Outbound sales email now runs under rules written by the largest consumer mailbox providers. Google and Yahoo began requiring authentication, low complaint rates and easy unsubscribes from bulk senders in February 2024. Microsoft followed for Outlook.com in May 2025. The rules are simple to state. How they apply to an SDR team sending sequences from a company domain is less obvious.
What the rules require
Google's email sender guidelines set a baseline for anyone sending to personal Gmail accounts: SPF or DKIM authentication, valid forward and reverse DNS for sending IPs, a TLS connection, and a spam rate kept below 0.1% and never reaching 0.3%, as measured in Google's Postmaster Tools.
Bulk senders face more. Google defines a bulk sender as one sending close to 5,000 messages or more to personal Gmail accounts in 24 hours. Those senders need SPF, DKIM and DMARC, with the domain in the visible From address aligned to the SPF or DKIM domain. Their marketing and subscribed messages must support one-click unsubscribe through the List-Unsubscribe header defined in RFC 8058. A mailto or plain URL link does not satisfy that requirement, according to Google's subscription guidelines.
Yahoo's sender best practices for bulk senders match closely: SPF and DKIM, a passing DMARC policy of at least p=none, one-click unsubscribe for marketing and subscribed mail, unsubscribes honoured within two days, and complaint rates below 0.3%.
Microsoft's announcement covers domains sending more than 5,000 messages a day to its consumer services. It is stricter on one point: SPF and DKIM must both pass, and DMARC must pass with alignment. Microsoft's support documentation says non-compliant messages are rejected with the error 550 5.7.515 rather than sent to junk.
Enforcement since November 2025
The requirements started as guidance. Google's sender guidelines FAQ states that from November 2025 Gmail began ramping up enforcement, with non-compliant messages facing temporary and permanent rejections. A failure now shows up as a bounce code in the sequencing tool, not as a quiet drop in reply rates.
How the threshold catches sales teams
Gmail counts all mail from the same primary domain. Google's own example: 2,500 messages from a company's main domain plus 2,500 from a promotional subdomain makes the company a bulk sender. Newsletters, product notifications and SDR sequences sent from one domain share a single tally. Moving outbound to a subdomain does not take it out of the count.
Bulk status is also permanent. Per the same FAQ, a domain that crosses the threshold once stays classed as a bulk sender even if volume later falls.
The scope is narrower than it looks. Google's FAQ says the guidelines apply to mail sent to personal Gmail accounts, not Google Workspace accounts, and Microsoft's rule covers its consumer services. A prospect reached at a corporate Workspace or Microsoft 365 address sits behind filtering set by their own organisation. Those gateways are not bound by these policies, but SPF, DKIM and DMARC are records they can check too, so the setup work carries over.
What to check
For a revenue operations or sales leader, the useful questions are about plumbing rather than copy.
- Which systems send as the company domain. The CRM, sequencing platform, marketing automation tool and any meeting or e-signature tool may all put the company in the From line. Each must be authorised in SPF and sign DKIM with the company's domain, not the vendor's, or DMARC alignment fails.
- How the sequencing tool sends. Tools that send through a rep's own Workspace or Microsoft 365 mailbox inherit that mailbox's authentication. Tools that relay through their own servers need explicit DNS setup.
- Whether outbound has its own domain. Some teams send prospecting mail from a separate registered domain to keep its reputation apart from the main one. That domain needs its own SPF, DKIM and DMARC, and prospects see an address they do not recognise.
- Who watches complaint rates. Postmaster Tools reports the Gmail spam rate. Someone needs access to it and a threshold that triggers a pause.
- Whether sequences carry an unsubscribe header. The guidance is written around marketing and mailing-list mail and is less explicit about one-to-one prospecting cadences. Teams that treat sequences as marketing mail take the conservative reading.
What commonly goes wrong
SPF records break as tools pile up. RFC 7208 caps SPF evaluation at 10 DNS-querying terms, such as include statements, and returns a permanent error past that. Each new sending tool tends to add an include, so a stack built one vendor at a time can exceed the cap unnoticed.
DKIM gets left on vendor defaults. Many platforms sign with their own domain out of the box. The message passes DKIM but fails DMARC alignment, because the signing domain does not match the From address.
Volume gets counted per team instead of per domain. Marketing and sales each stay under 5,000 a day on their own dashboards, while Gmail sees one domain sending past the line.
None of this changes what a good prospecting email looks like. It decides whether the email arrives, and that now depends on whoever owns the DNS records as much as on the SDR writing the sequence.