Email deliverability changed more in 2026 than in any year since the bulk-sender rules arrived: DMARC became a real internet standard in May as RFC 9989, Gmail and Outlook.com moved from filtering to outright SMTP rejection, business mailboxes quietly got a rulebook of their own, an AI layer started reading and then operating the inbox, and two European regulators turned the open-tracking pixel into a consent question. This report collects what actually changed through August 2026, each change with its date, and closes with what to do about each one.
One pattern runs through all of it. Authentication, sender reputation, recipient engagement and legal compliance stopped being separate jobs in 2026: every change below tightens the link between at least two of them.
DMARC became a standard: RFC 9989 replaced RFC 7489
The IETF published DMARC as RFC 9989 in May 2026, ending a decade in which the protocol every major mailbox provider requires was, formally, just an informational document. It arrived as three documents, RFC 9989 for the protocol, RFC 9990 for aggregate reporting and RFC 9991 for failure reporting, which together obsolete RFC 7489 and move DMARC to the Standards Track.
Nothing breaks by itself: v=DMARC1 is still the only version string and existing records stay valid. But three tags are gone, pct, ri and rf, and the percentage rollout pct provided is replaced by a test flag, t=y, which applies your policy one level down.
That removal is the one change that alters what happens to your mail with no edit to DNS. Under RFC 7489, p=reject; pct=25 rejected a quarter of failing messages. A receiver following RFC 9989 ignores the tag and rejects all of them. The Unspam DMARC checker flags all three as historic tags for exactly this reason.
Deployment is the missing half. As of August 2026 none of Google, Yahoo or Microsoft has publicly committed to RFC 9989 semantics, and their documentation still describes DMARC in RFC 7489 terms, so both readings of pct are live at once. The tree walk, the DKIM2 drafts and the proposal to retire ARC are covered in our DKIM2 and DMARCbis guide.
One new proposal addresses the thing this year made worse. Draft-brotman-aggregate-performance-reporting, submitted March 17, 2026 by authors at Comcast, Iterable and Google, would have mailbox providers send senders aggregate placement reports: inbox versus unwanted folder, plus engagement split positive, neutral and negative. It keys on the DKIM d= and s= values rather than the From domain, discovered at <selector>._aprf._domainkey.<domain>. Read the standing honestly: an individual submission, no working group, status "I-D Exists", and boilerplate stating it has no formal standing in the IETF process. It is the first serious attempt to replace seed-list inference with provider-reported truth, and it is nowhere near shipping.
Gmail escalated from filtering to SMTP rejections
Gmail began rejecting non-compliant bulk mail at the SMTP level in November 2025, and Google describes the escalation as gradual and progressive rather than a switch. The sender guidelines FAQ warns that non-compliant traffic faces disruptions up to rejection, first as temporary 4.7.x errors then as permanent 5.7.x ones: 5.7.25 for a missing PTR record, 5.7.26 and 5.7.27 for SPF, 5.7.30 for DKIM, 5.7.29 for missing TLS.
The requirements themselves did not move, and they are the February 2024 rules covered in our Gmail and Yahoo requirements guide: spam rate below 0.1% and never reaching 0.3%, SPF, DKIM and DMARC, one-click unsubscribe. Recovery has a published number worth knowing before you panic: a bulk sender regains eligibility for mitigation once its spam rate stays below 0.3% for seven consecutive days.
The scope is narrower than most senders assume, and Google states it plainly: the Email sender guidelines "don't apply to messages sent to Google Workspace accounts". The thresholds, the 5,000-a-day bulk definition and the rejection regime all govern mail to personal gmail.com recipients. Mail to a company running on Workspace is filtered by that tenant's own configuration. A B2B sender optimizing against the 0.1% figure for a recipient list full of business domains is tuning to a rule that does not apply to those recipients. The 5,000-a-day definition is Google's own, too; Yahoo has never published a volume threshold.
The tooling changed more than the rules did. Google retired the old Postmaster Tools interface on a timeline the industry places in autumn 2025, and the API v2 reached general availability on February 3, 2026, so compliance status is now something a script reads on a schedule rather than something a person remembers to check. The replacement signal is blunter than the old reputation scale: v2 exposes a deliverability analysis verdict whose reason codes include SPAM_RATE_HIGH, documented as "The spam rate is above 0.1%", plus USER_FEEDBACK_NEGATIVE, SMTP_ERRORS_HIGH and SENDER_NOT_COMPLIANT. A domain can pass every compliance row and still draw a verdict saying users do not want its mail. Google says the domain and IP reputation dashboards will be retired, without publishing a date, and both are still documented today. Our guide to why DMARC fails covers the failure most senders hit first.
Outlook.com started rejecting unauthenticated bulk mail, then broke for a week
Microsoft now rejects unauthenticated bulk mail to its consumer mailboxes outright. Domains sending more than 5,000 messages a day to outlook.com, hotmail.com, live.com and other Microsoft consumer addresses must pass SPF, DKIM and DMARC under the requirements Microsoft announced on April 2, 2025, and an April 29 revision skipped the planned junk-folder grace period: since May 5, 2025 the documented action for failures is rejection with 550 5.7.515. Microsoft expects SPF and DKIM to pass individually, which is stricter than DMARC's one-aligned-pass logic, and the scope is consumer mailboxes only.
Compliance then proved necessary but not sufficient. For roughly a week in late February 2026, practitioners tracking the consumer platform reported Outlook.com rate-limiting and rejecting mail from long-standing authenticated senders, with temporary 451 4.7.650 errors citing IP reputation alongside outright 550 rejections. Microsoft's own acknowledgement went no further than a support-portal notice about certain IP addresses being temporarily rejected at higher rates. The reported wave peaked on February 24 and 25 and had largely cleared by February 26. It was the year's most visible deliverability incident, it hit senders whose records were in order, and the practical lesson is about detection speed: the senders who lost the least were the ones who noticed within hours.
Microsoft also spent the year removing the evidence senders use to diagnose themselves. From December 4, 2025 SNDS required authentication to approve network access and discontinued complaint sample downloads, and junk-report feeds were cut back to headers with the sender address redacted. Then the last first-party trap signal went: SNDS stopped reporting trap hit counts on July 22, 2026. Recovery steps live in our Outlook.com deliverability guide.
Business mailboxes got their own rulebook, and nobody announced it to marketers
Microsoft started sorting business mail by commercial intent in 2026, and the change went out as tenant plumbing rather than as a sender announcement. Microsoft Learn states that "As of July 2026, all messages identified as bulk (regardless of BCL value) automatically receive the Promotions tag", with a live note that the feature is still rolling out and should reach all organizations by mid-September 2026.
The tag and the folder are two different things, and conflating them is how this gets reported wrongly. Tagging is on by default and tenant-wide, and it renders in Outlook on the web and Outlook for Windows. Actually diverting that mail into a Promotions folder requires the separate bulk-moves setting, which ships off in the default, Standard and Strict preset security policies. Three escapes exist and no others: the recipient has the sender in Safe Senders, the sender is in an accepted domain of the tenant, or the recipient's admin suppresses the stamp with a mail flow rule. Bulk complaint level thresholds are unchanged at 7 by default, 6 under Standard and 5 under Strict.
Tenant senders also got ceilings where consumer senders got filters. Exchange Online enforces a Tenant External Recipient Rate Limit, capping how many external recipients an entire tenant can reach in a rolling 24 hours, scaled to its license count and fixed at 5,000 a day for trial tenants, with distribution-group members counted one by one once the group expands. Microsoft then dropped the companion per-mailbox cap: the 2,000-external-recipient limit announced for individual mailboxes was cancelled in January 2026 before it ever took effect, leaving the per-mailbox recipient rate limit at 10,000 a day. Mail sent from a tenant's onmicrosoft.com domain is now capped far lower, at 100 external recipients per organization per 24 hours, rejected with 550 5.7.236.
None of that is a filtering rule, and Microsoft says plainly that Exchange Online is not suited to bulk mailing. That is the actual message for anyone still running campaigns out of a tenant.
The US consumer mailbox map consolidated, and Apple moved its masked addresses
A growing share of US consumer mail is filtered by Yahoo even where the address says otherwise. Comcast is migrating comcast.net mailboxes to Yahoo Mail at different times in 2025 and 2026, with addresses staying @comcast.net. AT&T's thirteen consumer domains, att.net, sbcglobal.net and bellsouth.net among them, were already Yahoo-hosted, and Yahoo pointed their MX records at its own infrastructure from June 24, 2025. The verizon.net population has been handled by AOL since 2017, though AOL is no longer a Yahoo property: Bending Spoons agreed to buy it in October 2025, with AOL Mail still on Yahoo infrastructure. One precision for list analysts: the comcast.net MX records still point at Comcast-operated hosts, so the migration is reaching users before senders can see it in DNS.
Yahoo's own requirements have not changed since February 2024. What Yahoo added is visibility: Sender Hub Insights, launched October 27, 2025, reports complaint rates and delivered-message counts for DKIM-verified domains.
Apple joined the authentication expectation without a press release. Its iCloud Mail postmaster guidance tells bulk senders to pass SPF and DKIM and publish a DMARC policy, states that bulk mail failing the requirements is rejected, and attaches no deadline and no published complaint-rate threshold. That completes the set: all four major US consumer operators expect authenticated bulk mail and all four reject non-compliant bulk mail, while only Gmail, Yahoo and Outlook.com attach dated rules to it. Classify recipients by mailbox infrastructure rather than by the domain after the @, because a Yahoo reputation problem now reaches far more of a US consumer list than the count of yahoo.com addresses suggests.
Apple also gave senders one piece of homework. On June 15, 2026 it announced that new Sign in with Apple and iCloud+ Hide My Email addresses will be issued on a single domain, private.icloud.com, and asked email service providers to update domain-based filtering, suppression lists and routing rules that enumerate relay domains. Apple said "later this summer" without naming a date, so treat it as announced rather than shipped. Existing masked addresses keep working.
An AI layer reads the inbox, and now operates it
Gmail and Apple Mail both put machine-written summaries and machine-chosen ordering between a delivered email and its reader, and in 2026 the same providers handed that layer the ability to act. Through 2025 Gmail added Gemini summary cards above long threads, a Manage subscriptions view sorted by most frequent sender, and a Most relevant sort that ranks Promotions by each recipient's own engagement. Google announced the Gemini-era Gmail on January 8, 2026, rolling out first in the US, and the AI Inbox view that triages what deserves attention is still subscriber-gated. Yahoo announced Mail summaries on January 27, 2026 under its Scout platform. Apple moved earlier and quieter: Mail categories reached iPhone in December 2024 and iPad and Mac in 2025, categorization runs on-device, and Apple documents no way for senders to influence it.
Not every recipient has the layer switched on. Gmail's Gemini features depend on its smart features settings, and Google documents those as off by default for users in the European Economic Area, Japan, Switzerland and the United Kingdom, who have to enable them deliberately. A European list and an American one are not reading your mail through the same interface, and the difference is a privacy default rather than a rollout schedule.
The acting half is new and the two providers drew the line in different places. Google shipped a Gmail MCP server in developer preview on April 22, 2026, scoped to read and compose: an agent can read, label and draft, and a human still sends. Microsoft's Mail MCP tools expose send, reply, reply-all, delete and update inside a tenant. And from April 27, 2026 Copilot in Outlook enables an actions mode by default, with documented actions to move mail from a named sender into a folder, archive, flag for follow-up and create rules for future messages. Two qualifiers matter: this is Microsoft 365 Frontier early access rather than general availability, and Microsoft states it is not currently available to users in the EU. The documented action list contains no send and no unsubscribe.
For a sender, an agent-written inbox rule is the quietest bad outcome there is: it reroutes your mail permanently with no complaint, no unsubscribe and no signal you will ever see, and an agent archiving a message looks exactly like a human doing it to the filter watching engagement. The funnel gained a stage, sent to delivered to inbox to seen, and placement is still the gate. How Gmail's changes reshape sender strategy is in our Gmail deliverability guide, and writing for summary-first reading has its own guide on AI summaries.
A receiver's broken transport became your delivery failure
Microsoft made other people's TLS configuration a reason your mail gets dropped. Exchange Online outbound connectors now carry SmtpDaneMode and MtaStsMode settings, and the defaults are not passive. Under the default Opportunistic DANE mode, a destination that supports DANE with DNSSEC but fails validation gets the message queued and retried for 24 hours while Exchange tries a secondary MX, and if nothing passes and no secondary MX exists, the message is dropped. The same is true for MTA-STS: if the destination publishes a policy in enforce mode and validation fails, the message is queued for 24 hours and then dropped. Mandatory DANE goes further and requires it of every destination, dropping after 24 hours for any domain that does not support DANE with DNSSEC at all. The asymmetry is worth noting: DANE mode accepts Mandatory, MTA-STS mode does not.
Google, meanwhile, quietly made SPF cheaper. As of August 20, 2026, _spf.google.com resolves to a single record with no include: terms, so include:_spf.google.com costs one of your ten SPF lookups instead of four, and _netblocks3.google.com now answers with an empty v=spf1 ~all. Google published nothing about this, so no flip date exists to cite; it is an observed state you can confirm yourself with one query. The actionable half is for anyone who hardcoded _netblocks, _netblocks2 and _netblocks3 into their record years ago to work around the lookup limit: some of those terms now resolve to nothing while still costing a lookup. Check what your record actually evaluates to with the Unspam SPF checker.
Open rates broke further, and two regulators made the pixel a consent question
An open rate fell in late 2025 without any deliverability change behind it. Validity's telemetry shows Gmail's image proxy cut pixel prefetching by roughly a third in late November 2025, with some Validity customers seeing Gmail opens drop 30% or more quarter over quarter. Validity measured Gmail inbox placement down about 3% across the same months, so the collapse in opens is many times larger than the placement change underneath it. Add AI summaries that digest a message without loading it the traditional way, and the conclusion most teams reached years ago is now unavoidable: opens are directional at best.
Then two European regulators made the pixel a legal object, and drew the line in different places. France's CNIL adopted Délibération n° 2026-042 on March 12, 2026, published in the Journal officiel on April 14. Its FAQ allows an unconsented deliverability pixel only if the one datum collected is the date of the last open, and says logging an IP address or user agent forfeits the exemption even if that data is anonymized or deleted afterwards. Scope is universal: all tracker use in email, B2B included. Senders had three months to inform recipients whose addresses predate publication, so to July 14, 2026, extendable with a documented justification.
Italy's Garante reached the opposite conclusion about which measurement survives. Its provvedimento n. 284 of April 17, 2026, published in the Gazzetta Ufficiale on April 29 with six months to comply, requires prior consent that is free, specific and informed, and exempts anonymized aggregate open-rate measurement as necessary for deliverability and anti-spam work. It also requires a simple way to withdraw consent selectively, so a recipient can switch tracking off without unsubscribing, which almost no email platform renders today.
Read them together, because a pan-European sender cannot ship one pixel policy. France exempts individual measurement stripped to a last-open date; Italy exempts aggregate statistics and not per-recipient measurement. Open-based sunsetting for Italian contacts has no exemption to sit in.
The gap between what providers require and what senders publish stayed wide all year. Across senders tested with Unspam so far in 2026, 52% still have no DMARC, and two years into the one-click unsubscribe mandate only 14% pass the one-click List-Unsubscribe check. The email deliverability benchmark tracks the full set, and the 2026 statistics report breaks it down by provider.
A misleading subject line became a litigation risk with a case name
A false urgency claim in a subject line now carries a price tag. In Brown v. Old Navy, decided April 17, 2025, the Washington Supreme Court held 5 to 4 that the state's Commercial Electronic Mail Act prohibits any false or misleading information in a commercial subject line, not only information that misleads about the message being an advertisement. Subjective hype survives as puffery; a representation of fact, such as when a promotion ends, does not. At $500 per email with no cap, 105 CEMA lawsuits followed within the year on Ballard Spahr's April 2026 count, and copycat filings reached Florida, Maryland and California.
Washington then rebalanced it. ESHB 2274, effective June 11, 2026, added a knowledge requirement, so liability turns on the sender's actual knowledge or knowledge fairly implied from objective circumstances, and cut recipient damages to $100 per message. The operational rule is cheaper than any of those numbers: treat a subject line as a factual claim, reviewed like a landing-page claim, and keep proof the offer matched it. The statutes and the state-by-state exposure are covered in our email spam laws guide.
Filtering is turning per-recipient, say the people who watch it daily
The same campaign now lands differently for two subscribers at the same provider, and practitioners call that the real story of 2026. Laura Atkins made the case in a February 2026 piece for the Certified Senders Alliance: technical enforcement keeps tightening, filtering is increasingly individualized to each recipient's behavior, and AI's effect on the inbox is the open question nobody can quantify yet. Al Iverson's 2026 outlook adds the corollaries: no single passing protocol covers for a failing one anymore, reverse DNS misconfiguration became a routine rejection cause, and the human escalation paths senders once used are disappearing as filtering automates. Spamhaus made the same point in December 2025 by adding a troubleshooter that checks reverse DNS and HELO validity before it accepts a removal request.
Cold outreach lost its remaining cover. M3AAWG published a formal position on cold email in November 2025 calling masked sending domains, evasion of volume limits and artificially simulated engagement particularly egregious, and stating that consent does not transfer between channels. It carries no enforcement mechanism, but it is the industry body rather than a vendor saying it. Spamhaus said in June 2025 that cold email is spam by definition and that bulk cold outreach hitting its spam traps is a listing candidate.
Individualized filtering has an honest implication for testing, including ours. A controlled test measures the binary layer: whether authentication passes, whether a domain sits on a blocklist, what the template trips, and where a controlled send lands at each provider. That is exactly the layer providers now reject on, and it is fully measurable. What no seed test can measure is one subscriber's personal filter, because that verdict exists only in that mailbox. The working split is to test the reject layer and to read the attention layer from your own engagement data, segmented by mailbox provider.
Smaller 2026 changes worth a line each
- Gmail had an outage of its own on April 8, 2026, roughly eight hours of rate-limit bounces to external recipients, so the year does not read as a Microsoft-only failure.
- Microsoft retimed the SMTP AUTH basic-authentication retirement on January 27, 2026. Nothing changes through December 2026, then basic auth for client submission goes off by default for existing tenants and is unavailable to new ones, with final removal announced in the second half of 2027. Anything still submitting mail with a username and password has a deadline.
- Amazon SES shipped tenant isolation with automated reputation policies on August 1, 2025, so SES itself can pause a tenant's sending on a reputation finding before any mailbox provider sees the mail.
- The UK raised the ceiling for unlawful email marketing on February 5, 2026, from a £500,000 cap to the standard maximum of £8.7m or 2% of global turnover, and the ICO's finalized guidance published that April covers tracking pixels alongside cookies.
- Consolidation continued. Validity completed its Litmus acquisition in April 2025, so one company owns Sender Score, Everest, BriteVerify and the rendering-test suite. Zeta Global agreed to buy Marigold's enterprise brands in October 2025, and Infobip acquired SocketLabs in July 2026.
- BIMI stayed a draft. The spec reached revision 14 in May 2026 and is still not an RFC. Gmail has honored Common Mark Certificates since September 2024, which puts a logo next to your name without a registered trademark; the blue verified checkmark still requires a Verified Mark Certificate.
- Spamhaus began enforcing fair use against Oracle-hosted queries on April 15, 2026. Free public-mirror lookups from Oracle network space now return an error code instead of an answer, and a receiver that mishandles it can reject all inbound mail.
- No new email statute landed outside the US, but Canada opened a consultation. The European Commission announced in February 2025 that it would withdraw the ePrivacy Regulation proposal, adopted the withdrawal that July and published it in the Official Journal in October, leaving the 2002 directive in force. CAN-SPAM has not changed since its last review. The CRTC opened Consultation 2026-132 on June 11, 2026, its first rewrite of the Unsolicited Telecommunications Rules since 2014.
What to do before 2027
- Search your DMARC record for
pct,riandrf. A receiver on RFC 9989 applies your full policy regardless of the percentage. Uset=ywhere you previously staged withpct. - Split your reporting by consumer and business recipients. Google's thresholds do not govern Workspace mail and Microsoft's consumer rules do not govern tenants, so one blended number averages two rulebooks.
- Verify SPF and DKIM pass individually. Outlook.com bounces if either fails, and alignment alone does not save you.
- Put compliance on a schedule instead of a memory. The Postmaster Tools API and Yahoo's Sender Hub expose the verdicts a human checks by hand, and scheduled inbox placement tests turn a February-style incident into a same-day alert.
- Re-map provider reporting by infrastructure. Count att.net, sbcglobal.net and migrated comcast.net recipients with Yahoo, because that is whose filters they sit behind.
- Decide your pixel policy per country before October. Italy's deadline lands in late October 2026 and exempts aggregate statistics only, so open-based automation aimed at Italian recipients needs a consent basis or needs switching off.
- Review subject lines like landing pages. An expiration claim needs an owner, and the archive should prove the offer matched the subject.
- Retire opens as a KPI. Report complaints, clicks, bounces and placement, which all kept their meaning through 2026.
The negatives in this report are as informative as the events. No email service provider imposed new dated requirements on its own customers in response to the enforcement wave, no mailbox provider made MTA-STS or TLS-RPT mandatory, and no provider published a rule aimed at cold outreach, leaving that to M3AAWG and Spamhaus. Google Workspace produced no new sender-facing rules at all in 2026 while Microsoft produced four, which is why the business-mailbox half of this report is almost entirely a Microsoft story.
Then test the message rather than the theory. Run your next campaign through the free Unspam spam test and read the authentication panel against the year described above: if SPF, DKIM and DMARC each pass on their own, the record carries no historic tags, and the placement grid is green across providers, every change in this report is one you are already ahead of.
