Three providers, three rulebooks, and one threshold that is measured rather than negotiated.
Email is still the delivery mechanism for most B2B demand programmes, and the rules governing whether that email arrives changed materially between 2024 and 2026. A lot of marketing teams are working from a version of those rules that is now two revisions out of date.
The three providers that matter do not ask for the same things. Treating them as one set of requirements is the most common cause of a programme that passes an internal check and still lands in spam.
What the three providers actually require
Google. Bulk sender obligations attach once a sender reaches 5,000 messages a day to personal Gmail addresses, and once reached they apply permanently rather than only on days above the threshold. Authentication requires SPF, DKIM and DMARC. Unsubscribe must be one-click and conform to RFC 8058, and a mailto link is explicitly not accepted. Unsubscribe requests must be honoured within 48 hours.
Microsoft. Since 5 May 2025, senders above 5,000 messages a day to Outlook.com addresses without correct authentication are rejected outright with SMTP error 550 5.7.515. This is a rejection rather than a spam placement, which means the message does not arrive at all and the sender receives a bounce.
Yahoo. A complaint rate threshold of 0.3 per cent applies, and a mailto unsubscribe is accepted. No numeric bulk-volume threshold is published.
Design to Google's requirements and the other two are covered. The reverse is not true, and it is the specific reason a programme can satisfy Yahoo and still fail at Gmail.
The number that actually governs the programme
Volume thresholds attract most of the attention and are rarely the binding constraint for a B2B sender. Complaint rate is.
Google publishes a target spam complaint rate of 0.10 per cent and a hard threshold of 0.30 per cent. Above the higher figure, mitigation is withheld until the sender has recorded seven consecutive days below it. That structure matters more than the numbers: recovery is not immediate once the underlying problem is fixed, it requires a week of clean sending afterwards.
The practical implication is that a single badly targeted campaign has a tail. Teams tend to model the cost of a poor send as the wasted send. The real cost is the sending window that follows it.
Enforcement has been tightening since November 2025, including permanent rejections rather than temporary deferrals. The grace period that characterised the first year of these requirements has ended.
Where B2B programmes get caught
Assuming business addresses are exempt. Google's requirements attach to messages sent to personal Gmail addresses. A B2B list contains more of those than most teams assume, because people register with personal addresses, because small businesses run on Gmail, and because forwarding is common.
Validating at collection rather than at send. A list verified at the point of capture decays continuously as people change roles. Verification at the point of sending is a different control and the only one that reflects the state of the address on the day the message goes out.
Warming a domain too fast. A new sending domain pushed to full volume in its first week lands in spam, and the resulting poor performance is almost always attributed to the message rather than to the infrastructure. This produces the wrong conclusion from an expensive test.
Treating unsubscribe handling as a technical detail. The 48 hour requirement needs an owner. It is a process obligation rather than a configuration setting, and it is the one most likely to be nobody's job.
What this means for supplied leads
If a demand programme includes leads bought from a third party, the sending reputation risk transfers to the buyer entirely. The supplier's bounce rate is not the buyer's problem until the buyer sends to the list, at which point it is only the buyer's problem.
That makes bounce rate a contractual question rather than a quality preference. It is reasonable to ask a supplier what their contracted hard bounce rate is, when validation occurs relative to delivery, and what happens commercially if the delivered file exceeds it. A supplier who validates at collection and delivers weeks later is describing a different control from one who validates at the point of delivery.
The order to fix things in
Authentication first, because without SPF, DKIM and DMARC nothing else is assessed. Then RFC 8058 one-click unsubscribe, because a mailto link fails Google outright. Then a named owner for unsubscribe processing inside 48 hours. Then verification moved to the point of send. Then, and only then, volume.
Most teams work that list in reverse, starting with volume because it is the number in the plan. The first three items are configuration and accountability rather than budget, and they are what determines whether the volume arrives.
References
Google, Email sender guidelines, bulk sender requirements, authentication and one-click unsubscribe. support.google.com/a/answer/81126
Google, Postmaster Tools, spam rate reporting and thresholds. postmaster.google.com
Microsoft, Outlook.com sender requirements, effective 5 May 2025, SMTP 550 5.7.515. techcommunity.microsoft.com
Yahoo, Sender requirements and recommendations. senders.yahooinc.com/best-practices
IETF, RFC 8058, Signalling One-Click Functionality for List Email Headers. rfc-editor.org/rfc/rfc8058
How we work. This article was researched and written by the Marketing Hub Media editorial team. We do not republish press releases. Where we cite data we name the source and the method. Corrections are made openly on the article - if you believe something here is wrong, write to info@marketinghubmedia.com.
Filed under Data, Privacy & Consent · Get the weekly brief
