Email Deliverability in 2026 — DMARC, DKIM, BIMI, Warm-Up

What changed in February 2024

On February 1, 2024, Google and Yahoo simultaneously enforced new sender requirements:

• Authentication mandatory — DMARC, DKIM, SPF aligned for >5,000 daily sends
• Spam complaint ceiling — 0.3% hard cap, 0.1% recommended
• One-click unsubscribe — RFC 8058 List-Unsubscribe header required
• Honour unsubscribes in <2 days — Inbox-level enforcement

Senders without these in place saw deliverability drop from 87% to under 30% inside Q1 2024. See Google's announcement and Yahoo's best practices.

DNS authentication: SPF, DKIM, DMARC

SPF (Sender Policy Framework)

Lists which IPs/services are allowed to send mail for your domain. Set to hard fail (-all), not soft fail.

v=spf1 include:_spf.google.com include:mailgun.org -all

DKIM (DomainKeys Identified Mail)

Cryptographically signs outgoing mail. Use 2048-bit keys (not 1024). Rotate annually. Each sending service (Gmail, Mailgun, SendGrid, XP One) gets its own DKIM selector.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

Tells receivers what to do when SPF/DKIM fail. Three policy levels:

• p=none — Monitor only (start here)
• p=quarantine — Send to spam if fail (after 30 days monitoring)
• p=reject — Reject if fail (target state for 2026)

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com; pct=100; adkim=s; aspf=s

Use adkim=s and aspf=s for strict alignment — required for BIMI later.

BIMI: brand verification

Brand Indicators for Message Identification displays your verified logo next to your emails in Gmail, Yahoo, Apple Mail and Fastmail. Requirements:

1. DMARC at p=quarantine or p=reject with 100% enforcement
2. SVG logo (Tiny PS profile) hosted on your domain
3. VMC (Verified Mark Certificate) from DigiCert or Entrust — $1,200–1,800/year

BIMI is optional but worth it for established brands. Open rates lift 5–10% on average per BIMI Group data.

Custom tracking domain

Never use your sending provider's default tracking domain (e.g., track.lemlist.com). Shared tracking domains accumulate spam history from all users. Set up a CNAME like links.yourcompany.com pointing to your provider's tracking service.

This single change typically lifts deliverability by 15–25% for accounts coming from shared infrastructure.

30-day warm-up schedule

Inbox warm-up tools: Mailwarm, Warmup Inbox, Lemwarm, MailReach. All work on the same principle — automated reply network simulating human conversations to build sender reputation.

Ramp schedule + max volumes

50/inbox/day is the post-2024 ceiling regardless of age. Above this, complaint rates and spam-folder placement spike. To send 500/day requires 10+ inboxes across 2–3 domains.

The two metrics that matter: complaint rate (<0.1%) and reply rate (>2%). Everything else is a vanity number.

Monitoring + tools

• Google Postmaster Tools — Free. Shows your Gmail reputation, complaint rate, spam-folder placement
• Microsoft SNDS — Free. Microsoft equivalent
• GlockApps / MailReach inbox tests — Paid. Seed-list inbox placement reports
• DMARC reports (rua) — Free. Daily XML reports from inbox providers
• XP One — sends over your own custom SMTP with automatic warm-up built in, so the warm-up schedule above runs without a second subscription. Your domain, your reputation, your sending infrastructure — XP One does not put you on shared IPs.

The volume problem nobody fixes with DNS

Everything above is necessary and none of it is sufficient. A perfectly authenticated domain sending 50 irrelevant emails a day still earns complaints, and complaints are the only metric the receiving side truly cares about. The 0.3% ceiling is roughly one complaint per 333 messages — which a badly-targeted list clears without effort.

So the deliverability fix that outperforms every DNS record is writing to people who were expecting to hear from someone like you. On XP One accounts, the same email sent to someone who just commented on a relevant post converts in a 3–8% band; sent to someone who publicly asked for a tool in your category, 15–30%; sent to a passive like, 1–3%.

Measured on XP One accounts, May 2026.

Two structural consequences. First, verify before you send: XP One finds emails and phone numbers at 80%+ accuracy on both, and refunds the credit when nothing is found — bounces are a reputation cost, so not sending is cheaper than guessing. Second, the same discipline applies on LinkedIn, where the penalty is harsher: XP One caps invitations at 80 per campaign, 100 per day and 100 per rolling 7 days, spaces them 1 min 45 to 2 min 15 apart at random, enforces quiet hours in both timezones, holds a 2-hour cooldown between campaigns, and auto-pauses after 5 consecutive failures or the loss of the extension's 10-second heartbeat. Different platform, same principle: the cap is the feature.

For the broader 2026 context, see our pillar Cold Outreach 2026: The Complete Guide, the channel-by-channel version in the multichannel sequence playbook, and signal-based prospecting for how to pick who gets the email at all.

FAQ

Key takeaways

• Feb 2024 enforcement made DMARC, DKIM, SPF non-negotiable
• Max safe volume: 30–50 cold sends/inbox/day
• 30-day warm-up required for every new inbox
• Custom tracking domain is the highest-ROI single fix
• BIMI lifts opens 5–10% but costs $1,200+/year
• Monitor: complaint rate <0.1%, reply rate >2%
• Relevance is a deliverability control: complaints come from people who did not expect you