Your email is being rejected.
Not filtered. Rejected.
Since May 2026 Gmail, Yahoo and Microsoft all enforce sender authentication, and the failure mode changed: non-compliant bulk mail now gets a permanent 550 rejection at the SMTP layer rather than a quiet trip to spam. It never reaches the folder your customer would have checked.
What actually changed
The 2024 Gmail and Yahoo requirements were widely read as advisory. They are not any more. Enforcement
ramped through 2024, escalated in November 2025 from temporary 4.7.x rate-limiting to permanent
5.7.x rejections, and as of May 2026 all three major providers enforce.
| Requirement | Applies to |
|---|---|
| SPF and DKIM, both passing | Everyone sending to Gmail/Yahoo/Outlook |
| DMARC record published, with alignment | 5,000+ messages/day per domain |
| Spam complaint rate under 0.30% | All bulk senders |
| One-click unsubscribe (RFC 8058) | All commercial bulk mail |
| Valid forward and reverse DNS on the sending IP | Anyone running their own server |
The gap between compliant and not is not subtle: compliant senders average around 89% inbox placement, while non-compliant mail sees roughly a fifth to a third routed away entirely.
The failure almost nobody catches
SPF passes. DKIM passes. DMARC still fails.
This is the single most common reason a business believes it is compliant and is not. Your email provider signs DKIM with their domain, not yours. Both individual checks report a pass — so every green tick in your dashboard looks correct — but DMARC does not care whether SPF and DKIM pass. It cares whether the domain they authenticate aligns with the domain in the visible From: header.
Sign with the ESP's domain and alignment fails, DMARC fails, and at p=reject the message is
gone. The fix is a signing domain on your own DNS — which is a ten-minute change once somebody has
correctly identified that this is the problem.
Diagnosing it means reading raw message headers and DMARC aggregate reports, not a dashboard summary. That is the work.
What we do
- Deliverability auditEvery sending source you own — the ESP, the CRM, the transactional provider, the thing on the server nobody remembers installing. SPF lookup count, DKIM selectors and key length, DMARC policy and alignment, rDNS, and where each one actually lands.
- Authentication, done rightSPF within the ten-lookup limit, DKIM signing on your own domain per source, and a staged DMARC rollout —
p=noneand read the reports first, then quarantine, then reject. Going straight to reject is how people delete their own invoices. - Report monitoringDMARC aggregate reports are XML sent to an inbox and are unreadable by hand. We parse them and tell you which sources are failing, which is how you find the marketing tool a department signed up for without telling anyone.
- Your own mail serverPostfix, Dovecot, OpenDKIM and DMARC on a dedicated host with your domain, your IP and your reputation. Webmail included. No per-seat pricing and no provider deciding your mail is now a paid feature.
- Transactional mail that arrivesOrder confirmations, password resets and receipts — the mail that costs you a support ticket when it goes missing — separated onto their own authenticated stream so a marketing blast can never poison them.
We run this ourselves, which is the whole argument
Every address on this domain is served by mail infrastructure we built and administer: Postfix, Dovecot, OpenDKIM, DMARC and Roundcube on our own host, with SPF, DKIM, DMARC and reverse DNS configured by hand. It scores 10/10 on mail-tester. We wrote the installer that provisions it, and it is idempotent, because we run it more than once. This is not a service line we resell.
Guides we have written on this
DMARC fails but SPF and DKIM pass
The alignment problem, how to spot it in a minute, and the fix.
p=none to p=reject, safely
The staged rollout that does not silently delete your own invoices.
All email guides
Written from running our own mail stack, not from reselling one.
Who this is for
- Anyone whose campaign open rates fell off a cliff and whose ESP says everything looks fine.
- Businesses over 5,000 messages a day per domain — the threshold where the rules bite.
- Companies with mail leaving from four different tools, where nobody can list all four.
- Teams who want mail on their own domain and infrastructure rather than a per-seat subscription.
- Anyone about to move to
p=rejectwho would like to not lose real mail doing it.
Common questions
How do I know if this is my problem?
Send one message to a Gmail address, open it, and choose "Show original". You will see SPF, DKIM and DMARC each marked PASS or FAIL. If DMARC says FAIL while SPF and DKIM say PASS, that is the alignment problem described above and it is costing you delivery today.
We use Mailchimp / Klaviyo / SendGrid. Does this still apply?
Yes, and this is exactly where alignment breaks. Using a reputable ESP does not give you DMARC alignment by itself — you have to configure a signing domain on your own DNS for each one. Every additional sending tool is another source that must be authenticated separately.
Is a self-hosted mail server actually a good idea?
For sending bulk marketing mail from a fresh IP, usually not — reputation has to be earned slowly. For a business's own mailboxes on its own domain, it is excellent, and it removes a recurring per-seat cost permanently. We will tell you honestly which of the two you are asking for.
What is BIMI and do we need it?
BIMI puts your logo beside your messages in supporting inboxes. It requires DMARC at enforcement first, so it is a reward for doing the work rather than a task of its own — and for most senders a verified mark certificate is a real annual cost. Worth it for consumer brands, rarely for B2B.
How long does an audit take?
The audit itself is days, not weeks — it is reading DNS, headers and reports. Fixing alignment is usually quick. The part that takes real time is the staged DMARC rollout, because you have to sit at p=none long enough for the reports to show you every legitimate sender before you start rejecting anything.
Send us one email and we will read the headers
Genuinely — forward us a message from your marketing tool and we will tell you whether SPF, DKIM and DMARC align, and what it is costing you. That part is free and takes us ten minutes.
Book a call →