The inbox rules changed. Most companies never noticed.

Google changed the rules in February 2024. Microsoft followed in May 2025. Neither announcement reached the businesses it affects, and the gap shows up the moment you measure it.

For most of email's history, reaching an inbox was a matter of not being obviously spam. That stopped being true two years ago, and the change was announced in developer documentation that almost nobody outside the email industry reads.

What Google actually requires

From 1 February 2024, every sender writing to a personal Gmail address has to meet a baseline: authenticate with SPF or DKIM, send over a TLS connection, and keep valid forward and reverse DNS on the sending host.

Send 5,000 messages or more a day to Gmail and the bar rises. You need SPF and DKIM, a DMARC record on the sending domain, alignment between the visible From address and the authenticated one, one-click unsubscribe in the header with a visible unsubscribe link in the body, and a spam complaint rate held below 0.3%.

That last number is the one people misread. 0.3% is three complaints in every thousand messages. One badly targeted campaign clears it comfortably.

Then Microsoft did the same

On 2 April 2025, Outlook.com announced matching requirements for domains sending more than 5,000 messages a day to its consumer addresses, covering outlook.com, hotmail.com and live.com. SPF, DKIM and DMARC, with DMARC at p=none as an absolute minimum and alignment to SPF or DKIM, preferably both. Enforcement began on 5 May 2025.

Microsoft softened the penalty shortly before it landed. Non-compliant mail is routed to the Junk folder rather than rejected outright, which was presented as giving senders time to fix things. Commercially, mail in a junk folder and mail that was rejected produce the same result.

The threshold is not the point

Most small businesses read "5,000 a day", conclude it does not apply to them, and stop reading. That is a mistake for three reasons.

• Requirements move downward. Every deliverability rule of the last decade began with bulk senders and became the default expectation for everyone.
• The protection is not volume-dependent. DMARC stops strangers sending mail in your name. A company sending 40 messages a day is exactly as impersonable as one sending 40,000, and usually has fewer people watching.
• Reputation is earned slowly and lost quickly. A business that decides to do outbound properly in eighteen months starts from nothing if none of this exists yet.

So we measured it

We took 95 companies in one industry across 13 countries and checked them against the standard the two largest inbox providers now describe. The method is in the companion piece.

Of the 73 that fall short, 42 have a record set to p=none. That is the monitoring setting: it watches forged mail go past and does nothing about it. It is the floor Microsoft asks for, not a finish line. The other 31 have nothing at all.

What to actually do

In order, and none of it is a project:

• Publish an SPF record, and a DKIM key for every service that sends on your behalf, including the CRM and the invoicing tool.
• Publish DMARC at p=none with a reporting address, and read the reports for a few weeks. You will find senders you had forgotten about.
• Move to p=quarantine, then p=reject, once the reports are clean. Jumping straight to reject will break mail you did not know you were sending.
• Check the domain on your website as well as the one your mail runs from. They are often different, and the protection is usually applied to only one of them.

An hour with whoever administers your DNS covers all of it. The reason it does not happen is not difficulty. The task sits between the web developer, the IT provider and the founder, and belongs to none of them.