If your order confirmations, password resets or newsletter are landing in spam, or not arriving at all, the usual instinct is to blame the subject line or how often you send. For most small-business domains in 2026, the real cause sits lower down: Gmail, Yahoo and Outlook now check whether your domain authenticates its mail with SPF, DKIM and DMARC, and each has moved from quietly filtering non-compliant mail to rejecting it outright. None of this requires a mail server. It requires three DNS records, set up in the right order, and revisited every time you add a new sending tool.
Every sender needs SPF or DKIM to pass with Gmail, Yahoo/AOL and Outlook/Hotmail/Live. Anyone sending roughly 5,000 or more messages a day to personal accounts on any one of them also needs a DMARC record, aligned with SPF or DKIM, plus a one-click unsubscribe on marketing mail and a spam complaint rate under 0.3%. Google said it began ramping up enforcement to temporary and permanent rejections from November 2025; Microsoft's equivalent requirement for Outlook.com addresses took effect on 5 May 2025. If your domain has no DMARC record, or your SPF record calls more than 10 other DNS lookups, that is very likely why mail is bouncing or disappearing into spam, whether or not you think of yourself as a "bulk" sender.
What actually changed, and why it hits you even at small volume
SPF, DKIM and DMARC have existed for years as optional best practice. What changed is enforcement: Google and Yahoo started treating them as a requirement for bulk senders from February 2024, and Microsoft followed with its own threshold for Outlook.com, Hotmail and Live addresses from 5 May 2025. Google's help pages now describe a deliberate escalation, moving non-compliant mail from filtering into temporary and then permanent rejection from November 2025 onward.
The volume threshold that triggers the stricter bulk-sender rules is roughly 5,000 messages in 24 hours to personal accounts, counted across your whole sending domain rather than per tool. That sounds like it excludes most small businesses, and for ordinary weeks it often does. The number gets crossed anyway when a marketing blast lands on the same day as a batch of order confirmations and abandoned-cart emails, which is exactly the kind of day a sale depends on. More importantly, SPF or DKIM failure — the baseline requirement for every sender, not just bulk ones — is the more common reason small-business mail gets filtered in the first place, regardless of volume.
Gmail, Yahoo and Outlook, side by side
Coverage of these rules online routinely blends the three providers together or applies one company's dates to another. They enforce independently, with different thresholds and different consequences for failing.
| Requirement | Gmail (personal accounts) | Yahoo & AOL | Outlook, Hotmail & Live |
|---|---|---|---|
| Minimum for every sender | SPF or DKIM must pass | SPF and DKIM expected to pass | SPF or DKIM expected to pass |
| Threshold for stricter bulk rules | ~5,000 msgs/24h to personal accounts, combined across your domain | No published figure; guidance mirrors Gmail's | >5,000 msgs/day to Outlook.com addresses, effective 5 May 2025 |
| Bulk sender requirement | SPF + DKIM + DMARC (p=none minimum) | SPF + DKIM + DMARC (p=none minimum); DKIM key ≥1024-bit | SPF pass + DKIM pass + DMARC (p=none minimum) |
| DMARC alignment | Required | Required | Recommended, increasingly enforced |
| Spam complaint ceiling | Under 0.3% | Under 0.3% | Not published; high complaints trigger throttling |
| One-click unsubscribe | Required on bulk/marketing mail, honoured within 2 days | Required, honoured within 2 days | Recommended |
| What non-compliance does | Temporary, then permanent rejection (escalated from Nov 2025) | Filtered to spam or throttled via Sender Hub | Routed to Junk, then rejected (SMTP 550 5.7.515) |
| Where to check your status | Google Postmaster Tools | Yahoo Sender Hub (senders.yahooinc.com) | SNDS + your DMARC aggregate reports |
Match the symptom to the actual cause
"Check your DNS records" is correct but not specific enough to fix anything quickly. These are the patterns that show up most often on small-business domains, and what each one usually means.
| What you're seeing | What's actually wrong | Fix first |
|---|---|---|
| Marketing emails land in spam; order confirmations arrive fine | DMARC missing or not aligned, or your complaint rate is high from the marketing list specifically | Publish DMARC at p=none, check your complaint rate, and clean inactive subscribers before sending again |
| Mail bounces to Outlook, Hotmail or Live addresses only | Your domain fails Microsoft's bar specifically; Microsoft enforces independently of Google | Trace a message header sent to an Outlook.com address and confirm SPF and DKIM pass for that exact path |
| Delivery to Gmail stopped the same day you added a new sending tool | Your SPF record passed 10 DNS lookups and now returns PermError, which fails SPF for everyone | Consolidate every "include:" into one SPF record and flatten it if it's still over 10 lookups |
| One app's email from your domain bounces; another's doesn't | Only one of your sending tools has a DKIM selector published in your DNS | Add a DKIM record for every service that sends as your domain — ESP, help desk, invoicing, form plugin |
| Delivery was fine for years, now intermittently fails after a sale or campaign | Daily volume briefly crossed the bulk-sender threshold and DMARC wasn't in place to cover it | Treat DMARC as required infrastructure even on days you don't expect to hit 5,000 sends |
The order that actually fixes it
Doing these out of order is the most common way a DNS change breaks mail that was working. Publishing DMARC at enforcement strength before confirming every legitimate sender passes is the single biggest cause of real customer email getting silently dropped.
- Check your current state before changing anything. Run the domain through Google Postmaster Tools and a free checker such as MXToolbox or Google's Admin Toolbox.
- Fix SPF as one record. List every service that sends as your domain — your email platform, Shopify, a help desk, an invoicing tool, a contact-form plugin — as one combined chain, and keep it under 10 DNS lookups or the whole record fails.
- Add DKIM for every sending service, not just one. Each platform issues its own selector; skip one and that platform's mail is unauthenticated even though DKIM "works" for everything else.
- Publish DMARC at p=none first. This changes nothing about delivery. It only turns on reporting, so you can see which senders pass and which fail before anything is rejected.
- Read the aggregate reports for two to four weeks. Fix any legitimate sender showing a failure before tightening the policy at all.
- Move to p=quarantine, then p=reject only once every legitimate sender passes consistently. Jumping straight to reject is what drops real customer mail.
- Add List-Unsubscribe and List-Unsubscribe-Post headers to anything that counts as bulk or marketing mail, and make sure requests clear within two days.
- Recheck after each change, not in a batch. Gmail, Yahoo and Outlook enforce independently, so passing with one confirms nothing about the others.
If you run a Shopify or WordPress store
Shopify's own sending domain authenticates order-confirmation and shipping emails correctly by default. The gap shows up as soon as marketing mail goes out through Shopify Email, Klaviyo or Mailchimp, because that's a separate sending path that needs its own DKIM record in your DNS even though "Shopify" already looks authenticated for transactional mail. Our Shopify development work includes auditing exactly this before a store depends on abandoned-cart or marketing email. WordPress sites relying on the server's default PHP mail function almost never pass SPF or DKIM at all, which is why contact-form notifications and WooCommerce order emails are a common, silent failure point; routing them through a transactional provider with its own DNS entry is the fix, not a plugin that changes how the message looks. It's the kind of DNS and infrastructure detail that belongs in any proper website design and development handover, not left for a client to discover when a customer says they never got their receipt.
Frequently asked questions
What is a DMARC record and do I actually need one?
DMARC tells inboxes what to do with mail that fails SPF or DKIM, and whether the result has to line up with your visible From address. Gmail and Yahoo require at least a DMARC record set to p=none from any domain sending roughly 5,000 or more messages a day to personal accounts. Below that volume it isn't mandatory, but it's the only way to see authentication failures in aggregate reports before they turn into rejections, so it's worth publishing regardless of how much you send.
How many emails do I have to send before Gmail's and Yahoo's bulk sender rules apply to me?
Gmail's published threshold is roughly 5,000 messages within a 24-hour period to personal Gmail and Googlemail addresses, counted across your whole sending domain rather than per tool. Microsoft applies the same 5,000-a-day figure to Outlook.com addresses, effective since 5 May 2025. Yahoo hasn't published its own number, but its guidance mirrors Gmail's, so treat 5,000 a day as the practical line for all three. Combined marketing and transactional volume can cross it during a sale even if neither alone would.
Why did my emails suddenly start bouncing when nothing changed on my end?
The most likely cause is that the provider's enforcement changed, not your setup. Google said it began ramping up enforcement against non-compliant mail from November 2025, moving from filtering to temporary and permanent rejections. Microsoft's equivalent requirement took effect on 5 May 2025. A domain that was authenticated correctly before an enforcement date and never revisited since can start failing now without any new sends on your side.
What is the difference between SPF, DKIM and DMARC?
SPF is a DNS record listing which mail servers are allowed to send on behalf of your domain. DKIM adds a cryptographic signature to each message so a receiving server can confirm it wasn't altered in transit and really came from where it claims. DMARC sits on top of both: it requires the visible From address to align with either a passing SPF check or a passing DKIM signature, and it tells inboxes what to do when that alignment fails, from doing nothing to rejecting the message outright.
Do these rules apply to transactional email like order confirmations and password resets?
Yes. Gmail, Yahoo and Outlook's authentication requirements don't exempt transactional mail; Gmail's only carve-out is for messages sent to Google Workspace accounts rather than personal Gmail addresses. A password-reset or order-confirmation email that fails SPF and DKIM is exactly as likely to be rejected or filtered as a newsletter sent to the same inbox.
The takeaway
Authentication, not content, is now the main reason legitimate small-business email fails to arrive. Gmail, Yahoo and Outlook each enforce SPF, DKIM and DMARC independently, on their own thresholds and timelines, so a fix that clears one inbox provider doesn't confirm the others. Work through SPF, then DKIM for every sending tool, then DMARC in monitor mode before enforcement, and revisit all three the next time you add a new tool that sends as your domain — that's the point most setups quietly break again.