For a long time, deliverability was folklore: warm your domain, avoid certain words, hope. That has changed. Gmail, Yahoo and Microsoft's Outlook.com now publish requirements for anyone sending email in volume, and the requirements are specific enough to build to.
They are written for bulk senders in general, not for cold outbound in particular. But outbound is exactly the kind of sending they are designed to police, so it is worth being precise about what they say.
What the providers ask for
Gmail. Google's sender guidelines require every sender to authenticate with SPF or DKIM and to keep the spam rate reported in Postmaster Tools below 0.3%. Senders above 5,000 messages a day to Gmail addresses also need DMARC and a one-click unsubscribe.
Yahoo. The same 0.3% spam-rate ceiling and one-click unsubscribe, with opt-outs honoured within 2 days. (We have this from a secondary summary rather than Yahoo's own page, so treat the detail with that caveat.)
Outlook.com. From 5 May 2025, Microsoft requires SPF, DKIM and DMARC from domains sending more than 5,000 messages a day to Outlook.com addresses. Mail that does not comply is routed to Junk first, according to Microsoft's announcement.
Read together, the floor is the same everywhere: authenticate properly, keep complaints very low, and make leaving easy.
Why 0.3% is lower than it sounds
A spam rate of 0.3% means three complaints in every thousand delivered emails. Cold email reaches people who did not ask for it, so a careless campaign can cross that line in a day. And the line is a ceiling, not a target. By the time a sender is near it, filtering has usually already started.
That is why we treat a much lower figure as our own limit. We monitor daily and pause sending at 0.1%, a third of the ceiling, so there is room to fix the cause before the providers notice it.
What that means for how outbound is built
None of this is solved by better copy. It is infrastructure, and it has to be in place before the first email.
Secondary domains. Outbound never runs from your main domain. If a campaign has a bad week, the damage stays on a domain that exists for outbound, and your day-to-day email is untouched. The secondary domains are registered to you, not to us.
SPF, DKIM and DMARC on every one of them. Gmail needs at least one, Outlook needs all three for volume, and there is no reason to stop short.
Warmup and per-inbox caps. New inboxes send small volumes before they send real ones, and every inbox has a daily cap. Volume is spread across inboxes rather than pushed through one.
One-click unsubscribe in every email. Processed within 2 business days, which also keeps us inside Australia's Spam Act (see the Australian piece).
Daily monitoring. Spam rate, bounces and replies, every day, with sending paused automatically when a threshold is crossed.
What the rules do not tell you
The sender rules are a floor. Meeting them keeps you eligible for the inbox; it does not get anyone to reply. The other half is sending fewer, better emails to people with a reason to read them — a list built around a clear ideal customer, and copy a person has checked before it goes out.
They also do not replace the law. Mailbox-provider rules sit on top of the anti-spam legislation in each market: the Spam Act in Australia, PECR and UK GDPR in the UK, CAN-SPAM in the US. Our compliance page sets out both layers side by side.
The short version
- Authenticate every sending domain with SPF, DKIM and DMARC.
- Keep the spam rate well under 0.3%. We pause at 0.1%.
- One-click unsubscribe, honoured within 2 days.
- Never send outbound from your main domain.
This is the infrastructure every plan's setup fee pays for. The outbound service describes the rest, and the pricing page lists what each plan includes.