Email Deliverability 2026: How to Stay in the Inbox Under the Gmail, Yahoo and Microsoft Rules

I always describe deliverability to clients the same way. FedEx might tell you your package was successfully delivered, but it went to your neighbor’s house. That’s great delivery and bad deliverability. Your email platform’s “delivered” number works exactly like that tracking page. It tells you the receiving server accepted the email. It doesn’t tell you whether it landed in the inbox, the promotions tab or the spam folder.

That gap got bigger and more expensive over the last two years. Gmail and Yahoo started enforcing sender rules in February 2024, Microsoft followed in 2025, and Gmail began rejecting mail that doesn’t comply in November 2025. The good news is that the rules reward the same habits that make email profitable in the first place. Every account my team takes over gets the same deliverability checklist, and most of it takes days, not months.

The short answer: authenticate your domain with SPF, DKIM and DMARC, offer one-click unsubscribe, keep spam complaints under 0.1% (and never near 0.3%), send to engaged subscribers first, and sunset and suppress the people who stopped engaging. On the Klaviyo stores we manage, the median spam complaint rate is 0.037%, comfortably inside Google’s recommended limit. And when a fixed group of our stores cut the number of campaign emails delivered roughly in half year over year, email kept exactly the same share of store revenue. The takeover checklist, in order, is at the end.

Seven marketing emails in eight reach the inbox, and the eighth is where your revenue leaks

Validity’s 2026 benchmark puts global inbox placement at 87.2% for 2025. Another 6.1% went to spam and 6.6% went missing entirely. Put the other way, about one marketing email in eight never reaches an inbox. Where you lose it depends heavily on who your subscribers use.

Microsoft is the hardest inbox to win, which matters most for B2B senders whose lists are full of company Outlook addresses. Industry matters too. Validity has retail at 90.4% inbox placement, one of the best sectors, while healthcare services (80.3%) and real estate (80.1%) sit near the bottom. Those are exactly the businesses that tend to email lists built from appointments, open houses and old spreadsheets rather than signup forms, and they have the most to gain from the habits below.

The Gmail, Yahoo and Microsoft sender rules in plain English, and the fixes

Since February 1, 2024, anyone sending more than 5,000 messages a day to Gmail addresses has had to meet Google’s bulk sender requirements, and Yahoo announced matching rules at the same time. Microsoft applied similar rules to Outlook.com from May 5, 2025, sending non-compliant mail to junk first and rejecting it later. The thresholds formally apply to bulk senders. I set up every account as if it were one, because the habits cost nothing and you will cross 5,000 a day sooner than you think, usually on Black Friday.

• Authenticate your domain. SPF (almost like a phone book of the servers allowed to send for you), DKIM (a signature proving the email wasn’t altered) and DMARC (a policy that tells inbox providers what to do when the first two fail; at least p=none). Your From address must align with the domain you authenticate.
• One-click unsubscribe. A List-Unsubscribe header that works in one click, required since June 1, 2024, and requests honored within two days. If you don’t already include an unsubscribe link in every message, stop what you’re doing and go fix that right now!
• Spam complaints under 0.1%. Google recommends staying below 0.1% and says never to reach 0.3%. Yahoo also draws the line at 0.3%.
• Enforcement is real now. From November 2025 Gmail started temporarily and then permanently rejecting non-compliant traffic, instead of just filtering it.

The authentication piece isn’t set-and-forget either. On one account a few months ago, a website change overwrote the client’s DNS records, and the SPF, DKIM and DMARC entries went with them. Weeks later Yahoo noticed and stopped accepting their mail. My team now checks authentication on every account after any website, DNS or hosting change. I walked through the original rules step by step in our 2024 guide to the Google and Yahoo requirements, and every step still applies.

97% Increase in email deliverabilityNon-Alcoholic Cocktail Brand Grows Email Revenue by 49%See the case study →77% Reduction in spam complaint rateCompression Stocking Retailer Cuts Email Spam Complaints by 77%See the case study →

Our stores keep complaints well inside Google’s limit, and here is how

The spam complaint rate is the number inbox providers watch most closely, because it’s the most direct signal of how subscribers feel about you. On the median Klaviyo store we manage, campaign spam complaints run at 0.037%, and on our Mailchimp lists at 0.021%. Both are well inside Google’s 0.1% recommendation and below Validity’s 2025 average of 0.06%.

About that bottom bar. Klaviyo’s help center calls an account healthy below 0.01% complaints, under 1% bounces and under 0.3% unsubscribes, and our median store is above that complaint line and above that unsubscribe line (0.37%). Bounces are fine at 0.76%. Klaviyo’s bar is strict, and I’d rather a client aim for it than coast at Google’s ceiling. The single rule that moves complaints most: if a person has ever marked your email as spam, they never hear from you again. Not in a win-back, not on Black Friday, never.

The other rule is to read unsubscribes and complaints as feedback rather than noise. Those metrics reflect audience sentiment more accurately than opens ever will, especially now that most opens are Apple’s privacy proxy, not people. A rising complaint rate on one segment tells you exactly who you’re over-mailing.

Smaller, engaged sends kept email’s full share of revenue

This is the part of deliverability that feels counterintuitive to business owners. Inbox providers judge your domain mostly on how people react to your campaigns. I think of it like school: flows are many small quizzes, and a campaign is the big test that counts for 40% of your grade. A campaign to your whole list, including the people who haven’t opened in a year, is a big test you walk into unprepared.

So we send campaigns to engaged segments first, starting with the last 30 days, and widen only while engagement holds. On a fixed group of our Klaviyo stores, the number of campaign emails delivered fell 49% year over year, on only 12% fewer campaigns. Email and SMS held the same share of store revenue: 36.5% in the first year and 36.6% in the second.

Owners push back on this, and I understand why. A premium wellness brand’s owner was upset that a product launch went to 2,800 people instead of the whole list of 18,000. I showed them the math: if I blasted all 18,000 that day, the account’s deliverability score would be cut in half, and much of that mail would land in spam. About 5,500 of those profiles had been dead for a long time and were part of a $450 platform bill. We agreed on incremental segment expansion, one broad “catch-all” send a month, a sunset flow and a bulk suppression of the long-dead profiles. This account had already seen what cleaning does: an earlier list clean-up was followed by its best campaign ever, at a 2.8% click rate. Over our time on the account, Klaviyo-attributed revenue has risen 135%, placed order rate 74% and click rate 56%.

List hygiene keeps the inbox open: sunset, suppress, and watch for bots

Lists decay quietly. On the Mailchimp lists we manage, the median list has lost about one in seven of everyone ever added to unsubscribes and cleaning, and about half of those were cleaned because the address no longer worked. Validity’s 2025 data puts the average unknown-user rate at 1.46%.

• A sunset flow for subscribers who haven’t engaged in somewhere between 120 and 180 days, depending on how often you send. It asks once whether they still want to hear from you. It doesn’t suppress anyone by itself; it identifies who should be suppressed.
• A recurring suppression task, monthly or quarterly. Suppress, never delete, so the unsubscribe and consent history stays with the business. Be conservative: labeling someone unengaged and leaving them out of campaigns is better than suppressing a valid customer.
• Judge engagement by clicks and orders, not opens. Nine times out of ten, I exclude people whose only “engagement” is an Apple privacy-proxy open.
• Watch for bot signups. A sudden wave of new profiles, carts that never reach checkout, or a spike in bounces from one internet provider is usually a list-bombing attack. Add a CAPTCHA or double opt-in on the affected form and suppress the fakes fast. I have seen a brand’s platform bill double in a month because nobody did.

And never send to a list nobody opted into. Contacts gathered from business cards and old deals bounce, complain and drag the whole domain down with them (the real-estate list in our real estate email guide is the cautionary tale). Keep any outreach on a separate domain and build the marketing program around the engaged contacts who asked for it.

Warm up new domains slowly, and plan for the holiday dip before it happens

A new sending domain, a new platform or a dedicated IP has no reputation yet. Start with your most engaged subscribers, the people who clicked or bought recently, and widen the audience over a few weeks while complaint and bounce rates stay low. Flows can go live early because they reach people at the moment they asked to hear from you. Big campaigns come last.

The same thinking applies every November. Black Friday is the one time I deliberately widen sends beyond the engaged core, and I tell clients upfront: deliverability is going to take a bit of a hit over the next two months, it’s completely expected, and I’ll make sure it doesn’t drop below a margin where emails stop reaching the inbox. After the holidays we run reputation recovery: back to engaged-only sends while the scores climb. For the account-level number, I like clients somewhere in the 70s and 80s in Klaviyo’s deliverability score. I have never seen a 100, and chasing it isn’t a good use of anyone’s time. The holiday version of this plan is in our Black Friday email guide.

The email deliverability checklist for 2026, in order

1. Check authentication. SPF, DKIM and DMARC (at least p=none) on your sending domain, aligned with your From address, and rechecked after any website or DNS change.
2. Confirm one-click unsubscribe. A working List-Unsubscribe header plus a visible link in every message, honored within two days.
3. Set up Google Postmaster Tools. Watch Gmail’s own spam-rate figure alongside your platform’s, and keep both under 0.1%.
4. Exclude every spam complainer, permanently. Build a suppression segment for anyone who has ever marked you as spam.
5. Move campaigns to engaged segments. Start with 30-day engaged, widen while engagement holds, and allow one broader send a month.
6. Launch a sunset flow and a suppression routine. Identify the unengaged at 120 to 180 days, ask once, then suppress (never delete) on a schedule.
7. Protect your forms from bots. CAPTCHA or double opt-in where you see suspicious signups, and a fast cleanup when you do.
8. Plan the holiday dip and the recovery. Widen on purpose for Black Friday, then return to engaged-only sends once the season ends.

Start this week with the first two items. They take an afternoon, and they’re the two that now get mail rejected outright. If you’d like my team to run the full checklist on your account, we offer a free account audit, and the checklist is part of every email and SMS engagement we start. It also pairs naturally with growing a healthier list, which I cover in our list-building guide.

Frequently asked questions