Email deliverability news and updates

This page collects email deliverability news from the source: each item is a change that Gmail, Yahoo, Microsoft or Apple announced on its own pages, or a document the IETF published, with its date and a link. Newest first. It doesn’t repeat third-party reports, and where a provider gives only a month, so does this page. For the full requirements behind each change, read the Gmail, Yahoo and Outlook sender requirements.

Last checked: October 29, 2026.

This month: October 2026

Gmail, Yahoo, Microsoft and Apple announced no new requirement for senders in October 2026 (checked October 29, 2026). One Microsoft feature change touches sending, and two IETF documents moved forward:

• October 27, 2026 – IETF: DKIM2 specification, revision 08. DKIM2 is the DKIM working group’s proposed successor to DKIM. Systems that handle a message add their signatures, and those that change it record what they changed, so receivers can follow the chain, spot replayed messages and send bounces only to systems that handled the message. The authors work at Yahoo, Google and Fastmail. It is a working-group draft, not a standard (IETF Datatracker). The DKIM that mailbox providers check today: DKIM record explained.
• October 9, 2026 – IETF: Aggregate Performance Reporting becomes a working-group draft. The MAILMAINT working group adopted the proposal from Comcast, Iterable and Google as draft-ietf-mailmaint-aprf-00. It defines a format for aggregate reports on email performance, a way to discover where to send them, and how to deliver them. It is still a draft, not a standard (IETF Datatracker).
• October 7, 2026 – Exchange Online: sending from aliases is generally available. Exchange Online users can now send from any alias (proxy address) on their mailbox, not just the primary SMTP address. Admins turn it on with Set-OrganizationConfig -SendFromAliasEnabled $True or under Settings → Mail flow in the Exchange admin center. Microsoft’s announcement lists known gaps and behavior changes, so review them before you turn the feature on for everyone (Microsoft Exchange Team Blog). Our note: if an alias sits on a different domain, that domain needs its own SPF, DKIM and DMARC, because receivers check the domain in the From line.

Checked on October 29, 2026 and unchanged:

• Gmail: the sender guidelines FAQ still names November 2025 as the latest enforcement step.
• Google Postmaster Tools: the old (v1) interface is still due to be retired, but Google has postponed the date: “Stay tuned for more information on timing.” The Domain and IP reputation dashboards are retired and are not part of the new version (Google). In the new version, the Compliance status dashboard has a Deliverability analysis that gives a recommendation about your domain’s status with Gmail (Postmaster Tools dashboards).
• Yahoo: the Sender Hub requirements are unchanged since enforcement began in February 2024. Sender Hub now shows an Insights view with aggregated delivery statistics for your domain; Yahoo marks it as new but gives no date (Yahoo Sender Hub).
• Outlook.com: the postmaster policies still list the high-volume sender rules in force since May 5, 2025.
• Apple: the iCloud Mail postmaster page is still the version of February 25, 2025. The Branded Mail guide was republished on April 14, 2026 with the same DMARC requirement as before (Apple Business User Guide).

Coming up

Changes that providers have announced but that haven’t happened yet:

Swipe sideways to see the whole table →

Email deliverability news archive by month

September 2026

• September 8, 2026 – IETF: Aggregate Performance Reporting, revision 01. An Internet-Draft with authors from Comcast, Iterable and Google proposes a standard format for aggregate reports on email performance, a DNS record that says where to send them, and a way to deliver them. A month later the MAILMAINT working group adopted it (see October 9, 2026) (IETF Datatracker).
• September 2, 2026 – Exchange Online throttles and blocks outdated Exchange servers. Since the second week of September 2026, Exchange 2016 and 2019 servers that send to Exchange Online through an inbound connector of type OnPremises need at least the October 2025 public update, or their mail is throttled and then blocked. Microsoft expects to raise the minimum again in several months, after which only servers in the Extended Security Update program or on Exchange SE will avoid it (Microsoft Exchange Team Blog).

June 2026

• June 24, 2026 – Postmaster Tools API v2 gets domain management and the deliverability verdict. The API can now add, verify and remove domains and manage their users, and the compliance status method returns the deliverability status verdict, so you can read it from a script instead of the dashboard (Gmail API release notes).

May 2026

• May 19, 2026 – DMARC becomes RFC 9989. RFC 9989 obsoletes RFC 7489 and RFC 9091. Aggregate reports moved to RFC 9990 and failure reports to RFC 9991. New tags: np (policy for subdomains that don’t exist), t (testing mode, one policy level lower) and psd (for public suffix operators). The pct tag is gone; t=y replaces it for testing. Existing records keep working. Tag by tag: what is a DMARC record.
• May 1, 2026 – BIMI Internet-Draft, revision 14. The BIMI specification is still an individual Internet-Draft with no formal IETF standing; revision 14 describes the record format v=BIMI1; l=…; a=… at default._bimi and was still the latest revision on October 29, 2026 (IETF Datatracker). How the records work: BIMI and MTA-STS explained.

April 2026

• April 22, 2026 – Microsoft 365 previews a Promotions folder. With the anti-spam setting “Bulk Moves Enabled”, Outlook routes non-spam bulk mail below the organization’s Bulk Complaint Level threshold to a new Promotions folder instead of the inbox; spam still goes to Junk, and mail from senders a user has allowed stays in the inbox. Moving a message back to the inbox stops future routing for that sender. The feature is in public preview; Microsoft says the Promotions tag will be on by default once it is generally available. It concerns mail to organizations on Microsoft 365 whose admins turn it on; the post doesn’t cover Outlook.com (Microsoft Defender for Office 365 blog).

February 2026

• February 3, 2026 – Postmaster Tools API v2 is generally available. The v2 API gives access to the full Postmaster Tools dataset, including the compliance status data, with flexible queries and batch requests (Gmail API release notes).

January 2026

• January 27, 2026 – Exchange Online sets a new timeline for SMTP AUTH with Basic authentication. Apps and devices that send through Exchange Online with SMTP AUTH and a username and password keep working until December 2026. At the end of December 2026, Basic authentication for SMTP AUTH is turned off by default for existing tenants, and admins can turn it back on; new tenants created after that don’t have it by default. Microsoft will announce the final removal date in the second half of 2027 (Microsoft Exchange Team Blog).
• January 6, 2026 – Exchange Online cancels the Mailbox External Recipient Rate Limit. The per-mailbox limit on external recipients that Microsoft had announced for Exchange Online won’t be introduced (Microsoft Exchange Team Blog). The recipient rate limit of 10,000 recipients per mailbox a day and the tenant-level external recipient rate limit still apply (Exchange Online limits).

November 2025

• November 2025 – Gmail ramps up enforcement. Google: “Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic.” Messages that don’t meet the sender requirements “will experience disruptions”, including temporary and permanent rejections. The requirements themselves didn’t change (Google sender guidelines FAQ). Gmail’s authentication rejections are explained in 550 5.7.26.

July 2025

• July 8, 2025 – Gmail adds Manage subscriptions. A view that lists subscription senders by how often they send, with a one-click unsubscribe; “Gmail will send an unsubscribe request to the sender on your behalf.” Rolling out on web, Android and iOS in select countries (Google).

May 2025

• May 30, 2025 – Gmail stops accepting 3DES. From this date, Gmail no longer supports the 3DES cipher for incoming SMTP connections, so mail servers that can only use 3DES can’t deliver to Gmail accounts (Google Workspace Updates).
• May 5, 2025 – Outlook.com requirements for high-volume senders take effect. Domains that send more than 5,000 emails a day to Outlook.com need passing SPF and DKIM and a DMARC record of at least p=none, aligned with SPF or DKIM. The postmaster policies say non-compliant mail goes to the junk folder and, if problems remain, may be rejected with 550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level. (Outlook.com postmaster policies).

April 2025

• April 2, 2025 – Microsoft announces the Outlook.com rules. Microsoft announced the high-volume sender requirements for Outlook.com on its Tech Community blog, with an “April 29th Update” that changed the action taken on messages that don’t meet them (Microsoft Tech Community). The rule that applies today is the one on the postmaster policies page, checked October 29, 2026: junk folder first, then possible rejection with 550; 5.7.515.

February 2025

• February 25, 2025 – Apple’s iCloud Mail postmaster page lists bulk sender rules. In the version published that day, Apple says “all requirements must be met in order to send a bulk email” to iCloud Mail, otherwise the mail is rejected. The list: recipients who opted in (no purchased or appended lists), an unsubscribe link, SPF and DKIM, a DMARC policy, reverse DNS, mail that complies with RFC 5321 and RFC 5322, ARC headers on forwarded mail, consistent sending IPs and From addresses, and handling of bounces and inactive subscribers. iCloud Mail has no allowlist and no feedback loop for bulk senders (Apple).

October 2024

• October 16, 2024 – Apple announces Branded Mail. Businesses verified in Apple Business Connect can show their name and logo in the Mail app (Apple Newsroom). To register a domain, its DMARC record needs p=quarantine or p=reject and pct=100 (Apple Business User Guide).

September 2024

• September 24, 2024 – Gmail accepts Common Mark Certificates for BIMI. Senders without a registered trademark can show their logo with a CMC; senders with a Verified Mark Certificate (VMC) also get the verified checkmark, which now appears in the Gmail apps for Android and iOS too (Google Workspace Updates).

June 2024

• June 1, 2024 – Gmail deadline for one-click unsubscribe. Senders that already had an unsubscribe link had until this date to add one-click unsubscribe to all commercial and promotional messages (Google sender guidelines FAQ). One-click means the two headers from RFC 8058, both covered by a valid DKIM signature, with an HTTPS address in List-Unsubscribe:

List-Unsubscribe: <https://example.com/unsubscribe/opaque-token>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

• June 2024 – Gmail stops mitigation above a 0.3% spam rate. “Beginning June 2024, bulk senders with a user-reported spam rate greater than 0.3% will be ineligible for” mitigation (Google).

February 2024

• February 1, 2024 – Gmail sender requirements take effect. All senders need SPF or DKIM, valid forward and reverse DNS, TLS (added to the list in December 2023), messages formatted per RFC 5322, and a spam rate below 0.3% in Postmaster Tools. Senders of more than 5,000 messages a day also need SPF, DKIM and DMARC with an aligned From domain, plus one-click unsubscribe. Since February 2024, Google provides no delivery mitigation to senders that don’t meet the guidelines (email sender guidelines, FAQ).
• February 2024 – Yahoo starts enforcing its sender requirements. Nearly the same list as Gmail’s, rolled out gradually while Yahoo monitored compliance through the first half of 2024 (Yahoo Sender Hub).

Rule tracker: Gmail, Yahoo, Microsoft, Apple

The rules each provider documents today, checked October 29, 2026. “Since” is the date the rule took effect; where a provider gives no date, the column says so.

Swipe sideways to see the whole table →

Apple still asks for pct=100, a tag that RFC 9989 retired. 100 was always its default, so adding it for Apple’s check doesn’t change how your DMARC policy applies.

To see where your own domain stands, send a test message to the email spam checker: it reports SPF, DKIM, DMARC, reverse DNS and List-Unsubscribe in one go. If the DMARC record is missing, the DMARC generator writes one. Authentication gets mail accepted, while reputation and list quality decide the folder: the email deliverability guide covers those, and bounces from old addresses are a reason to reduce your email bounce rate before the next send.

Sources

All opened and checked October 29, 2026:

• Google: Email sender guidelines, Email sender guidelines FAQ, Postmaster Tools v1 deprecation, Postmaster Tools dashboards, Gmail API release notes, Set up BIMI, Gmail: additional BIMI protections, 3DES for incoming SMTP connections, Manage subscriptions
• Yahoo: Sender Hub, Sender Hub best practices, BIMI
• Microsoft: Outlook.com postmaster policies, High-volume sender announcement, Exchange Online limits, Exchange Team Blog posts on sending from aliases, outdated Exchange servers, the SMTP AUTH Basic authentication timeline and the canceled external recipient rate limit, Defender blog on the Promotions folder
• Apple: Postmaster information for iCloud Mail, About BIMI support in Apple Mail, Branded Mail DMARC requirements, Newsroom, October 16, 2024
• IETF: RFC 9989, RFC 9990, RFC 9991, RFC 8058, BIMI draft, Aggregate Performance Reporting (earlier individual draft), DKIM2 specification