Since February 1, 2024, a sender who pushes more than 5,000 messages a day to Gmail without SPF, DKIM and DMARC can see their mail sorted into spam or rejected with error 5.7.26 (Google documentation). In the sending tool everything reads “OK”. The campaign still lands in the junk folder.
Deliverability is the share of mail accepted by a server that actually reaches the inbox rather than the spam folder. It rests on domain authentication and on sender reputation. For each term, this glossary gives a short definition, then the value to watch when there is one and where to read it.
Delivery and deliverability: two separate measures
Delivery means the recipient’s server accepted the message. Its metric is the delivery rate: emails sent minus bounces, divided by emails sent. Deliverability only comes into play afterwards, when the provider files the message in the main inbox or in the spam folder. A good delivery rate is compatible with spam placement.
The delivery rate is read in the sending tool. Placement is read in Postmaster Tools (postmaster.google.com) for Gmail, or with a deliverability test.
Who is involved in sending: ESP, ISP, IP and domain
An ESP (Email Service Provider) is the platform that sends your campaigns: Brevo, Mailchimp, SendGrid or Klaviyo, for example. On the recipient side, the mailbox provider (Gmail, Outlook.com, Yahoo Mail) decides what happens to the message. The ISP (internet service provider) is the carrier that gives access to the network: AT&T, Verizon or Mediacom.
The IP address is that of the server that sends the message. A dedicated IP belongs to a single sender: its reputation depends only on your sends, but it has to be warmed up. A shared IP is split between the ESP’s customers: each sender’s activity weighs on everyone’s reputation, and a poor shared reputation can trigger the 550 5.7.1 error. Yahoo’s Sender Hub page recommends not sending marketing from the IPs that carry transactional mail. Google and Yahoo also ask for a valid reverse DNS record (PTR) on sending IPs.
The domain is the name of the site (captainverify.com) and the subdomain depends on it (blog.captainverify.com). Reserving a subdomain for marketing sends lets you track it separately in Postmaster Tools, where each subdomain is added on its own.
Sender reputation: where to read it
Sender reputation is the credit a provider gives your IP and your domain. Each provider computes it from its own data. Gmail, Yahoo and Outlook.com each publish their own tool.
| Tool | Mailbox concerned | What it measures | Benchmark |
|---|---|---|---|
| Google Postmaster Tools | Personal Gmail (@gmail.com, @googlemail.com) | spam rate, reputation, authentication, delivery errors | spam rate under 0.10% and never 0.30% or more |
| Complaint Feedback Loop | Yahoo | copies of subscriber complaints | complaint rate under 0.3% |
| SNDS (Smart Network Data Services) | Outlook.com | data per IP address | read in the Microsoft interface |
| Sender Score | independent of mailbox providers | score from 0 to 100 per IP or domain | rules of thumb: 90 and 80 |
Published by Validity and scored from 0 to 100, the Sender Score serves as an outside benchmark. The 80 and 90 thresholds are industry habit, not an official grid. For Gmail, the published reference is the Postmaster Tools spam rate.
Authentication: SPF, DKIM, DMARC, alignment and BIMI
These protocols are published as TXT-type DNS records at the domain’s host. Their result appears in the Authentication-Results header of every received message. In Gmail, the three-dot menu on the message, then “Show original”, displays the spf=pass, dkim=pass and dmarc=pass lines.
SPF
SPF (Sender Policy Framework) lists in a TXT record the servers allowed to send for your domain, with a limit of 10 DNS lookups per check (RFC 7208, April 2014). A typical record for Google Workspace reads v=spf1 include:_spf.google.com ~all. The record must include every sender: messages from any that are missing are more likely to be sorted into spam.
DKIM
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the header. The recipient checks it against the public key published in DNS. To write to personal Gmail accounts, Google requires a DKIM key of at least 1,024 bits and recommends 2,048 bits when the domain provider supports it.
DMARC
DMARC tells the receiving server what to do with a message that fails the SPF or DKIM checks: p=none (monitor), p=quarantine (spam) or p=reject (refuse). On this point the minimum requirement is the same at Google, Yahoo and Microsoft: a policy set to p=none is accepted. The record is published at _dmarc.yourdomain.com, for example v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Its rua option sends aggregate reports. Yahoo and Google recommend turning it on to see who sends on your behalf.
Alignment
Alignment ties authentication to the visible address: the domain in the From field must match the domain validated by SPF (Return-Path) or the one that signs the DKIM (d=). Yahoo accepts relaxed alignment. A green SPF on the ESP’s domain is not enough if the From shows another domain and the DKIM is not aligned either: DMARC then fails, a classic trap when the individual tests all show “pass”.
BIMI
BIMI (Brand Indicators for Message Identification) displays the brand’s logo next to the message in compatible mailboxes.
Gmail, Yahoo and Microsoft requirements for bulk sending
The 5,000-emails-a-day threshold appears at Gmail and at Outlook.com; Yahoo sets no numeric threshold. The table compares the requirements of the three providers.
| Criterion | Gmail | Yahoo | Outlook.com |
|---|---|---|---|
| Effective date | February 1, 2024 | February 2024, gradual rollout | May 5, 2025 |
| Senders targeted | all senders (SPF or DKIM); full rules above 5,000 emails a day | no numeric threshold | more than 5,000 emails a day |
| Authentication | SPF, DKIM and DMARC above 5,000 a day | SPF and DKIM | SPF and DKIM must pass |
| DMARC | published, “none” accepted, SPF or DKIM alignment | at least p=none, must pass | at least p=none, aligned on SPF or DKIM |
| Unsubscribe | one click above 5,000 a day | one-click List-Unsubscribe header, request handled within 2 days | working link recommended |
The details are in Google’s sender guidelines, Yahoo’s Sender Hub page and the Microsoft post of April 2, 2025, updated on April 30. On enforcement, Google cites error 5.7.26 for an unauthenticated message. Microsoft announces that non-compliant messages will go to the junk folder first, then be rejected with code 550 5.7.515; the post sets no date for the rejection.
One-click unsubscribe
One-click unsubscribe relies on two headers: List-Unsubscribe with an HTTPS address and List-Unsubscribe-Post with the value List-Unsubscribe=One-Click, described in RFC 8058, January 2017. The provider then sends a POST request to that address. Google and Yahoo also ask for a visible unsubscribe link in the body of the email. At Yahoo the request must be handled within 2 days, List-Unsubscribe header included.
Warm-up: ramping up without hurting the IP
Warm-up means raising the sending volume of a new IP or a new domain step by step, so that providers build a history from well-received messages. Google advises starting with low volume, then tracking server responses, spam rate and sending-domain reputation during the ramp. Postmaster Tools shows nothing until the sending domain is added and verified with a TXT or CNAME record in DNS. If bounces persist at low volume, Google advises examining the messages one by one. No universal schedule exists: the larger the volume, the slower the ramp should be.
Tracking results and list hygiene
Bounces and bounce rate
A bounce is a message that does not reach its destination. A hard bounce (SMTP code 5xx) is a permanent refusal: a nonexistent address (550 5.1.1, RFC 3463, January 2003) or an unknown domain. A soft bounce (code 4xx) is a temporary failure such as a full mailbox (452 4.2.2) or an unavailable server, which the sending platform usually retries after 30 minutes at least and abandons after 4 to 5 days (RFC 5321, October 2008). The bounce rate is bounces divided by emails sent. Our removal rule: delete the address at the first hard bounce and at the third consecutive soft bounce, across three sends spread over at least 14 days (an editorial choice, no standard sets it). Each ESP sets its own suspension threshold: the Amazon SES console, for example, displays the hard bounce rate and the complaint rate, then puts the account in “Under review” status when either exceeds the maximum.
Spam complaints
A spam complaint happens when a recipient clicks “report spam”. Aim for under 0.10% at Gmail and never let the rate reach 0.30%. Yahoo also caps its spam rate at 0.3%.
Spam traps
A spam trap is an address that belongs to no real subscriber and that providers or anti-spam organizations use to spot poorly maintained lists. It does not show up as such in a sending tool’s statistics: you guess it from its effects on reputation.
Blacklist and whitelist
A blacklist records the IPs and domains judged to be sources of spam. A whitelist does the opposite: the recipient has added you to their trusted contacts.
List hygiene and address verification
List hygiene covers the habits that keep an address base healthy: removing hard bounces, verifying new addresses, setting aside inactive ones. Each recipient’s address should be confirmed before subscribing them. Yahoo asks you to remove invalid recipients quickly. An address verification tool like CaptainVerify checks the validity of addresses before sending; it generally examines the syntax, the domain, then the mailbox itself. The value lies in reputation: filtering after sending means you have already paid for the hard bounce. Verification says nothing about consent or engagement and does not remove every spam trap.
Deliverability test
A deliverability test sends the same message to seed addresses opened at several providers, then records placement: main inbox or spam. Tools like GlockApps or Mail-Tester also check authentication. The result remains an estimate based on a few mailboxes, whereas Postmaster Tools reflects real traffic to Gmail. The common deliverability errors that a test brings to light are covered in a dedicated article.
Engagement, consent and GDPR
Double opt-in asks the new subscriber to confirm their address with a click in a confirmation email, where single opt-in stops at sign-up. Yahoo recommends it: the list then holds fewer fake addresses and bots. The feedback loop sends complaints back to the sender so that they can remove the subscribers concerned. TINS (“This Is Not Spam”) is the recipient’s action of pulling a message out of the spam folder.
The GDPR sets the legal framework. In France, for commercial prospecting by email, the CNIL requires in the general case prior, unambiguous consent, for example a dedicated box that is not pre-ticked. Accepting the terms and conditions is not enough. An exception exists for a customer who is offered products or services similar to their purchase; it excludes a mere account created without a purchase (CNIL page of June 10, 2026). National rules vary from one country to another.
Before your next campaign, run a sample of the list through address verification: the hard bounce rate you get says whether the rest of the base deserves the same treatment. Also open the headers of the last email you received and look for the three pass verdicts on the domain shown in the From. This glossary lays out the vocabulary. The complete email deliverability guide goes through each lever.
