Plaintext
All issues

Issue 1 · Tuesday, November 17, 2026

Gmail and Outlook now bounce mail that cannot prove who sent it

Plaintext is a weekly note on the rule changes that hit small B2B teams who sell by email and search: inbox rules, AI search, and new ad platforms. One change per issue, what it means for you, and one thing to do about it this week.

This week: the inbox rules.

What changed

Over the last two years the three biggest inbox providers moved from asking politely to enforcing.

  • Gmail and Yahoo, February 2024. Anyone sending more than about 5,000 messages a day to personal Gmail accounts must pass SPF and DKIM, publish a DMARC record (monitoring mode, p=none, is enough), align the From domain, offer one-click unsubscribe on marketing mail and keep spam complaints under 0.3%. Every sender, at any volume, needs SPF or DKIM. (Gmail sender guidelines)
  • Microsoft, May 5, 2025. Outlook.com, Hotmail and Live addresses now hold senders of 5,000+ messages a day to the same standard. Mail that fails can be refused outright with the code 550 5.7.515. (Outlook postmaster policies)
  • Gmail, November 2025. Google said enforcement was ramping up, with more non-compliant traffic rejected instead of only filtered. (Spam Resource, Nov 2025)

Why this matters if you send 40 emails a day

The 5,000 line is about volume from your whole domain, not one inbox. Your CRM, newsletter tool, invoicing app and support desk all send as your domain. Add them up and plenty of 20-person companies are closer to the line than they think.

Below the line, the same records still decide where your mail lands. Filters treat a domain with no DMARC record the way a bouncer treats someone with no ID. You might get in. You might not.

When a sysadmin posted Microsoft's change on Reddit in April 2025, one of the top replies was simply: "This is going to be an issue for a lot of small shops out there that don't have these configured." (r/sysadmin)

The three records, in plain words

  • SPF lists the services allowed to send as your domain. One record per domain, and no more than 10 DNS lookups inside it, or it stops working.
  • DKIM is a signature your email provider adds to each message. You publish the matching public key in DNS. Most providers make you switch it on yourself.
  • DMARC tells inboxes what to do when SPF and DKIM fail, and sends you reports about who is sending as you. It has three settings: p=none (watch only), p=quarantine (send failures to spam) and p=reject (refuse them).

Two patterns are common: no DMARC record at all, or p=none set years ago and never moved. Monitoring mode was meant to last a few weeks, not forever.

Do this this week

  1. Run your domain through the free Plaintext DNS check. It takes ten seconds and shows the exact record to add if one is missing.
  2. List every tool that sends email as your domain. Ask whoever runs each one whether it signs with DKIM for your domain.
  3. If you have no DMARC record, publish one in monitoring mode today: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. Then read the reports for two to four weeks before tightening.

If you want it done for you

Moving from p=none to enforcement is where most teams stall, because the reports are hard to read and one missed tool can bounce your invoices.

DMARC enforcement, $249. We read your reports, fix SPF and DKIM for each legitimate sender, and move you to p=quarantine and then p=reject as the reports allow, usually over 30 to 45 days. See the scope. Fixed price, no retainer, and we never ask for passwords.

Yan

Plaintext was founded by Yan Moukoury. Reply to this email with a question and we will answer it in a future issue.