Email marketing in 2026: the new rules of deliverability and engagement

An email that never reaches the inbox is worth nothing, however good it is. Since February 2024, the largest mailbox providers have turned what used to be best practice into rules: authentication, one-click unsubscribe, a spam-complaint ceiling. In 2025 Microsoft followed. This article sets out those rules as the providers publish them, with links, then what follows for segmentation, automation and measurement. It was first published on 10 June 2026 and revised on 17 October 2026: figures we could not trace to a source have been removed.

Deliverability: the gate everything else depends on

The rules depend on volume. Gmail defines a bulk sender as one sending more than 5,000 messages a day to Gmail accounts; Microsoft uses the same threshold for Outlook.com, Hotmail and Live addresses.

Requirement	Gmail	Yahoo	Outlook.com
Applies from	1 February 2024	February 2024, phased in over the first half of the year	5 May 2025
SPF and DKIM	Both for bulk senders (SPF or DKIM for all senders)	Both	Both
DMARC	Required for bulk senders; the policy can be p=none	A valid policy, at least p=none, that passes	Required, aligned with SPF or DKIM
Alignment	The From: domain aligned with the SPF or DKIM domain	Same	Same
One-click unsubscribe	Required for marketing and subscribed messages, with a visible link in the body (RFC 8058 headers)	Required, and unsubscribes honoured within 2 days	Expected for bulk mail
Spam complaints	Below 0.3% in Postmaster Tools; aim for below 0.1%	Below 0.3%	-
Sources: Google email sender guidelines; Yahoo sender best practices; Microsoft, requirements for high-volume senders (announced in April 2025; per coverage of the announcement, non-compliant mail first goes to Junk). Read on 17 October 2026.

Google also requires all senders to use TLS, to have valid forward and reverse DNS for their sending IPs, and to format messages according to RFC 5322. And it states that DKIM keys must be at least 1024 bits, 2048 recommended.

The three records, in plain terms

DNS record	What it does	How it is set up
SPF	Lists the servers allowed to send email for your domain.	One TXT record listing your senders, including your email platform.
DKIM	Signs each message cryptographically, proving it was not altered and comes from your domain.	Your email platform provides the public key to publish in DNS.
DMARC	Tells receivers what to do when SPF and DKIM fail, and sends you reports.	Start with p=none to collect reports, then tighten.

The DMARC rollout deserves patience. Start with p=none and read the reports: they show every service sending mail under your name, and forgotten tools, old CRMs or billing systems often turn up. Once every legitimate sender passes, move to p=quarantine, then p=reject. Jumping straight to reject is the fastest way to block your own transactional email silently.

Reputation: the score you never see

Authentication gets you to the door; reputation decides whether you get in. Mailbox providers score a sending domain on how recipients react, and spam complaints weigh most, hence the 0.3% ceiling above. Three consequences follow. Make unsubscribing effortless: a one-click exit costs less than a frustrated reader pressing "spam". Warm up a new sending domain gradually instead of mailing the whole list on day one. And keep transactional email (receipts, password resets) on a separate subdomain from campaigns, so a promotional misstep never takes critical messages down with it.

Segmentation: the end of the identical blast

Since providers watch engagement, an email nobody opens is not just wasted, it teaches the filters that your messages can be ignored. Segmentation becomes a deliverability tool, not only a conversion tactic. Useful criteria:

• pages and products viewed on your site;
• purchase history and order value;
• email engagement (opened, clicked, ignored);
• lifecycle stage (new subscriber, active customer, dormant contact);
• sign-up source (checkout, content download, event).

Personalisation goes beyond a first name: content blocks, offers and images that adapt to each contact's data. Its value depends entirely on the quality of the data you collect and how you use it.

Automation: the sequences that do the work

Automated sequences fire when a contact signals intent, which is why they carry most of an email programme's results. Three matter most.

The welcome sequence

New subscribers are at their most attentive. A short series over the first days, who you are, your most useful content, then an offer, beats a single confirmation email followed by silence.

Nurturing

A series of educational emails over several weeks accompanies a prospect's decision. Each message should stand on its own, a practical tip, a case, a guide, and close with a light call to action.

Abandoned cart

In e-commerce, a first email shortly after abandonment should remove friction: show the items, answer objections, restate delivery and return terms. Keep any discount for a later message, or you teach customers to abandon on purpose. The recovery email is only as strong as the page it links back to.

List hygiene

Contacts who have ignored everything for months drag down the engagement signals providers use to score you. Run a short win-back series, and if nothing comes back, remove those addresses. A smaller list that opens and clicks out-delivers a large list of ghosts.

Measurement: why opens are no longer a reliable signal

Open rates have lost much of their meaning. With Apple's Mail Privacy Protection turned on, remote content, tracking pixels included, is downloaded privately in the background when a message is received, not when it is viewed, and the reader's IP address is hidden (Apple, Mail on Mac). An "open" can therefore mean that a message arrived. Base decisions on clicks, conversions, revenue per email and unsubscribe and complaint rates, the last of which the providers themselves measure.

Test one variable at a time, subject line, send time, length, so that you actually learn something. And avoid the vocabulary content filters associate with spam in subject lines.

Where AI fits, without the hype

AI is useful in the email workflow as an assistant, not an autopilot: generating subject-line variants to test, drafting a first version of a campaign, summarising long content into newsletter snippets, suggesting segments from behavioural data. It replaces neither the strategy nor the brand voice, nor the judgement about what your audience actually cares about.

The rules, summarised

Email in 2026 rewards senders who do the unglamorous work: authenticate the domain (SPF, DKIM, DMARC, aligned), offer one-click unsubscribe and honour it fast, keep complaints under 0.3%, segment on behaviour, automate the sequences that matter, prune the contacts who stopped listening, and judge on clicks rather than opens.