Your Email Reaches the Inbox or It Does Not Exist. The 2026 Deliverability Checklist

By Cody Wise, founder of Wise Media. Wise Media builds and maintains email infrastructure for Canadian agencies, operators and service businesses. This article explains published platform requirements and Canadian anti-spam rules in plain language. It is not legal advice. CASL penalties are significant and the rules turn on facts specific to your business, so confirm your own position with a lawyer before you rely on any interpretation here.

Summary

• Gmail requires SPF, DKIM and DMARC from senders above 5,000 messages a day to personal Gmail accounts. It asks every sender to keep spam rates reported in Postmaster Tools below 0.10 percent and to avoid ever reaching 0.30 percent.
• Microsoft applies the same 5,000 a day threshold to Outlook.com addresses, effective 5 May 2025. Non-compliant mail is routed to junk first, then rejected outright with a 550 5.7.515 error.
• Yahoo requires a working one-click unsubscribe for marketing mail and expects unsubscribe requests honoured within two days.
• Authentication is the entry ticket, not the strategy. Reputation is earned by what recipients do with your mail after it arrives.
• The three fastest wins for most Canadian lists are a sunset policy, a correctly formed List-Unsubscribe-Post header, and separating marketing mail from transactional mail.
• Your email service provider’s “delivered” number is not inbox placement. Delivered means accepted by the receiving server. The junk folder counts as delivered.

Table of Contents

• What actually decides whether your email reaches the inbox?
• What do Gmail, Yahoo and Outlook require in 2026?
• How do you actually see your sender reputation?
• How do you set up one-click unsubscribe correctly?
• How do you clean a list without shrinking your reach?
• How do you warm up a new sending domain?
• The 2026 email deliverability checklist
• Common mistakes that quietly kill deliverability
• Should you fix this yourself or hire someone?
• Frequently asked questions

What Actually Decides Whether Your Email Reaches the Inbox?

Three layers decide it, in order. Identity is whether the receiving server can prove the mail came from you, which SPF, DKIM and DMARC answer. Permission is whether the recipient agreed to hear from you, which CASL governs in Canada. Reputation is what recipients then do with your mail. Only the third layer is ongoing, and it is where almost every deliverability problem actually lives.

Most businesses stop at layer one. They add the DNS records, see mail arriving in their own test inbox, and assume the job is finished. Six months later open rates have halved and nobody can say when it started. That is layer three failing, and no amount of re-checking your SPF record will fix it.

This post deals with layers two and three. If you have not yet set up authentication, start with our guide on why your emails go to spam and how SPF, DKIM and DMARC fix it, then come back. If you are not certain your list was collected lawfully, read how to build an email list in Canada without breaking CASL first, because sending to a list you should not have is the fastest way to destroy a sending domain. Everything below assumes both of those are handled. Email is one pillar of the system we build inside our email marketing services, and it is the pillar clients most often discover is broken.

Why “delivered” is the most misleading number in your dashboard

Your email service provider reports a delivery rate. That number means the receiving mail server accepted the message rather than bouncing it. It says nothing about which folder the message landed in. A campaign can show 99.4 percent delivered and sit entirely in the Promotions tab or the junk folder.

Inbox placement is a separate measurement, and the honest ways to approximate it are: your spam rate in Google Postmaster Tools, your complaint data from Yahoo and Microsoft, seed list testing, and the blunt but reliable proxy of reply rate from a segment you know is engaged. Treat any single-number “deliverability score” from a tool vendor with suspicion unless it tells you how it was calculated.

What Do Gmail, Yahoo and Outlook Require in 2026?

All three require authentication, a low complaint rate and a working unsubscribe. Gmail and Microsoft both draw a hard line at 5,000 messages a day to their consumer addresses, above which SPF, DKIM and DMARC all become mandatory. Yahoo applies its stricter rules to bulk senders without publishing a volume number. The table below is drawn from each provider’s own published requirements.

Gmail: the 0.10 percent number is the one that matters

Google’s email sender guidelines publish two spam-rate figures and most summaries only quote the second one. Google asks senders to keep spam rates reported in Postmaster Tools below 0.10 percent and to avoid ever reaching 0.30 percent. Treat 0.10 percent as the operating target and 0.30 percent as the point at which filtering is already happening.

Put 0.10 percent in context. On a send of 5,000 messages, five complaints puts you at the limit. On a send of 1,000, a single complaint is 0.10 percent. Small Canadian lists are volatile for exactly this reason, which is why the engagement and hygiene work below matters more at small scale, not less.

Gmail’s other requirements are easy to meet and easy to forget: a TLS connection for transmission, messages formatted per RFC 5322 with a valid Message-ID, single-instance headers such as From, To, Subject and Date appearing only once, a single address in the From header, and DKIM keys of at least 1024 bits, with 2048 recommended.

Microsoft: the rule that turns junk into rejection

Microsoft’s Outlook.com postmaster policies state that domains sending more than 5,000 emails a day to Outlook.com accounts must fully comply with SPF, DKIM and DMARC, effective 5 May 2025. The escalation is what makes this one dangerous. Non-compliant high-volume mail goes to the junk folder first. If the issues are not resolved, messages are rejected with “550; 5.7.515 Access denied, sending domain does not meet the required authentication level.”

Microsoft also publishes two operational rules that catch sloppy sending platforms: do not retransmit a message to a recipient after a permanent 500 to 599 SMTP error, and stop sending to a recipient after multiple non-delivery responses. If your platform retries a hard bounce, that is a reputation problem and a configuration bug at the same time.

Yahoo: the two-day clock

Yahoo’s sender best practices add a timing requirement the other two do not state as plainly: honour unsubscribe requests within two days. Yahoo also calculates its spam rate from mail delivered to the inbox, which it notes explicitly, so your own internal complaint maths will not match its figures.

Two Yahoo recommendations are worth treating as requirements. Enrol in the Complaint Feedback Loop, which Yahoo says is needed for all DKIM domains. And segregate streams: send bulk and marketing mail from IPs or DKIM domains separate from user, transactional and alert mail. That single change protects your password resets and receipts from your newsletter’s bad week.

What if you send far fewer than 5,000 a day?

Most Canadian small businesses never cross the bulk threshold at any single provider, and read that as permission to skip the requirements. That is a mistake for two reasons. The thresholds define when rules become mandatory, not when filtering starts, and filtering applies to everyone. And the moment a campaign goes out to a list that has grown past the line, you are in scope without having built for it.

Build to the bulk standard from day one. The incremental cost is a DMARC record and a properly formed unsubscribe header, both of which take an afternoon.

How Do You Actually See Your Sender Reputation?

Through the mailbox providers’ own free tools, not your email platform. Google Postmaster Tools reports spam rate, domain and IP reputation, authentication results and delivery errors. Microsoft offers Smart Network Data Services and the Junk Email Reporting Program. Yahoo offers the Complaint Feedback Loop. Together they cover the large majority of Canadian consumer inboxes.

Google Postmaster Tools, and its two limits

Postmaster Tools is the single most useful deliverability instrument available, and it is free. It has two documented limits you need to understand before you draw conclusions from it. Google states that data in Postmaster Tools only applies to messages sent to personal Gmail accounts, so your mail to Google Workspace business addresses is invisible there. And dashboards show gaps when the total number of messages for a given day is too low, which Google attributes to protecting user privacy.

The practical consequence for a Canadian B2B sender is uncomfortable: if most of your list is at company domains, Postmaster Tools will show you very little. You are not reading a broken dashboard, you are reading a dashboard that does not cover your audience. Lean harder on complaint feedback loops, bounce classification and reply rate in that case.

The weekly five-minute read

1. Spam rate. Target below 0.10 percent. Any single day above 0.30 percent is an incident, not a blip. Find the campaign that caused it.
2. Domain reputation. This is the number that moves slowly and matters most. A drop from High to Medium is an early warning that usually precedes an open-rate decline by a week or two.
3. IP reputation. On shared sending infrastructure this is partly other people’s behaviour. If it is consistently poor and your domain reputation is fine, the conversation is with your platform.
4. Authentication rate. Should be at or near 100 percent for SPF, DKIM and DMARC. Anything less means a sending source somewhere is not signed, often a CRM or a form notification nobody remembered.
5. Delivery errors. Spikes here name the problem directly, including the 550 5.7.515 rejection Microsoft issues for authentication failures.

Set a recurring 15 minute slot. Deliverability problems are cheap to fix in week one and expensive in month three, because reputation recovers much more slowly than it degrades.

How Do You Set Up One-Click Unsubscribe Correctly?

You need two headers and a visible link. Add a List-Unsubscribe header containing an HTTPS URI, add a List-Unsubscribe-Post header whose only permitted value is the pair “List-Unsubscribe=One-Click”, make sure your DKIM signature covers both headers, and keep a clearly visible unsubscribe link in the message body as well. The POST must complete without a confirmation page.

This is specified in RFC 8058, published in January 2017, and it is the single requirement most Canadian senders get subtly wrong. The spec is short and precise. The header syntax is exactly this:

List-Unsubscribe: <https://example.ca/u/9f3a2c7b>, <mailto:unsub@example.ca>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

The five rules the spec actually imposes

• The List-Unsubscribe header must contain an HTTPS URI. It may also contain other URIs such as mailto, and Yahoo accepts mailto, but HTTPS is what makes one-click work.
• The URI should include an opaque or hard to forge component so your server can verify the request is genuine. A guessable sequential ID invites abuse.
• The POST request carries no cookies and no HTTP authorization, so your endpoint must identify the subscriber from the URI alone.
• You must not answer with an HTTPS redirect. A redirect breaks the flow.
• The message needs a valid DKIM signature covering both headers. Receivers are told not to offer one-click unsubscription when that signature is missing, so a misconfigured DKIM silently removes the button.

Four ways businesses break it

• Mailto only. The header exists, but with no HTTPS URI there is no one-click. Common on older self-hosted setups.
• A confirmation page. The URI resolves to a “are you sure you want to unsubscribe” screen. That is a landing page, not a one-click endpoint, and the unsubscribe never completes.
• Unsubscribe behind a login. If the recipient has to authenticate to a preference centre, the POST cannot carry credentials and fails.
• Headers outside the DKIM signature. Your platform adds the headers after signing. Everything looks correct in a raw message view, yet mailbox providers will not surface the control.

Test it by sending yourself a campaign at a personal Gmail address and looking for the Unsubscribe control beside the sender name in the header area. If it is not there, one of the four problems above is present. Then honour the request inside two days, which is Yahoo’s stated expectation. Under CASL the statutory window is longer, but building to the shorter clock keeps you compliant with both.

How Do You Clean a List Without Shrinking Your Reach?

Remove invalid addresses immediately, stop mailing disengaged contacts on a published schedule, and run a single reconfirmation attempt before you suppress. A smaller engaged list reaches more real inboxes than a larger stale one, because engagement is an input to filtering decisions. Shrinking the list often increases total inbox placements.

That claim sounds like agency talk, so here is the mechanism. Mailbox providers infer wanted mail from recipient behaviour: opens, replies, moving messages out of junk, adding senders to contacts. Mail nobody interacts with accumulates negative signal. Keeping 4,000 dead addresses on the list does not add 4,000 chances to be read, it adds 4,000 pieces of evidence that your mail is ignored, and that evidence is applied to the live portion of your list too.

Signal, action, timing

The sunset policy, written down

A sunset policy is a documented rule for when a contact stops receiving marketing mail. The exact numbers matter less than having them and applying them automatically. A defensible default for a Canadian service business sending weekly or fortnightly:

1. No opens or clicks in 90 days, drop to monthly.
2. No opens or clicks in 180 days, send one reconfirmation email asking them to click to stay.
3. No response to the reconfirmation within 14 days, suppress from all marketing sends.
4. Keep the record. Suppression is not deletion, and under CASL you need your consent records regardless.

One caution on open tracking. Apple Mail Privacy Protection pre-loads images, which inflates opens for a meaningful share of any consumer list. Click behaviour, reply behaviour and conversion are more honest engagement signals. Use opens as a directional input, not as the gate.

Where validation services help and where they do not

Bulk email verification tools are useful in exactly one situation: you have inherited a list of unknown age and need to strip dead addresses before the first send. They are not a substitute for permission, and they do not repair a reputation problem. Microsoft’s policies also warn against namespace mining, meaning verifying addresses without sending email to them, so check how any vendor performs its checks before you point it at a large list.

A verified address is not a consenting address. If you cannot say where a contact came from and when, verification will clean the syntax and leave you with the same CASL problem you started with.

How Do You Warm Up a New Sending Domain?

Start small, send to your most engaged contacts first, and increase volume gradually over two to four weeks. A brand new domain has no reputation, and no reputation is treated with suspicion rather than neutrality. Warming up builds a track record of wanted mail before volume arrives, which is the only way a filter learns you are legitimate.

A workable ramp

If a metric degrades at any stage, hold volume where it is rather than continuing the ramp. The timetable is a plan, not a commitment.

Use a subdomain, and separate your streams

Send marketing mail from a subdomain such as news.yourdomain.ca rather than the root domain your staff use for client correspondence. Reputation is tracked at the domain level, so a bad campaign on a subdomain does not take your invoices and quotes down with it. This matches Yahoo’s own recommendation to send bulk and marketing mail from IPs or DKIM domains separate from user, transactional and alert mail.

Keep DMARC at the organisational domain so it covers both, and publish the rua tag so you receive aggregate reports. Yahoo strongly recommends rua, and it is the only way to discover that an old CRM has been sending unsigned mail as you for a year.

The 2026 Email Deliverability Checklist

Work through this in order. Identity first, because nothing downstream matters if the mail cannot be attributed to you. Measurement last, because you cannot act on numbers until the rest is in place.

Identity

• SPF record published, listing every service that sends as your domain, and under the 10 DNS lookup limit.
• DKIM signing enabled on every sending source, key length 1024 bits minimum and 2048 recommended.
• DMARC record published at a minimum of p=none, with a rua address that someone actually reads.
• From domain aligns with the SPF or DKIM domain. Relaxed alignment is acceptable.
• Valid PTR record on sending IPs, with a matching A or AAAA record, and not a generic hostname.
• TLS in use for transmission.
• Messages conform to RFC 5322, with a valid Message-ID and no duplicated From, To, Subject or Date headers.

Permission

• Every contact traceable to express or implied consent, with the date and method recorded.
• No purchased, scraped, appended or pre-checked lists.
• Signup confirms what the subscriber will receive and how often, and the sending matches it.
• Sender identification and a physical mailing address in every commercial message, as CASL requires.
• Implied consent expiry tracked. The two year clock is a calendar item, not a memory exercise.

Infrastructure

• Marketing mail on a dedicated subdomain, separate from transactional and staff mail.
• List-Unsubscribe with an HTTPS URI, plus List-Unsubscribe-Post set to the One-Click value.
• Both headers inside the DKIM signature.
• Unsubscribe endpoint accepts a POST, requires no login, and returns no redirect.
• Visible unsubscribe link in the body of every marketing message.
• Unsubscribes honoured within two days, automatically.
• Hard bounces suppressed on the first permanent failure, never retried.

Content and sending behaviour

• A real, monitored reply-to address. Do not send from noreply@.
• Consistent From name and address. Changing it resets recognition.
• Plain text alternative included alongside the HTML part.
• Link domains consistent with the sending domain, and no URL shorteners.
• Sending cadence steady. A list that hears from you quarterly then receives daily mail will complain.
• Subject lines that describe the contents. Misleading subject lines are both a complaint driver and a CASL problem.

Measurement

• Google Postmaster Tools verified for every sending domain.
• Microsoft SNDS and JMRP enrolled.
• Yahoo Complaint Feedback Loop enrolled for all DKIM domains.
• DMARC aggregate reports parsed, not just received.
• A 15 minute weekly review booked and owned by a named person.
• A documented sunset policy that runs automatically.

Common Mistakes That Quietly Kill Deliverability

• Treating authentication as a project. SPF, DKIM and DMARC are set once and then drift as new tools are added. Every new CRM, booking system or form plugin that sends mail as you needs to be added to SPF and signed.
• Sending marketing from the root domain. One bad campaign and your quotes stop arriving.
• Importing an old list into a new platform. New platform, new IP, old dead addresses, immediate reputation damage. Warm up and clean first.
• Reading delivery rate as inbox rate. Covered above, and it is the most common misreading in the whole discipline.
• Making unsubscribing hard. Hidden links and preference-centre mazes convert a harmless unsubscribe into a spam complaint, which costs roughly a hundred times more.
• Buying a list because it is “opt-in”. It is not consent you hold, it is consent someone else collected, and under CASL that will not save you.
• Chasing a deliverability score. Vendor scores with no published methodology are marketing. The mailbox providers’ own dashboards are the record.
• Ignoring B2B blind spots. If your list is mostly business domains, Postmaster Tools covers almost none of it. Build other instrumentation.
• One big send after months of silence. Volume spikes from a cold domain look exactly like a compromised account.

Should You Fix This Yourself or Hire Someone?

Do it yourself if you have DNS access, one sending platform and a list under roughly 10,000. Hire help if you have multiple sending sources, an existing reputation problem, or a list you inherited and cannot account for. The work is not difficult, but it is unforgiving, and recovery takes far longer than prevention.

Running it in house

• For: The tools are free. The platform requirements are published. Most of the checklist above is a single afternoon of DNS and platform settings.
• For: You learn where your own mail actually goes, which is knowledge that keeps paying.
• Against: DMARC aggregate reports are XML and genuinely unpleasant to read without a parser.
• Against: Diagnosing a block at one provider while the others are fine takes pattern recognition that comes from doing it repeatedly.

Bringing someone in

• For: A reputation problem in progress is a time-sensitive issue, and the cost of getting it wrong compounds daily.
• For: Someone who has seen a hundred accounts will find the unsigned sending source faster than you will.
• Against: Plenty of providers sell deliverability as a monthly retainer when the underlying work is a fixed setup plus a weekly glance.
• Against: Nobody can outsource permission. If the list is not clean, no consultant can fix that for you.

One honest framing on cost. Authentication records cost nothing at the DNS level and Postmaster Tools, SNDS and the Yahoo feedback loop are all free. What you are paying for, in house or out, is attention. Email sits inside the wider system we describe in our content system for Canadian businesses, and it is handled as part of our website growth packages. If paid search is also part of your mix, our Google Ads wasted spend audit is the companion piece published alongside this one. If your deliverability is fine and the problem is that the emails are not producing work, the diagnostic in your website gets traffic but no enquiries is the better starting point, and building an email funnel that converts covers the sequencing side.

Frequently Asked Questions

What is a good email deliverability rate in 2026?

For a permission-based list that is actively maintained, expect a bounce rate under 2 percent and a spam complaint rate under 0.10 percent. Inbox placement, as distinct from delivery, is harder to pin down, but a healthy consumer list should be reaching the inbox for the large majority of engaged contacts. Treat any sustained spam rate above 0.30 percent as an active incident.

Why are my emails going to spam even though SPF, DKIM and DMARC all pass?

Because authentication proves identity, not welcome. Passing all three only tells the receiving server the mail really is from you. Filtering decisions after that are driven by complaint rate, engagement history, sending pattern consistency, list quality and domain reputation. Authentication that passes while mail still lands in junk is the normal signature of a reputation problem, not a DNS problem.

Does the 5,000 a day rule apply per provider or in total?

Per provider. Google’s threshold counts messages sent to personal Gmail accounts, and Microsoft’s counts messages sent to Outlook.com accounts. A Canadian business sending 8,000 messages split across several providers may sit under both thresholds while still being filtered on the same criteria. Build to the bulk standard regardless of where you sit.

How long does it take to recover a damaged sending reputation?

Weeks, not days, and the timeline depends on how the damage happened. Reputation is built from a rolling history of sending behaviour, so recovery requires a sustained period of clean, engaged, low-complaint sending to displace the bad history. The practical route is to cut volume hard, mail only your most engaged contacts, fix whatever caused the problem, and rebuild slowly. There is no reset button.

Should I use a dedicated IP address?

Only at consistent volume. A dedicated IP means your reputation is entirely your own, which cuts both ways. At low or irregular volume there is not enough sending history for a dedicated IP to establish a reputation at all, and you are better off on well-managed shared infrastructure. Most Canadian small businesses do not need one, and some are harmed by moving to one too early.

Does removing subscribers hurt my results?

It reduces list size and usually increases the number of people who actually read you. Disengaged contacts contribute negative signal that affects filtering for your whole list, so suppressing them typically improves inbox placement for the contacts who remain. The number that matters is replies, bookings and revenue, not subscriber count.

Is one-click unsubscribe required by Canadian law?

CASL requires a clearly set out, readily performed unsubscribe mechanism in every commercial electronic message, and requires that requests be given effect without delay. The one-click header specified in RFC 8058 is a platform requirement imposed by Gmail, Yahoo and Microsoft rather than a Canadian statutory requirement, but implementing it satisfies both. Our guide to CASL compliance for Canadian websites covers the statutory side.

My list is mostly business addresses. Does any of this apply?

All of it applies, and you have less visibility. Corporate mail is filtered by Microsoft 365, Google Workspace and third-party security gateways that publish far less diagnostic data than the consumer providers. Authentication matters more in that environment, not less, because security gateways weight it heavily. Expect to rely on bounce classification, reply rate and direct feedback rather than a dashboard.

The Bottom Line

Deliverability is not a trick, a tool or a score. It is the accumulated result of proving who you are, only mailing people who asked, and giving them an easy way out. The platform requirements published by Google, Yahoo and Microsoft are not obstacles, they are a free specification for building a list that keeps working.

Start with the checklist above. Verify Postmaster Tools this week. Write down your sunset policy. Move marketing mail to a subdomain before you need to. Those four actions prevent the large majority of deliverability incidents we are called in to fix.

If your open rates have been sliding and nobody can tell you why, we will audit your sending setup, your list and your reputation signals, and give you the fix list in writing. Start with our intake form and tell us what you are sending and where it is going.