild your Gmail monitoring around the v2 API and the compliance dashboard, and treat spam rate as the primary signal now that reputation is gone.

Someone bought noreply.net and received 700 secrets a day

Security researcher Cory Solovewicz registered noreply.net and noreply.us and started receiving close to 700 delivery attempts a day: password resets, account credentials, loyalty points and stored-card access, and social media account controls, all sent by companies using a noreply address on a domain they do not own. Al Iverson at Spam Resource reports 600 or more daily attempts to a similar domain of his own.

The lesson is old but clearly not learned. Every From and Reply-To address you use must be on a domain you control and cover with DMARC. Anything else leaks replies, bounces, and whatever your customers type into them to whoever registers the domain next. See email authentication mistakes for the rest of the checklist.

---

July 2026

Apple moves Hide My Email and Sign in with Apple to a new domain

Apple has confirmed it is unifying the addresses behind Sign in with Apple and iCloud+ Hide My Email under a single domain, private.icloud.com, rolling out through summer 2026. Until now, Sign in with Apple issued relay addresses on privaterelay.appleid.com while Hide My Email handed out ordinary-looking @icloud.com addresses that were indistinguishable from real mailboxes. New addresses created after the switch move to the shared subdomain; existing ones keep working and keep forwarding.

For senders, the effect cuts two ways. Privacy researchers are unhappy because a masked address ending in @private.icloud.com is now trivially identifiable, defeating part of the point of a relay. But that same visibility is a gift to list hygiene: you can finally see how much of your list is Apple relay traffic instead of it hiding in your iCloud segment.

Resist the urge to block them. These are real subscribers whose mail forwards to a real inbox, and rejecting @private.icloud.com at signup or suppressing it in bulk will cost you engaged recipients. Treat relay addresses like any other real address: authenticate properly, watch engagement, and let the forwarding do its job. See spamresource's breakdown of what changes and what doesn't.

Google quietly trims its SPF include

Google has removed _netblocks3.google.com from its published SPF data, collapsing the old three-part chain (_netblocks, _netblocks2, _netblocks3) down to two. The retired sub-record no longer holds active sending IPs, so Google cleaned it up with no announcement.

If your record uses the recommended include:_spf.google.com, you need to do nothing. Google manages the nested includes for you and the change is invisible. The senders who get bitten are the ones who hard-coded the individual _netblocks includes into their own record years ago to shave a DNS lookup. Those records now reference a sub-record that may eventually stop resolving as expected.

The fix is the advice that always applied: don't copy Google's internal structure into your record. Replace any hard-coded _netblocks includes with a single include:_spf.google.com and let Google keep it current. While you are in there, confirm your total stays under the 10-lookup SPF limit. Our guide covers how to flatten safely.

AOL changes hands: Bending Spoons closes its Yahoo carve-out

Italy's Bending Spoons has completed its roughly $1.5 billion acquisition of AOL from Yahoo, financed in part by $2.8 billion in new debt. AOL Mail still counts tens of millions of active mailboxes, so this is a live consumer inbox changing owners, not just a nostalgia brand.

Bending Spoons has a track record of buying mature products (Evernote, WeTransfer, Meetup) and running them lean. For now nothing changes for senders: AOL continues to share Yahoo's authentication and complaint-rate requirements, and existing AOL addresses, logins, and mail flow are unaffected. But new ownership means new priorities, and deliverability rules or feedback loops could drift from Yahoo's over time.

Watch for divergence. If AOL's filtering, complaint feedback loop, or bulk-sender enforcement starts behaving differently from Yahoo's, your AOL segment is where you will see it first. Keep AOL broken out in your seed tests and postmaster monitoring rather than lumping it under "Yahoo."

---

June 2026

Google Postmaster Tools adds Deliverability Analysis

In early June 2026, Google began quietly rolling out a Deliverability Analysis view inside Postmaster Tools, with no formal announcement. Senders spotted it and compared notes. It changes how you diagnose problems. Instead of reading four separate dashboards and guessing how they relate, you get a consolidated assessment that pulls together authentication health, spam complaint activity, delivery errors, and sending pattern consistency in one place.

The point is speed to root cause. When placement drops, the old flow meant cross-referencing your SPF, DKIM, and DMARC status against complaint spikes and volume changes by hand. The new view surfaces which signal is dragging you down, in plainer language, so a marketing or ops team without a deliverability specialist can act on it.

It is a monitoring aid, not a fix. You still need the underlying authentication correct and your complaint rate under control. But for anyone sending to Gmail at volume, it is worth checking weekly alongside the spam rate dashboard, which remains the earliest warning that reputation is slipping. Set up Postmaster Tools for every sending domain if you haven't.

Microsoft retires the old SNDS portal on June 8

June 8, 2026 ended nearly twenty years of the Smart Network Data Services (SNDS) portal as senders knew it. Microsoft migrated SNDS, the dashboard that reports IP reputation, complaint activity, and spam trap hits for Outlook.com, Hotmail, and Live.com, to a new URL and a new data model.

The headaches are in the automation. The old automated access links (the sendersupport.olc.protection.outlook.com/snds/ URLs that scripts used to pull CSV reports) are being deprecated, with the cutover landing around June 22. Those links now expire after 30 days and return a 404 when they lapse. IP Status and IP Data move to a new REST API that uses OAuth and your SNDS login, and the report columns and underlying calculations changed, so any dashboard parsing fixed columns will break.

There is also a quieter shift to the Junk Mail Reporting Program (JMRP), Microsoft's complaint feedback loop. It is moving away from sharing full message content, leaning on headers and authentication data instead. If you monitor Outlook.com reputation, audit any scripts that hit SNDS, move to the REST API, and confirm your JMRP feed still parses.

---

May 2026

DMARCbis is official: RFCs 9989, 9990, and 9991 replace RFC 7489

May 20, 2026 is the day DMARC grew up. After more than seven years of working group effort, the IETF published the DMARCbis specifications as three Standards Track documents: RFC 9989 (the core protocol), RFC 9990 (aggregate reporting), and RFC 9991 (failure reporting). Together they replace RFC 7489, the 2015 Informational document that defined DMARC until now.

The headline changes match what we flagged in April. The pct tag is gone, along with rf and ri. A binary t (testing) flag replaces percentage-based rollout: t=y for test mode, t=n for enforcement. New np and psd tags handle non-existent subdomains and public suffix declarations. The biggest mechanical shift is the DNS Tree Walk, which replaces the Public Suffix List for finding the organizational domain. Receivers now query _dmarc up the domain tree, capped at eight lookups.

Nothing breaks today. Records still start with v=DMARC1, so existing setups keep working and there is no "DMARC2." But if you use pct for gradual rollout, plan to move to the t flag, and audit your subdomains, since the Tree Walk can surface forgotten intermediate records. See our guide on DMARC policy progression.

The new standard tells mailbox hosts to back off p=reject

Buried in RFC 9989 is a reversal of conventional advice. Section 7.4 states that domains "that host users who might post messages to mailing lists SHOULD NOT publish" a p=reject policy, because strict rejection breaks indirect mail flows like mailing lists and forwarding.

This does not mean p=reject is dead. For pure sending domains and parked domains that never originate human mail, reject is still the right call, and np=reject on unused subdomains is now explicitly encouraged. The nuance is about who you are. If real people send mail from your domain, the standard now favors p=quarantine as the safe enforcement end state.

If you pushed to p=reject on a domain with live mailboxes, this is your cue to reassess. Most receivers were already softening reject for forwarded mail, so aligning to p=quarantine rarely changes real-world outcomes while reducing collateral damage.

Validity benchmark shows inbox placement climbing

Validity's 2026 Email Deliverability Benchmark Report, drawn from trillions of inbox data points and published this spring, puts the global average inbox placement rate at 87.2%, up 3.7 percentage points year over year. The gain came mostly from fewer outright blocks and rejections, a sign that providers are extending more trust to senders who have done the authentication work.

Provider breakdown: Gmail rose to 89.8%, Yahoo to 87.3%, and Apple to 82.0%, helped by a halo effect as senders upgraded to satisfy other inboxes. Microsoft remains the toughest at 77.4%, though Validity expects that to improve through 2026 as senders fully comply with its bulk sender rules. Europe led all regions at 91.1%. The takeaway is consistent with what we have said: authentication plus engagement is winning, and the senders who did the groundwork in 2024 and 2025 are now seeing the payoff.

Barracuda: AI and Phishing-as-a-Service reshape the threat landscape

On May 12, 2026, Barracuda published its 2026 Email Threats Report, built on telemetry from more than 3.1 billion emails. The headline: one in three messages is now either malicious or unwanted spam, and 48% of malicious email is phishing. Generative AI and Phishing-as-a-Service (PhaaS) kits are the accelerant. Roughly 90% of high-volume phishing campaigns now run on PhaaS infrastructure, which lets attackers spin up clean, well-targeted messages at scale.

The tactics are shifting too. Attackers are moving from file-based payloads to URL-based delivery, and 70% of malicious PDFs now embed QR codes that bounce victims to phishing sites, sidestepping link scanners. Earlier in the year, Cofense reported a 204% jump in malware-carrying phishing, one malicious email slipping through roughly every 19 seconds.

For legitimate senders, the second-order effect is what matters. As spoofing and lookalike-domain attacks climb, mailbox providers lean harder on authentication and domain reputation to decide who to trust. That pressure is exactly why DMARC enforcement keeps gaining weight in inbox decisions. Get to enforcement so attackers can't spoof your domain, and keep SPF and DKIM aligned. See our guide on DMARC policy progression.

---

April 2026

Microsoft kills Basic Auth for SMTP on April 30

April 30, 2026 marks Microsoft's deadline for removing Basic Authentication from Exchange Online SMTP AUTH. Since March 1, Microsoft has been rejecting an increasing percentage of Basic Auth SMTP submissions, ramping up to 100% rejection on April 30.

After this date, applications and devices using username/password authentication for SMTP will stop working entirely. App passwords cannot be regenerated. Organizations must migrate to OAuth 2.0, Microsoft's High Volume Email service, or Azure Communication Services Email.

This primarily affects automated systems: scanners, printers, legacy CRMs, and custom apps that send email through Microsoft 365 via SMTP. If your infrastructure sends transactional email through Exchange Online, verify your authentication method now.

DMARCbis standard nears publication

The successor to RFC 7489, known as DMARCbis, is expected to land as a Proposed Standard in 2026. The most significant change: the pct tag is removed entirely. Most receivers only ever respected pct=0 or pct=100, ignoring intermediate values or applying them unpredictably.

In its place, a binary t (testing) flag:

• t=y: policy is in test mode, no enforcement
• t=n: full enforcement

Other removed tags include rf and ri. New tags include np (non-existent subdomain policy) and psd (public suffix domain). Records still use v=DMARC1, so this is not a breaking change, and there is no "DMARC2."

If you're currently using pct for gradual rollout, plan to switch to the t flag once DMARCbis is formally published. See our guide on DMARC policy progression.

BIMI adoption still low despite growing support

Despite 72% email client support, only 8% of domains have a BIMI DNS record and less than 1% have a Verified Mark Certificate (VMC). The barrier remains cost (VMCs run $1,500+ annually) and the prerequisite of DMARC enforcement at p=quarantine or p=reject, which 36% of senders still haven't achieved.

That said, BIMI is increasingly tied to deliverability outcomes, not just branding. Strong DMARC enforcement combined with BIMI can reduce successful phishing attempts by approximately 60%, which providers factor into reputation scoring. Gmail and Yahoo have the most consistent BIMI support. If you're already at DMARC enforcement, setting up BIMI is worth the investment.

Inbox placement gap widens

Recent industry data shows a disconnect: despite a global deliverability health score of 86/100, only about 60-65% of emails actually reach a visible inbox location. The gap confirms what providers have signaled for years. Technical authentication is necessary but not sufficient.

ISPs now layer behavioral signals (opens, clicks, replies, complaints) on top of authentication checks. Perfect SPF, DKIM, and DMARC with poor engagement still gets you filtered. The Asia-Pacific region shows the widest variation, with India at approximately 70% deliverability due to shared IP infrastructure and inconsistent authentication.

---

March 2026

Authentication is now table stakes everywhere

As of early 2026, SPF, DKIM, and DMARC are no longer optional for any sender at meaningful volume. Google, Yahoo, and Microsoft all enforce authentication requirements. The era of sending unauthenticated email to major providers is over.

If your domain doesn't have all three protocols configured and aligned, you're already losing mail. Use our free deliverability checker to test your setup.

---

May 2025

Microsoft enters the enforcement game

On May 5, 2025, Microsoft began enforcing bulk sender requirements for Outlook.com, Hotmail.com, and Live.com. Senders sending 5,000+ emails per day must now have:

• SPF configured with accurate authorized IP addresses
• DKIM signatures validating email integrity
• DMARC published at minimum p=none, aligned with SPF or DKIM

Non-compliant messages go to Junk first. If left unaddressed, Microsoft will block them outright with error code 550 5.7.515.

This matters because Microsoft had been the last major provider without formal bulk sender enforcement. With Google, Yahoo, and now Microsoft all requiring authentication, there's nowhere left to hide.

What to do: Check your SPF, test your DKIM, and verify your DMARC. If you're sending to corporate Outlook/365 addresses, be aware that enterprise filtering (Mimecast, Proofpoint, Barracuda) may apply additional rules beyond Microsoft's baseline.

---

Late 2024 and Early 2025

Gmail ramps up enforcement to rejections

From November 2024 onwards, Google escalated enforcement of its bulk sender requirements from warnings to active rejections. Messages from non-compliant senders that previously landed in spam now bounce with permanent failures.

Key thresholds Google enforces:

• Spam complaint rate must stay below 0.3% (Google recommends below 0.1%)
• SPF, DKIM, and DMARC all required for 5,000+ daily senders
• One-click unsubscribe required in marketing emails
• TLS encryption expected for message transmission

If your bounce rates spiked in late 2024, Gmail enforcement is the likely cause. Check your DMARC alignment and ensure all sending services are properly authenticated.

Yahoo mirrors Google's requirements

Yahoo and AOL aligned their sender requirements with Google's, requiring the same SPF, DKIM, DMARC authentication and spam rate thresholds. The 0.3% complaint rate ceiling applies across both providers.

---

September 2024

Apple Mail Privacy Protection continues to reshape metrics

Apple Mail Privacy Protection (MPP), active since iOS 15, now affects over 95% of Apple Mail users. With Apple Mail representing roughly half of all email opens globally, open rates are fundamentally unreliable as a deliverability metric.

What this means in practice:

• Open-based automations (re-engagement sequences, A/B tests on subject lines) produce misleading data
• Click-through rates and conversions are now the reliable engagement signals
• Sunset policies based on "last opened" dates will incorrectly suppress active subscribers on Apple devices

This isn't new, but many senders still haven't adapted their measurement. If you're still using open rates as your primary deliverability indicator, it's time to shift to clicks.

iOS 18 introduces AI-powered inbox changes

Apple's iOS 18 brought AI-generated email previews, new inbox categorization, branded sender icons, and digest-style views to Apple Mail. These changes affect how recipients interact with email. Categorized inboxes mean your marketing emails compete for attention differently than before.

---

February 2024

Google and Yahoo announce bulk sender requirements

On February 1, 2024, Google and Yahoo's bulk sender requirements took effect, marking the biggest shift in email authentication enforcement in years. For the first time, major inbox providers formally required DMARC for high-volume senders.

The initial enforcement was soft: warnings and spam folder placement rather than outright rejection. This gave senders a runway to comply. That runway closed through 2024 and into 2025 as enforcement escalated.

The requirements that changed everything:

• SPF authentication required
• DKIM signing required
• DMARC policy at minimum p=none
• One-click unsubscribe for marketing email
• Spam complaint rate under 0.3%

If you're still running p=none and haven't planned your progression to p=quarantine or p=reject, see our guide on DMARC policy progression.

---

What to watch for the rest of 2026

• DMARCbis receiver adoption. The RFCs are published, but receivers will migrate to the DNS Tree Walk and the t flag at their own pace. Watch your aggregate reports for discovery_method=treewalk to see who has switched.
• p=none becoming a liability. Providers increasingly treat p=none as a weak signal. Move toward enforcement, but per RFC 9989, prefer p=quarantine over p=reject if real people send mail from your domain.
• BIMI cost reduction. As adoption pressure grows, watch for more affordable VMC options and expanded provider support beyond Gmail and Yahoo.
• ARC (Authenticated Received Chain). Becoming more important as email forwarding and mailing list scenarios need authentication preservation.
• DKIM2. The IETF working group revised the core spec twice in the last week of August (drafts -05 and -06), adding SHA-512 hashing and guidance for verifiers on detecting replayed messages, and a companion draft now defines how DKIM2 results appear in Authentication-Results headers. The authors are from Yahoo, Google, and Fastmail, which tells you who will run it first. There is still no working group last call, so nothing to deploy yet. Track the dkim working group.
• MTA-STS adoption. More organizations requiring encrypted email transport via MTA-STS, preventing downgrade attacks.
• Google Gmailify and POP shutdown. Google's help page now gives a date. No new users after Q1 2026, and existing users can keep using "Check mail from other accounts" until January 2027. If you rely on Gmail to pull in external mailboxes, move to IMAP in the Gmail apps or to forwarding before then.
• Exchange 2016 and 2019 reach the end. Extended Security Updates for both end in October 2026, and Exchange Online's minimum patch baseline for hybrid relays will keep rising past anything publicly available. Hybrid customers who have not moved to Exchange Subscription Edition should plan for throttling.
• Gmail's political sender lane. The verified program starts September 8 with a 0.3% complaint rate over 14 days as the only ongoing test. Watch whether Google publishes any data on it, and whether that threshold starts appearing in guidance for everyone else.

---

This page is updated regularly. Last updated September 6, 2026.