The Gmail & Outlook sender rules, explained like you're busy

import FAQ from “../../components/blog/FAQ.astro”; import ComparisonTable from “../../components/blog/ComparisonTable.astro”;

Since 2024, Gmail and Microsoft stopped politely suggesting good sending practices and started enforcing them. If you send cold email — even at modest volume — these are the rules of the road now. Here’s the short version, without the jargon.

The three DNS records you must have

Think of these as your domain’s ID papers. Receivers check them before reading a word of your copy.

SPF answers “which servers may send email for this domain?” It’s one TXT record listing your providers. Two rules people break constantly: you can only have one SPF record (multiple records = automatic fail), and it should end in ~all or -all — ending in +all means “anyone may send as me”, which receivers treat as a red flag.

DKIM is a cryptographic signature attached to every email, proving it wasn’t altered and really comes from your domain. Your email provider usually generates the key; you publish the public half in DNS. If you need a key for your own server, you can generate one free in your browser.

DMARC tells receivers what to do when SPF or DKIM fail: nothing (p=none), spam-folder it (p=quarantine), or reject it (p=reject). Gmail and Microsoft now require at least p=none from bulk senders — and p=none is the floor, not the goal. Once your legitimate mail passes reliably, move to quarantine.

You can test all three — plus whether your domain can receive replies at all — in one pass with our free domain health checker.

Where Gmail and Outlook actually differ

Both providers converged on the same three DNS records, but they didn’t converge on the same threshold, the same enforcement style, or the same published numbers. Treating “the rules” as one undifferentiated checklist is how senders miss the gaps between the two:

<ComparisonTable headers={[“”, “Gmail”, “Outlook / Hotmail / Live”]} rows={[ { label: “Volume threshold”, values: [“5,000 messages/day to Gmail addresses”, “5,000 messages/day to Outlook, Hotmail, or Live addresses”] }, { label: “SPF + DKIM”, values: [“Both required to pass”, “Both required to pass”] }, { label: “DMARC”, values: [“Required, aligned, minimum p=none”, “Required, aligned, minimum p=none”] }, { label: “One-click unsubscribe”, values: [“Required (RFC 8058)”, “Strongly recommended, not a hard published rule”] }, { label: “Published spam-complaint ceiling”, values: [“0.3%, enforced”, “No equivalent public number”] }, { label: “Rollout style”, values: [“Gradual: spam-foldering, then rejections”, “Went straight to rejection from day one”] }, ]} />

That last row is the one senders get burned by most often. Gmail’s original 2024 rollout leaned on spam-foldering non-compliant mail for an extended period before escalating to hard rejections, which gave slow movers time to notice and fix things. Microsoft didn’t offer that runway — its requirements took effect with permanent rejection built in from the start, meaning a domain that’s misconfigured for Outlook doesn’t get a quiet warning period; it gets bounced mail immediately. Teams that treat “we’re Gmail-compliant” as equivalent to “we’re compliant” are the ones who discover the gap the hard way, usually as a spike in hard bounces to @outlook.com and @hotmail.com addresses that their Gmail-focused monitoring never flagged.

The unsubscribe rule

Bulk senders must support one-click unsubscribe (the technical kind, RFC 8058 — a header, not just a link in the footer) and honor it within two days. For cold email specifically this is doubly important: a recipient who can’t unsubscribe in one click will press the other button instead — Report spam — and that one costs you forever.

The number that ends careers: 0.3%

Gmail’s enforced spam-complaint threshold is 0.3%, and their stated target is under 0.1%. Three complaints per thousand emails. That’s not many: a sloppy list segment or a tone-deaf follow-up can blow through it in one morning.

What actually keeps complaints low isn’t a trick — it’s relevance and restraint: tight targeting, small personalized batches, sequences that stop the moment someone replies, and never emailing someone twice who said no.

Think about what a complaint actually represents before you optimize around the raw percentage: someone opened your email, decided it was unwanted enough to act on, and clicked “Report spam” instead of just deleting it or ignoring it. That’s a stronger negative signal than a bounce (which just means the address is bad) or an unsubscribe (which is at least a clean exit). A rising complaint rate is usually telling you something true about the mail itself — wrong audience, wrong timing, too aggressive a follow-up cadence — not just a number to suppress with a better unsubscribe link.

Why a brand-new domain needs to be more careful, not less

A domain with no sending history has no reputation to fall back on, which means both Gmail and Outlook are watching its first real volume more closely than an established domain’s. A cold domain that jumps straight to sending a few thousand emails a day, even with SPF, DKIM, and DMARC all correctly configured, still looks suspicious to mailbox providers purely because of the sudden volume against zero prior history — authentication passing doesn’t override a pattern that reads as a burst of new bulk mail. That’s why a gradual ramp matters even when every DNS record is technically in order: the requirements above are necessary but not sufficient on a domain that hasn’t earned trust yet.

The busy person’s checklist

• One SPF record, ending in ~all or -all
• DKIM signing on, key published (2048-bit if your DNS allows)
• DMARC record live — p=none to start, quarantine when clean
• One-click unsubscribe header on every campaign email
• Unsubscribes honored automatically, within two days
• Spam complaints watched, with a plan to pause sending if they spike
• Bounce rate kept low — verify lists before sending

The first three are one-time DNS work — an afternoon, most of it waiting for propagation. The last four are ongoing operations, and they’re where most senders quietly fail: nobody watches the bounce rate on a Tuesday afternoon.

That ongoing half is the part Norbelys automates — unsubscribes and suppression are handled for you, and every mailbox is watched around the clock, with sending slowed or paused before your domain takes damage. You bring relevant copy and a clean list; the machinery underneath is our job.

<FAQ items={[ { question: “Do these rules apply if I send under 5,000 emails a day?”, answer: “The hard enforcement is tied to the 5,000/day threshold, but SPF, DKIM, DMARC, and a working unsubscribe mechanism are good practice regardless of volume, and skipping them below the threshold still hurts deliverability even without formal enforcement.” }, { question: “Can I be compliant with Gmail but rejected by Outlook, or the other way around?”, answer: “Yes. The two providers check independently, and Outlook in particular offers no gradual warning phase, so a domain that’s fine on one can still be rejected by the other if its DNS records or alignment aren’t correctly set up for both.” }, { question: “Does a single spam complaint spike hurt me permanently?”, answer: “A brief spike is generally recoverable if the underlying cause is fixed quickly, but a sustained pattern of complaints above the threshold is what triggers ongoing enforcement — the priority is catching and correcting a spike fast, not treating one bad send as fatal.” }, ]} />