Email deliverability is the share of your mail that reaches the inbox rather than the spam folder or nowhere. As of November 2026 it depends on three things: authentication (SPF, DKIM and DMARC), low complaint rates, and mail your subscribers actually asked for. The biggest change since this post was first written came in February 2024. Gmail and Yahoo started enforcing bulk sender rules that require authentication, one-click unsubscribe and a spam rate below 0.3%, and Microsoft brought similar rules to Outlook.com on May 5, 2025. Open rates also became a much weaker signal after Apple Mail Privacy Protection launched in 2021.
Most email marketers now know the word “deliverability,” but it wasn’t always common. In the decade before this post was written, roughly 2000 to 2010, email use grew fast and inboxes filled up with unwanted messages. To fight spammers, internet service providers (ISPs) and mailbox providers such as AOL, Yahoo and Hotmail put complex filters on incoming mail to block likely spam. In those early years they published almost nothing about how the filters worked. Plenty of legitimate email got caught too. It went straight to the junk folder or never arrived. As filtering spread, open rates, response rates and conversion rates fell for email marketers across the board.
Because spam filtering was so inconsistent, deliverability became a discipline of its own around 2003. That was also the year the US passed the CAN-SPAM Act, signed in December 2003 and in force from January 1, 2004. Since then, federal law and a series of authentication standards have made the problem more stable. Deliverability is now a market within the email industry, with its own experts, consultants and tools.
For the industry’s view of deliverability at the time, the Interactive Advertising Bureau published this document. It’s still useful as history, but it was written before DMARC and before the 2024 bulk sender rules, so don’t treat its technical advice as current.
How deliverability got from 2003 to today
The path from “filters nobody explains” to today’s published sender rules ran through about two decades of standards, failed experiments and changes by mailbox providers. These are the milestones that still shape how your mail is judged.
| Year | Milestone | What it changed |
|---|---|---|
| 2003 | CAN-SPAM Act signed (December 16) | First US federal rules for commercial email: honest headers, a physical address, a working opt-out |
| 2004 | Yahoo proposes DomainKeys; Microsoft proposes Sender ID | Early attempts to prove a message really came from the domain it claims |
| 2006 | SPF published as RFC 4408 | Domains can list the servers allowed to send their mail |
| 2007 | DKIM published as RFC 4871 | Messages carry a cryptographic signature tied to the sending domain |
| 2011 | Goodmail Systems shuts down (February) | The end of paid “certified email” as a way to buy inbox placement |
| 2012 | DMARC specification announced by Google, Yahoo, Microsoft, PayPal and others | Domain owners can tell receivers what to do with mail that fails SPF and DKIM |
| 2013 | Gmail adds inbox tabs (May) and an image proxy (December) | Promotions tab placement becomes a concern; image-based open tracking changes |
| 2014 | SPF updated as RFC 7208 | The current SPF standard |
| 2015 | DMARC published as RFC 7489 | DMARC gets a formal (informational) specification |
| 2021 | Apple Mail Privacy Protection arrives with iOS 15 | Apple Mail preloads images, so open rates get inflated |
| 2024 | Gmail and Yahoo bulk sender rules (February; one-click unsubscribe enforced from June) | Authentication, easy unsubscribe and spam rate limits become requirements |
| 2025 | Microsoft rules for high-volume senders to Outlook.com, Hotmail.com and Live.com (May 5) | All three big consumer mailbox providers now have published rules |
| 2026 | DMARCbis published as RFC 9989, 9990 and 9991 (May) | DMARC moves onto the IETF Standards Track and replaces RFC 7489 |
Old tactics that are now history
Several things that once counted as deliverability strategy are gone. Goodmail’s CertifiedEmail let senders pay per message for preferred delivery at AOL and Yahoo. Yahoo stopped giving certified mail preferred delivery in February 2010, and Goodmail Systems shut down in February 2011. Microsoft’s Sender ID lost out to SPF and DKIM. Windows Live Hotmail became Outlook.com, and the inbox now judges you mostly on authentication and how recipients engage with your mail. Paid certification doesn’t buy you that.
What deliverability depends on in 2026
Today the rules are published, which the early filters never were. If you send in bulk, you need authenticated mail, a working one-click unsubscribe and a low complaint rate. Missing any one of them can send your mail to spam or get it rejected.
The main rules from the three biggest consumer mailbox providers:
- Gmail: If you send close to 5,000 or more messages a day to personal Gmail accounts, you count as a bulk sender. You need SPF, DKIM and a DMARC record, plus one-click unsubscribe on marketing mail, and you must honor unsubscribe requests within two days. Google says to keep the user-reported spam rate below 0.1% and never let it reach 0.3%.
- Yahoo: The same core rules apply. Yahoo doesn’t publish a volume threshold for bulk senders. It wants an RFC 8058 List-Unsubscribe header for one-click unsubscribe and names 0.3% as its spam rate ceiling.
- Microsoft Outlook.com: Domains sending more than 5,000 messages a day must pass SPF, DKIM and DMARC. Since May 5, 2025, Microsoft routes non-compliant mail to Junk, and may reject it if the problems stay unfixed.
A minimal DMARC record that meets the baseline looks like this:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Start with p=none so you can read the aggregate reports and spot any sending service you forgot to authenticate. Then move to p=quarantine or p=reject once legitimate mail passes consistently.
FAQ
When did email deliverability become a discipline of its own?
It took shape in the early 2000s. Spam filtering at ISPs was blocking legitimate marketing mail without explanation, and the CAN-SPAM Act of 2003 and the first authentication proposals in 2004 gave the field its legal and technical base. By the late 2000s, deliverability consultants and tools were a market of their own.
Do the 2024 Gmail and Yahoo rules apply to small senders?
Some of them do. Both providers require every sender to set up SPF or DKIM, keep spam complaints low and send properly formatted mail. The stricter rules, DMARC and one-click unsubscribe, apply once you count as a bulk sender, which Gmail sets at close to 5,000 messages a day to personal Gmail accounts.
Are open rates still a reliable deliverability signal?
Not on their own. Apple Mail Privacy Protection preloads tracking pixels, so many Apple Mail users show as “opened” whether they read the email or not. Watch clicks, conversions, bounce rates and your spam rate in Google Postmaster Tools instead.
What are the penalties for breaking CAN-SPAM?
The FTC can seek civil penalties of up to $53,088 for each email that violates the law. That figure was set in the January 2025 inflation adjustment, and the FTC confirmed it will stay at that level through 2026.
Does DMARCbis mean I have to change my DMARC record?
Usually not. The new standard, RFC 9989, keeps the v=DMARC1 tag, so existing records keep working. The main changes are behind the scenes, such as how receivers find your organizational domain. It’s still worth checking your record against the new specification the next time you update your DNS.
Can I pay for guaranteed inbox placement?
No. Paid certification such as Goodmail ended in 2011, and no major mailbox provider sells inbox placement today. Placement now depends on authentication, complaint rates and how recipients engage with your mail.