Email Deliverability News

Email deliverability changes fast. Gmail tightens enforcement. Microsoft adds new requirements. Yahoo updates thresholds. Miss an update and your emails start bouncing.

This page tracks the changes that matter across Gmail, Yahoo, Microsoft, and the major authentication standards. Updated regularly with provider policy changes, bulk sender enforcement updates, and industry developments that affect whether your emails reach the inbox.

Bookmark this page. When something breaks, check here first.

Don't wait for the news to find you

Monitor your SPF, DKIM, DMARC, and blacklist status automatically. Get alerts when something changes.

June 2026

Google Postmaster Tools adds Deliverability Analysis

In early June 2026, Google began quietly rolling out a Deliverability Analysis view inside Postmaster Tools, with no formal announcement. Senders spotted it and compared notes. It changes how you diagnose problems. Instead of reading four separate dashboards and guessing how they relate, you get a consolidated assessment that pulls together authentication health, spam complaint activity, delivery errors, and sending pattern consistency in one place.

The point is speed to root cause. When placement drops, the old flow meant cross-referencing your SPF, DKIM, and DMARC status against complaint spikes and volume changes by hand. The new view surfaces which signal is dragging you down, in plainer language, so a marketing or ops team without a deliverability specialist can act on it.

It is a monitoring aid, not a fix. You still need the underlying authentication correct and your complaint rate under control. But for anyone sending to Gmail at volume, it is worth checking weekly alongside the spam rate dashboard, which remains the earliest warning that reputation is slipping. Set up Postmaster Tools for every sending domain if you haven't.

Microsoft retires the old SNDS portal on June 8

June 8, 2026 ended nearly twenty years of the Smart Network Data Services (SNDS) portal as senders knew it. Microsoft migrated SNDS, the dashboard that reports IP reputation, complaint activity, and spam trap hits for Outlook.com, Hotmail, and Live.com, to a new URL and a new data model.

The headaches are in the automation. The old automated access links (the sendersupport.olc.protection.outlook.com/snds/ URLs that scripts used to pull CSV reports) are being deprecated, with the cutover landing around June 22. Those links now expire after 30 days and return a 404 when they lapse. IP Status and IP Data move to a new REST API that uses OAuth and your SNDS login, and the report columns and underlying calculations changed, so any dashboard parsing fixed columns will break.

There is also a quieter shift to the Junk Mail Reporting Program (JMRP), Microsoft's complaint feedback loop. It is moving away from sharing full message content, leaning on headers and authentication data instead. If you monitor Outlook.com reputation, audit any scripts that hit SNDS, move to the REST API, and confirm your JMRP feed still parses.

May 2026

DMARCbis is official: RFCs 9989, 9990, and 9991 replace RFC 7489

May 20, 2026 is the day DMARC grew up. After more than seven years of working group effort, the IETF published the DMARCbis specifications as three Standards Track documents: RFC 9989 (the core protocol), RFC 9990 (aggregate reporting), and RFC 9991 (failure reporting). Together they replace RFC 7489, the 2015 Informational document that defined DMARC until now.

The headline changes match what we flagged in April. The pct tag is gone, along with rf and ri. A binary t (testing) flag replaces percentage-based rollout: t=y for test mode, t=n for enforcement. New np and psd tags handle non-existent subdomains and public suffix declarations. The biggest mechanical shift is the DNS Tree Walk, which replaces the Public Suffix List for finding the organizational domain. Receivers now query _dmarc up the domain tree, capped at eight lookups.

Nothing breaks today. Records still start with v=DMARC1, so existing setups keep working and there is no "DMARC2." But if you use pct for gradual rollout, plan to move to the t flag, and audit your subdomains, since the Tree Walk can surface forgotten intermediate records. See our guide on DMARC policy progression.

The new standard tells mailbox hosts to back off p=reject

Buried in RFC 9989 is a reversal of conventional advice. Section 7.4 states that domains "that host users who might post messages to mailing lists SHOULD NOT publish" a p=reject policy, because strict rejection breaks indirect mail flows like mailing lists and forwarding.

This does not mean p=reject is dead. For pure sending domains and parked domains that never originate human mail, reject is still the right call, and np=reject on unused subdomains is now explicitly encouraged. The nuance is about who you are. If real people send mail from your domain, the standard now favors p=quarantine as the safe enforcement end state.

If you pushed to p=reject on a domain with live mailboxes, this is your cue to reassess. Most receivers were already softening reject for forwarded mail, so aligning to p=quarantine rarely changes real-world outcomes while reducing collateral damage.

Validity benchmark shows inbox placement climbing

Validity's 2026 Email Deliverability Benchmark Report, drawn from trillions of inbox data points and published this spring, puts the global average inbox placement rate at 87.2%, up 3.7 percentage points year over year. The gain came mostly from fewer outright blocks and rejections, a sign that providers are extending more trust to senders who have done the authentication work.

Provider breakdown: Gmail rose to 89.8%, Yahoo to 87.3%, and Apple to 82.0%, helped by a halo effect as senders upgraded to satisfy other inboxes. Microsoft remains the toughest at 77.4%, though Validity expects that to improve through 2026 as senders fully comply with its bulk sender rules. Europe led all regions at 91.1%. The takeaway is consistent with what we have said: authentication plus engagement is winning, and the senders who did the groundwork in 2024 and 2025 are now seeing the payoff.

Barracuda: AI and Phishing-as-a-Service reshape the threat landscape

On May 12, 2026, Barracuda published its 2026 Email Threats Report, built on telemetry from more than 3.1 billion emails. The headline: one in three messages is now either malicious or unwanted spam, and 48% of malicious email is phishing. Generative AI and Phishing-as-a-Service (PhaaS) kits are the accelerant. Roughly 90% of high-volume phishing campaigns now run on PhaaS infrastructure, which lets attackers spin up clean, well-targeted messages at scale.

The tactics are shifting too. Attackers are moving from file-based payloads to URL-based delivery, and 70% of malicious PDFs now embed QR codes that bounce victims to phishing sites, sidestepping link scanners. Earlier in the year, Cofense reported a 204% jump in malware-carrying phishing, one malicious email slipping through roughly every 19 seconds.

For legitimate senders, the second-order effect is what matters. As spoofing and lookalike-domain attacks climb, mailbox providers lean harder on authentication and domain reputation to decide who to trust. That pressure is exactly why DMARC enforcement keeps gaining weight in inbox decisions. Get to enforcement so attackers can't spoof your domain, and keep SPF and DKIM aligned. See our guide on DMARC policy progression.

April 2026

Microsoft kills Basic Auth for SMTP on April 30

April 30, 2026 marks Microsoft's deadline for removing Basic Authentication from Exchange Online SMTP AUTH. Since March 1, Microsoft has been rejecting an increasing percentage of Basic Auth SMTP submissions, ramping up to 100% rejection on April 30.

After this date, applications and devices using username/password authentication for SMTP will stop working entirely. App passwords cannot be regenerated. Organizations must migrate to OAuth 2.0, Microsoft's High Volume Email service, or Azure Communication Services Email.

This primarily affects automated systems: scanners, printers, legacy CRMs, and custom apps that send email through Microsoft 365 via SMTP. If your infrastructure sends transactional email through Exchange Online, verify your authentication method now.

DMARCbis standard nears publication

The successor to RFC 7489, known as DMARCbis, is expected to land as a Proposed Standard in 2026. The most significant change: the pct tag is removed entirely. Most receivers only ever respected pct=0 or pct=100, ignoring intermediate values or applying them unpredictably.

In its place, a binary t (testing) flag:

t=y: policy is in test mode, no enforcement
t=n: full enforcement

Other removed tags include rf and ri. New tags include np (non-existent subdomain policy) and psd (public suffix domain). Records still use v=DMARC1, so this is not a breaking change, and there is no "DMARC2."

If you're currently using pct for gradual rollout, plan to switch to the t flag once DMARCbis is formally published. See our guide on DMARC policy progression.

BIMI adoption still low despite growing support

Despite 72% email client support, only 8% of domains have a BIMI DNS record and less than 1% have a Verified Mark Certificate (VMC). The barrier remains cost (VMCs run $1,500+ annually) and the prerequisite of DMARC enforcement at p=quarantine or p=reject, which 36% of senders still haven't achieved.

That said, BIMI is increasingly tied to deliverability outcomes, not just branding. Strong DMARC enforcement combined with BIMI can reduce successful phishing attempts by approximately 60%, which providers factor into reputation scoring. Gmail and Yahoo have the most consistent BIMI support. If you're already at DMARC enforcement, setting up BIMI is worth the investment.

Inbox placement gap widens

Recent industry data shows a disconnect: despite a global deliverability health score of 86/100, only about 60-65% of emails actually reach a visible inbox location. The gap confirms what providers have signaled for years. Technical authentication is necessary but not sufficient.

ISPs now layer behavioral signals (opens, clicks, replies, complaints) on top of authentication checks. Perfect SPF, DKIM, and DMARC with poor engagement still gets you filtered. The Asia-Pacific region shows the widest variation, with India at approximately 70% deliverability due to shared IP infrastructure and inconsistent authentication.

March 2026

Authentication is now table stakes everywhere

As of early 2026, SPF, DKIM, and DMARC are no longer optional for any sender at meaningful volume. Google, Yahoo, and Microsoft all enforce authentication requirements. The era of sending unauthenticated email to major providers is over.

If your domain doesn't have all three protocols configured and aligned, you're already losing mail. Use our free deliverability checker to test your setup.

May 2025

Microsoft enters the enforcement game

On May 5, 2025, Microsoft began enforcing bulk sender requirements for Outlook.com, Hotmail.com, and Live.com. Senders sending 5,000+ emails per day must now have:

SPF configured with accurate authorized IP addresses
DKIM signatures validating email integrity
DMARC published at minimum p=none, aligned with SPF or DKIM

Non-compliant messages go to Junk first. If left unaddressed, Microsoft will block them outright with error code 550 5.7.515.

This matters because Microsoft had been the last major provider without formal bulk sender enforcement. With Google, Yahoo, and now Microsoft all requiring authentication, there's nowhere left to hide.

What to do: Check your SPF, test your DKIM, and verify your DMARC. If you're sending to corporate Outlook/365 addresses, be aware that enterprise filtering (Mimecast, Proofpoint, Barracuda) may apply additional rules beyond Microsoft's baseline.

Late 2024 and Early 2025

Gmail ramps up enforcement to rejections

From November 2024 onwards, Google escalated enforcement of its bulk sender requirements from warnings to active rejections. Messages from non-compliant senders that previously landed in spam now bounce with permanent failures.

Key thresholds Google enforces:

Spam complaint rate must stay below 0.3% (Google recommends below 0.1%)
SPF, DKIM, and DMARC all required for 5,000+ daily senders
One-click unsubscribe required in marketing emails
TLS encryption expected for message transmission

If your bounce rates spiked in late 2024, Gmail enforcement is the likely cause. Check your DMARC alignment and ensure all sending services are properly authenticated.

Yahoo mirrors Google's requirements

Yahoo and AOL aligned their sender requirements with Google's, requiring the same SPF, DKIM, DMARC authentication and spam rate thresholds. The 0.3% complaint rate ceiling applies across both providers.

September 2024

Apple Mail Privacy Protection continues to reshape metrics

Apple Mail Privacy Protection (MPP), active since iOS 15, now affects over 95% of Apple Mail users. With Apple Mail representing roughly half of all email opens globally, open rates are fundamentally unreliable as a deliverability metric.

What this means in practice:

Open-based automations (re-engagement sequences, A/B tests on subject lines) produce misleading data
Click-through rates and conversions are now the reliable engagement signals
Sunset policies based on "last opened" dates will incorrectly suppress active subscribers on Apple devices

This isn't new, but many senders still haven't adapted their measurement. If you're still using open rates as your primary deliverability indicator, it's time to shift to clicks.

iOS 18 introduces AI-powered inbox changes

Apple's iOS 18 brought AI-generated email previews, new inbox categorization, branded sender icons, and digest-style views to Apple Mail. These changes affect how recipients interact with email. Categorized inboxes mean your marketing emails compete for attention differently than before.

February 2024

Google and Yahoo announce bulk sender requirements

On February 1, 2024, Google and Yahoo's bulk sender requirements took effect, marking the biggest shift in email authentication enforcement in years. For the first time, major inbox providers formally required DMARC for high-volume senders.

The initial enforcement was soft: warnings and spam folder placement rather than outright rejection. This gave senders a runway to comply. That runway closed through 2024 and into 2025 as enforcement escalated.

The requirements that changed everything:

SPF authentication required
DKIM signing required
DMARC policy at minimum p=none
One-click unsubscribe for marketing email
Spam complaint rate under 0.3%

If you're still running p=none and haven't planned your progression to p=quarantine or p=reject, see our guide on DMARC policy progression.

What to watch for the rest of 2026

DMARCbis receiver adoption. The RFCs are published, but receivers will migrate to the DNS Tree Walk and the t flag at their own pace. Watch your aggregate reports for discovery_method=treewalk to see who has switched.
p=none becoming a liability. Providers increasingly treat p=none as a weak signal. Move toward enforcement, but per RFC 9989, prefer p=quarantine over p=reject if real people send mail from your domain.
BIMI cost reduction. As adoption pressure grows, watch for more affordable VMC options and expanded provider support beyond Gmail and Yahoo.
ARC (Authenticated Received Chain). Becoming more important as email forwarding and mailing list scenarios need authentication preservation.
MTA-STS adoption. More organizations requiring encrypted email transport via MTA-STS, preventing downgrade attacks.
Google Gmailify and POP shutdown. Google stopped new Gmailify signups in Q1 2026 and will shut down POP-based "Check mail from other accounts" later this year. Users relying on Gmail to aggregate external accounts need to migrate to IMAP-based solutions.

This page is updated regularly. Last updated June 22, 2026.

Email Deliverability News: Latest Updates and Changes