February 2024: authentication stops being best practice and becomes the gate

Since February 1, 2024, Gmail and Yahoo require every sender to authenticate its mail and keep reported spam below 0.3%, and bulk senders (at Gmail, around 5,000 messages a day) must also publish SPF, DKIM and DMARC and support one-click unsubscribe. Microsoft applied matching authentication rules to Outlook.com from May 5, 2025. Authentication stopped being best practice and became the gate: if your sending domain fails it, nothing else you do in outbound matters.

What changed in February 2024?

Google announced the rules on October 3, 2023. At the time, it said Gmail's defenses were blocking nearly 15 billion unwanted emails every day, and that its 2022 requirement for some form of authentication had already cut the unauthenticated messages Gmail users received by 75%. Yahoo backed the change in the same announcement, and its Sender Hub published matching requirements, with enforcement rolled out gradually from February 2024. Microsoft announced its own on April 2, 2025 for Outlook.com, Hotmail and Live addresses.

What does DMARC at p=none actually require?

Less than it sounds, with one detail worth checking. A DMARC policy of none means, in the words of the current standard, that the domain owner "offers no expression of preference": it asks receivers to block nothing. What the rules do require is that the record exists and that the From: domain your prospects see lines up with a domain that passes SPF or DKIM. Alignment is the part to check, because every tool that sends as your domain, from the sequencer to the CRM to the marketing platform, needs its own SPF or DKIM setup to pass it. DMARC itself moved from an informational document (RFC 7489, 2015) to a Proposed Standard, RFC 9989, in May 2026.

Do the rules apply to a small B2B sales team?

Read the fine print, because it cuts both ways. Google's FAQ says its sender requirements and enforcement apply only to mail sent to personal Gmail accounts, not to Google Workspace accounts. Microsoft's rules cover its consumer addresses. Dana Reyes reads her mail at northwind.com, not at gmail.com. And a team of four reps sending fifty emails a day each is nowhere near 5,000.

Meet the volume rules anyway, for three reasons.

• The count is your whole domain, not your sales team. Google counts every message sent from the same primary domain to personal Gmail accounts, subdomains included, toward the 5,000. Product notifications and the marketing newsletter count too, and may already have put your company over the line.
• The status does not expire. Google's FAQ is explicit.

Senders who meet the above criteria at least once are permanently considered bulk senders.

• The rules describe a trusted sender, whoever enforces them. SPF, DKIM, DMARC and one-click unsubscribe are open standards, and every receiving filter can read them. Our read: a sender that passes all of them is easier to trust at Workspace and Microsoft 365 companies too, even where no published rule requires it.

Why did more domains make outbound harder to run?

The sender side of this era is more throughput across more domains and mailboxes. Spreading volume over separate domains keeps each one under the line, and multiplies the work: every domain needs its own SPF, DKIM and DMARC records, its own monitoring and its own history. Ten lookalike domains are ten pieces of production infrastructure, and in a company with a first head of sales and no sales operations hire, one person owns all of them.

The stricter view is worth knowing too. M3AAWG's sender best practices define cold email as unsolicited email that tries to start a business relationship with someone who has no prior relationship with the sender, and say the group views such email as abusive. Microsoft's hygiene recommendations for large senders ask them to make sure recipients have consented. The law is looser: CAN-SPAM, as the FTC's guide describes it, makes no exception for business-to-business email, asks for an opt-out rather than prior consent, and allows ten business days to honor it. Yahoo allows two. The provider rules are now stricter than the law, and the providers decide placement.

What era five means for a head of sales in 2026

• Audit every sending domain before the next campaign. SPF and DKIM passing, DMARC published and aligned. Postmaster Tools now has a compliance status dashboard that shows this for Gmail.
• Put a one-click opt-out in cold email too, with a visible link, and honor it within two days. Google ties fast unsubscribes to fewer spam reports.
• Watch the spam rate against 0.1%, not 0.3%. In a small campaign the arithmetic is unforgiving: one report among 300 emails delivered to Gmail users is 0.33%.
• Check authentication automatically. Records drift when someone changes DNS or adds a tool. Part 13 treats that drift as a known event that should be caught and fixed without waiting for a person, and part 12 makes sender health the first layer of any reply-rate diagnosis.

Next in the series

Part 6 looks at 2026 and 2027, when research and drafting became nearly free and Gmail's AI Inbox started deciding what a reader sees first, so delivery stopped meaning attention. For the shortcuts these rules answered, see part 4. The series page lists every part in order.