By Cody Wise, Founder, Wise Media. Published 9 September 2026. Wise Media builds websites and lead systems for Canadian founders, agencies, trades and short-term rental operators.

Your emails are going to spam because your domain is not proving it sent them. Since 2024 Gmail, Yahoo and Outlook have required SPF, DKIM and DMARC from bulk senders, and through late 2025 Gmail moved from politely deferring non-compliant mail to rejecting it outright. Nothing about your copy causes this. Three DNS records fix most of it.

Summary

A wall of brass apartment mailboxes with one door ajar and an envelope corner visible
Authentication decides which box your message lands in, and increasingly whether it is accepted at the door at all.
  • Three records do the work. SPF says which servers may send for your domain. DKIM cryptographically signs the message. DMARC tells receivers what to do when the first two disagree, and reports back to you.
  • The bulk threshold is roughly 5,000 messages a day to personal Gmail accounts, counted across your whole primary domain including subdomains. Google’s own guidance is that once you cross it, bulk sender status never expires.
  • Gmail moved to rejections. Google’s sender FAQ states that from November 2025 non-compliant traffic experiences disruptions including temporary and permanent rejections.
  • Microsoft already rejects. Outlook.com returns 550 5.7.515 Access denied, sending domain does not meet the required authentication level for high-volume senders that fail.
  • The most common single technical fault is the SPF ten lookup limit. Exceed it and the record returns permerror, which is a fail, not a warning.
  • The DMARC spec changed in 2026. RFC 9989 replaced RFC 7489 on 19 May 2026 and removed the pct tag. Almost nothing published this year mentions it.
  • Canadian senders have a second master. CASL governs consent and unsubscribes, and its deadlines are looser than Gmail’s. Build to the stricter one.

Table of contents

SPF, DKIM and DMARC in one table

All three are TXT records in your domain’s DNS. None of them lives on your website, which is why so many business owners never find them. They are set at your domain registrar or DNS host, not in WordPress.

RecordQuestion it answersWhere it livesWhat breaks without it
SPFWhich servers are allowed to send mail using this domain?TXT record on the root domainAny server can claim to be you, and receivers cannot tell
DKIMWas this specific message altered in transit, and did the claimed domain sign it?TXT record on a selector subdomain, e.g. google._domainkeyNo cryptographic proof of origin. Forwarded mail fails outright
DMARCWhat should a receiver do when SPF and DKIM do not align with the From address, and where do I send the report?TXT record at _dmarcNo policy, no visibility, and bulk sender rejection at Gmail, Yahoo and Outlook

The word doing the heavy lifting in that DMARC row is alignment. SPF can pass while DMARC still fails, because SPF checks the envelope sender, and the address your recipient actually sees is the From header. If those two domains do not match under DMARC’s alignment rules, DMARC fails even though SPF passed. This single mechanism is responsible for a large share of the “but my SPF is fine” support tickets in existence.

What Gmail, Yahoo and Outlook actually require in 2026

Overhead view of a stack of plain white envelopes and an espresso on a dark walnut desk
Cross roughly 5,000 messages a day to personal Gmail accounts and you are a bulk sender. Google’s guidance is that the status does not expire.

Gmail

Google splits its rules into two tiers. These apply to mail sent to personal Gmail addresses, not to Google Workspace accounts, which is a distinction almost every article gets wrong.

RequirementAll senders5,000+ per day
SPF or DKIMRequired, either oneBoth required
DMARC recordNot requiredRequired, p=none is acceptable
Valid forward and reverse DNS (PTR)RequiredRequired
TLS on transmissionRequiredRequired
Spam rate in Postmaster ToolsBelow 0.30%Below 0.10% target, never reach 0.30%
From header alignmentNot requiredMust align with the SPF or the DKIM domain
One-click unsubscribe (RFC 8058)Not requiredRequired on marketing and subscribed mail

Two details from Google’s own documentation that matter more than they look. First, spam rate is calculated daily, not averaged over a month, so one bad send can put you over. Second, since June 2024 a bulk sender above 0.3% is ineligible for delivery mitigation or escalation, and only regains eligibility after seven consecutive days back below the line. There is no phone number to call.

The enforcement change is the part worth acting on. Google’s sender guidelines FAQ carries this banner: from November 2025, Gmail ramped up enforcement on non-compliant traffic, and messages that fail the requirements experience disruptions including temporary and permanent rejections. Alignment failures, missing SPF and DKIM, missing PTR, no TLS and RFC 5322 violations are all listed as capable of producing a failure code rather than a spam foldering.

The Gmail error codes worth recognising

  • 4.7.23 and 5.7.25: no valid PTR record for the sending IP
  • 4.7.27 and 5.7.27: SPF failure
  • 4.7.29 and 5.7.29: no TLS
  • 4.7.30 and 5.7.30: DKIM failure
  • 4.7.31: no DMARC record published
  • 4.7.32: the From header does not align

A code beginning with 4 is a temporary deferral. A code beginning with 5 is permanent. If your email platform is showing you a wall of 5.7.x bounces, the fix is DNS, not copy.

Yahoo and AOL

Yahoo’s published requirements track Gmail’s closely: SPF or DKIM for all senders, both plus a valid DMARC policy of at least p=none for bulk senders, a functioning one-click List-Unsubscribe, unsubscribes honoured within two days, spam complaint rate below 0.3%, and a DKIM key of at least 1024 bits with 2048 recommended.

One difference is worth knowing. Yahoo publishes no volume threshold. Its own FAQ states that a bulk sender is one sending a significant volume of mail and that it will not specify a number. You are assessed at the authenticated domain level, and spoofed mail using your domain counts toward the volume Yahoo evaluates you on, which is an underrated argument for getting DMARC to enforcement.

A correction, because it is repeated everywhere: there is no primary-source Yahoo enforcement date in late 2025. Yahoo’s own pages still reference February and June 2024. Articles claiming a November 2025 Yahoo rejection date appear to be echoing Google’s announcement onto the wrong provider.

Microsoft, Outlook.com, Hotmail and Live

Microsoft applies its requirements to domains sending 5,000 or more messages a day to its consumer services. You must publish SPF and DKIM, both checks must pass, and you must publish a DMARC record with a valid policy, minimum p=none, with SPF or DKIM aligned to the From domain.

Enforcement began on 5 May 2025 and Microsoft revised its plan shortly before that date from junk-foldering to outright rejection. The rejection string, verbatim from Microsoft’s own knowledge base, is:

550 5.7.515 Access denied, sending domain [yourdomain.ca]
does not meet the required authentication level

Note the code is 5.7.515. A widely circulated write-up renders it as 5.7.15, which will send you searching for the wrong thing.

The bulk sender threshold nobody tells you is permanent

Here is the trap. Google defines a bulk sender as anyone sending close to 5,000 or more messages to personal Gmail accounts within a 24 hour period, counted across the whole primary domain. Subdomains roll up into the parent. Your newsletter platform, your CRM, your booking confirmations and your invoicing tool all count toward one number if they share a domain.

And per Google’s own guidance, once bulk sender status is assigned it does not expire. Sending 5,200 messages for one product launch in March moves you permanently into the stricter tier, even if you never send more than 400 a day again.

Two practical consequences for a Canadian business:

  1. Assume you are a bulk sender and configure accordingly. The full setup takes an afternoon and there is no downside to being over-configured.
  2. Separate your sending streams by subdomain if your volume is real. Transactional mail from mail.yourdomain.ca, marketing from news.yourdomain.ca. A reputation problem in one stream then does not poison your invoices. This is the single highest-leverage architectural decision in email, and it has to be made before you have a problem, not after.

Seven reasons legitimate email lands in spam

Cody Wise working on a laptop at a street cafe table
Most deliverability problems are diagnosed in about twenty minutes, once you know which three things to look at.

In rough order of how often we find each one on a Canadian small business domain:

  1. No DMARC record at all. The most common finding. The business has SPF from 2019, no DKIM, and has never heard of DMARC.
  2. SPF exceeds ten DNS lookups. Every tool you have ever connected added an include. See the next section.
  3. The From address does not align. Your platform sends as you@yourdomain.ca but signs with the platform’s own domain and you never completed their custom domain setup. SPF passes, DMARC fails.
  4. Multiple SPF records. Two TXT records both starting v=spf1 is an automatic permerror. This happens when a new vendor’s setup wizard adds a record instead of editing the existing one.
  5. No PTR record on the sending IP, which is common on cheap shared hosting sending mail directly from the web server. Send through a real mail service instead.
  6. Complaint rate over the line. Usually caused by mailing a list that has not been touched in eighteen months. Re-engagement sends are the single most common cause of a sudden deliverability collapse.
  7. Purchased or scraped lists. Google tells senders outright not to buy addresses, and in Canada this is also a CASL exposure. Both problems, one behaviour.

Notice what is not on that list. Subject line wording, the number of images, the word “free”, and every other piece of folklore from 2011. Content filtering exists, but in 2026 it is downstream of authentication. If you fail authentication, your copy never gets a hearing.

The SPF ten lookup limit, the most common single failure

RFC 7208, the SPF standard, is unambiguous:

SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS. If this limit is exceeded, the implementation MUST return “permerror”.

RFC 7208, section 4.6.4

The terms that count toward the ten are include, a, mx, ptr, exists and the redirect modifier. The terms that do not count are all, ip4, ip6 and exp. Critically, nested includes count too. One include: pointing at a vendor whose own record contains four includes has consumed five of your ten, not one.

There is a second, quieter limit. The same RFC recommends capping void lookups at two. A void lookup is a query that returns nothing, which is exactly what happens when an include: still points at a vendor you stopped using two years ago. Three dead includes can permerror a record that is nowhere near ten lookups.

A common piece of guidance says an SPF record can have up to ten include: tags. That is a simplification of the real rule and it will mislead you. Cite the RFC, count every DNS-querying term including nested ones, and use a flattening or hosted SPF service if you genuinely need more than ten senders.

A working minimal SPF record

Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com ~all

Google Workspace plus one marketing platform looks like this:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

One SPF record per domain. Subdomains need their own. Allow up to 48 hours for propagation before you conclude anything.

How to diagnose your own domain in fifteen minutes

A brass letter slot in a black front door at dusk with two envelope corners pushed part way through
Delivered and inboxed are two different outcomes. Only your headers tell you which one you got.
  1. Send yourself an email from your real platform to a personal Gmail address. Not from your desk to your colleague. Use the actual sending system that is failing.
  2. Open it in Gmail, click the three dot menu next to Reply, and choose Show original. Gmail prints SPF, DKIM and DMARC as three separate lines at the top of the panel. You want PASS on all three. Anything else is your answer.
  3. If DMARC fails while SPF passes, you have an alignment problem, not a DNS problem. Complete your platform’s custom sending domain setup.
  4. Run your domain through learndmarc.com. It is free, needs no signup, and walks the full evaluation visually including alignment. It is the best teaching tool available for this.
  5. Publish a monitoring DMARC record if you do not have one, and give the reports somewhere to go.
  6. Set up Google Postmaster Tools. It is free, requires DNS verification, and it is the only place you can see your real Gmail spam rate rather than guessing from open rates.

The DMARC record to start with

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.ca;

p=none changes nothing about how your mail is treated. It satisfies the bulk sender requirement and, far more usefully, it turns on reporting. Without the rua address you get the compliance checkbox and no information, which is the worst of both worlds. Yahoo calls the rua tag strongly recommended for exactly this reason.

Leave it at p=none for at least four weeks, read the reports, confirm every legitimate sender is passing, and only then move to quarantine and eventually reject. Jumping straight to p=reject is how a business discovers that its invoicing system was never DKIM signed, and it discovers it by not getting paid.

Free tools that are genuinely free in 2026

ToolWhat it gives youCatch
Google Postmaster ToolsYour real Gmail spam rate, domain reputation, compliance status dashboardNeeds DNS verification. Only shows Gmail
learndmarc.comVisual walkthrough of a live SPF, DKIM and DMARC evaluation including alignmentNone. No signup required
Postmark DMARC Weekly DigestsWeekly DMARC report summary by emailFree tier now caps at the top 10 sources, 5 IPs each, 7 days of history, email only
Google Admin Toolbox CheckMX and DigDomain and PTR record checksNone
Yahoo Complaint Feedback LoopReports when Yahoo users mark you as spamEnroll your DKIM signing domain. No IP-based option any more
MXToolbox SuperToolQuick MX, SPF, DKIM, DMARC and blacklist lookupsDaily limits and ads on the free tier

DMARC changed in 2026 and nobody told you

On 19 May 2026 the IETF published RFC 9989, which obsoletes RFC 7489, the specification every DMARC article written in the last decade cites. Two companion documents cover reporting: RFC 9990 for aggregate reports and RFC 9991 for failure reports.

What actually changed, for a business owner:

  • The pct tag is gone. RFC 9989 devotes an appendix to removing it. The partial-rollout technique many guides still recommend is no longer part of the standard.
  • A new t tag replaces it for testing. Setting t=y tells a receiver to treat an enforcing policy as if it were less strict, while reports keep flowing. It has no effect on p=none.
  • The np tag applies a policy specifically to non-existent subdomains, which closes a real spoofing gap. Precedence runs np, then sp, then p.
  • Alignment is unchanged. Relaxed alignment still means the same organizational domain and strict means an identical one, and both adkim and aspf still default to relaxed.

Practical advice: if your existing record contains pct=100, leave it. It is harmless, receivers still tolerate it, and at least one major provider still asks for it (see BIMI below). The point is not to rip anything out. The point is that if a vendor is quoting you for a DMARC project in 2026 and citing RFC 7489, they have not read the current spec.

BIMI, and whether it is worth the money

BIMI puts your logo beside your name in the inbox. It is the most visible payoff for doing all of the above, and it is also the one most often oversold.

The hard requirements, from Google’s own documentation:

  • A DMARC policy of quarantine or reject. Google states outright that BIMI does not support p=none. This is the gate almost everyone fails.
  • A Verified Mark Certificate or a Common Mark Certificate. A bare SVG with no certificate is not supported in Gmail.
  • An SVG Tiny PS logo, minimum 96 by 96 pixels for Gmail, dimensions in absolute pixels, solid background, 32 KB or smaller.
  • Only a VMC produces the blue checkmark in Gmail. A VMC requires a registered trademark, and Google notes trademark registration typically takes six to twelve months.

Certificate pricing sits in the region of USD $1,000 to $1,500 a year from the main issuers, with resellers and CMCs quoted lower. Those are published third-party rates, they move, and you should get a current quote rather than budget from an article. Note that these are USD figures, not CAD, which matters when you convert.

Our honest read. For a Canadian services business sending a few thousand emails a month, BIMI is a nice-to-have that should come after DMARC enforcement, never before it. Getting to p=reject is the work that improves deliverability. BIMI is the badge you get for having done it. If you are a consumer brand where inbox recognition drives open rates, the maths changes.

The Canadian layer: CASL and two clocks that conflict

Cody Wise closing a MacBook at a beachfront table at dusk
Canadian senders answer to two rulebooks at once. Build to whichever is stricter on each point.

Authentication gets your mail accepted. CASL governs whether you were allowed to send it. Both apply, and they set different deadlines for the same action.

ObligationGmail and YahooCASLBuild to
Honour an unsubscribeWithin 48 hours (Google), within 2 days (Yahoo)Within 10 business days48 hours
Unsubscribe mechanismOne-click header, RFC 8058Visible mechanism in the message, free to useBoth. They are different things
Sender identificationNot specifiedBusiness name, mailing address, and a phone, email or website, valid for 60 days after sendingCASL
ConsentNot specifiedExpress, or implied under a defined exceptionCASL

The implied consent clocks are worth memorising, because they are what quietly turns a compliant list into a non-compliant one: two years from a purchase or the acceptance of a business opportunity, six months from an inquiry or application, and two years from the expiry of a written contract. Express consent does not expire until the recipient withdraws it.

The maximum administrative monetary penalty under CASL is $1 million CAD per violation for an individual and $10 million CAD per violation for a business. Worth context: actual enforcement since 2014 has produced something closer to $1.4 million CAD in total across all cases, with the largest penalty against an individual at $75,000 CAD. The realistic risk is not a headline fine. It is that the burden of proving consent always sits with the sender, so poor record-keeping is the exposure.

We covered the website side of this in detail in is my website CASL compliant, which deals with forms, tracking scripts and consent capture. This article is the delivery layer underneath it. Neither is legal advice. Confirm your position with counsel.

A 30 day plan

  1. Day 1. Send a test to a personal Gmail address and read Show original. Record whether SPF, DKIM and DMARC pass.
  2. Day 1. Publish v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.ca; if you have nothing.
  3. Day 2. Audit SPF. One record only, under ten DNS-querying terms, no dead includes.
  4. Day 2. Enable DKIM signing on every platform that sends as your domain, at 2048 bits. Most people find at least one they had forgotten about.
  5. Day 3. Verify Google Postmaster Tools and enroll in the Yahoo feedback loop.
  6. Days 4 to 28. Read the DMARC aggregate reports weekly. Fix every legitimate sender that is failing alignment.
  7. Day 21. Confirm your one-click unsubscribe header is present and actually works, and that unsubscribes process inside 48 hours.
  8. Day 30. Move to p=quarantine. Watch for two weeks, then p=reject.

If your lead flow depends on email actually arriving, this sequence is also the prerequisite for everything downstream of it. Our guide to speed to lead and the follow-up system that fixes cold enquiries assumes the mail lands. So does guest email marketing for Airbnb hosts. Both fail silently without this layer.

Frequently asked questions

Why are my emails going to spam all of a sudden?

The three usual causes are a recent send to an old, unengaged list which pushed your complaint rate over 0.3%, a new tool added to your SPF record which pushed it past ten DNS lookups, or a mailbox provider enforcement date arriving. Gmail moved to rejections for non-compliant traffic from November 2025 and Microsoft has rejected since May 2025.

Do I need DMARC if I only send a few hundred emails a month?

You are not required to at that volume, but you should. It is free, it takes ten minutes, and the reports are the only way to find out that someone is spoofing your domain. Google also notes bulk sender status is permanent once assigned, so a single large send moves you into the stricter tier for good.

What does 550 5.7.515 mean?

It is Microsoft’s permanent rejection for a high-volume sender whose domain does not meet the authentication requirements for Outlook.com, Hotmail and Live. Publish SPF and DKIM, make sure both pass, and publish a DMARC record with at least p=none aligned to your From domain.

Does SPF passing mean DMARC passes?

No. SPF checks the envelope sender. DMARC additionally requires that the domain in the visible From header aligns with the SPF or DKIM domain. Mail can pass SPF and fail DMARC, and this is one of the most common causes of a bulk sender failing while the owner insists SPF is configured.

How many includes can an SPF record have?

RFC 7208 limits SPF evaluation to ten DNS-querying terms in total, which includes nested lookups inside your vendors’ own records, not ten include: tags. Exceeding it returns permerror, which counts as a failure. There is also a recommended limit of two void lookups, which is what dead includes trigger.

Should I go straight to p=reject?

No. Publish p=none with a rua address, read four weeks of aggregate reports, fix every legitimate sender that fails alignment, then move to quarantine and finally reject. Going straight to reject typically stops invoices and booking confirmations that were never DKIM signed.

Do these rules apply to email sent to Google Workspace accounts?

Google’s sender guidelines apply to mail sent to personal Gmail and googlemail addresses, not to Google Workspace accounts. A Canadian B2B sender emailing corporate mailboxes is in a different enforcement regime, though the same authentication is still what keeps you out of the junk folder.

Is a high open rate proof my deliverability is fine?

No. Open tracking has been unreliable since Apple began preloading images through a proxy, which fires the tracking pixel whether or not anyone read the message. Google states that it does not track open rates and cannot verify third-party open rate reporting. Use Postmaster Tools spam rate and DMARC reports instead.

The short version

Publish SPF, DKIM and DMARC. Keep SPF under ten DNS lookups with no dead includes. Make sure your From address aligns with whatever actually signs the message. Read your aggregate reports for a month, then tighten the policy. Split transactional and marketing mail onto separate subdomains before you have a problem rather than after. Everything else in email marketing is downstream of those five things.

If you would rather have it done than diagnose it yourself, our Website packages ship with DNS, authentication and form delivery configured properly, and our Website Growth packages keep it monitored as your stack changes.

Tell us where your email is going and we will tell you why. Start with the Wise Media intake form.

Sources

Mailbox provider requirements change without much notice. Every fact in this article was verified against the primary sources above on 9 September 2026. This is technical guidance, not legal advice.