Non-compliant cold email used to land in spam. In 2026, Google, Yahoo and Microsoft increasingly reject it outright at the receiving server, before it ever gets a chance to be filtered anywhere. That's a real escalation, not a rebranding of the same rules. A sender who was merely "getting bad open rates" under the old system can now be flat-out bounced under the new one.
Here's exactly what changed, what's actually mandatory now and what a real sending setup needs to pass it.
The Real Change: Rejected, Not Filtered
The old failure mode was soft: a poorly authenticated or high-complaint sender's mail would often still arrive, just quietly routed to spam where almost nobody would see it. The new failure mode is hard. Google, Yahoo and Microsoft now reject non-compliant mail at the receiving server itself, the email equivalent of a bounced call rather than one that goes to voicemail. Microsoft brought this same enforcement to Outlook.com consumer mailboxes in 2026, moving non-compliant senders to Junk first and then rejecting their traffic outright.
What's Actually Mandatory Now
| Requirement | Google & Yahoo | Microsoft |
| Authentication | SPF, DKIM, DMARC, passing and aligned | SPF, DKIM, DMARC, passing and aligned |
| DMARC policy | p=quarantine or p=reject required | p=quarantine or p=reject required |
| Spam complaint rate | Under 0.3% | Published at 0.3%, automated flags can trigger at 0.10% |
| Bounce rate | Under 2% | Under 2% |
| One-click unsubscribe | Required (RFC 8058) | Required, treated as a deliverability signal even outside marketing mail |
Why p=none Doesn't Work Anymore
DMARC has three policy levels: p=none just monitors and reports without doing anything about a failed check, p=quarantine routes failing mail to spam, and p=reject blocks it outright. p=none used to be an acceptable starting point while a sender worked toward full alignment. It no longer clears the bar on its own. Bulk senders are now expected to actually be at p=quarantine or p=reject, not just publishing a DMARC record that watches and does nothing.
Microsoft's Real Threshold Is Tighter Than Its Published One
Microsoft publishes a 0.3% spam complaint threshold, matching Google and Yahoo. In practice, its automated flagging systems can trigger enforcement at a complaint rate as low as 0.10% in 2026. Treat 0.3% as the ceiling you never want to approach, not the number you're safely under. A sending setup tuned to just barely pass Google's published rule can still get flagged by Microsoft's stricter real-world behavior.
What This Means for Your Actual Sending Setup
Confirm SPF and DKIM are correctly configured and actually aligned with your sending domain, not just present. Move DMARC from p=none to at least p=quarantine. Plan a path to p=reject once you've confirmed alignment isn't breaking legitimate mail. Add proper List-Unsubscribe and List-Unsubscribe-Post headers so one-click unsubscribe actually works, not just a mailto link buried in the footer. Watch your complaint rate against 0.10%, not 0.3%, since that's the number that actually triggers enforcement in practice.
This applies regardless of which sending platform does the actual delivery. Instantly and Smartlead both sit on top of the same underlying authentication requirements, so the platform choice doesn't exempt a sender from any of this.
FAQ
Do these rules apply to cold outbound, or just marketing email?
Both. The bulk-sender rules from Google, Yahoo and Microsoft are based on sending volume and complaint behavior, not on whether the mail is labeled marketing or sales outreach. Cold email at any real volume falls under the same requirements.
What happens if I'm already below the published thresholds?
Being under Google and Yahoo's published 0.3% complaint rate is necessary but not sufficient anymore, since Microsoft's real enforcement can trigger well below that. Treat 0.10% as the number that actually matters day to day.
Is DMARC alone enough without SPF and DKIM?
No. DMARC works by checking whether SPF and DKIM both pass and align with the sending domain. Without correctly configured SPF and DKIM underneath it, DMARC has nothing valid to enforce, regardless of what policy level it's set to.
If you're not sure your current sending setup would actually pass these checks, get in touch and we can audit it before it costs you deliverability.