Getting to the inbox.

Why this is a revenue problem

Email and SMS are usually the highest-margin revenue a D2C brand has, because the audience is already yours. That also makes them the channel where a technical failure is least visible: nothing errors, nothing alerts, the campaign reports a send, and the revenue simply is not there. Brands regularly spend months optimising subject lines while a chunk of their list is never seeing the message.

The rules below are not best practice. They are the conditions the mailbox providers apply before deciding whether to accept your mail at all, and since 2025 the failure mode is rejection rather than the spam folder.

What the mailbox providers require

Google publishes the clearest version of the requirements, Yahoo mirrors them closely, and Microsoft aligned with the same core set. Treat Google's list as the standard and you satisfy the others.

Every sender, at any volume, needs:

• SPF or DKIM authentication on the sending domain. In practice, set up both.
• Valid forward and reverse DNS records for the sending IPs. Your email platform handles this on shared infrastructure.
• TLS on the connection used to transmit mail.
• A spam complaint rate below 0.3 percent as reported in Google's Postmaster Tools. This is the one you can move.
• Correctly formatted messages per the RFC 5322 standard, and no impersonation of Gmail in the From header.

Sending 5,000 or more messages a day to that provider adds:

• DMARC on the sending domain. The policy may be p=none to satisfy the requirement, which is a starting position rather than a destination.
• Alignment. The domain in the visible From header must align with either the SPF domain or the DKIM domain. This is the requirement most often failed by brands who believe they are authenticated, because a platform sending "on behalf of" you can pass its own SPF while aligning with nothing of yours.
• One-click unsubscribe on marketing and subscribed messages, implemented with the List-Unsubscribe and List-Unsubscribe-Post headers per RFC 8058. A link in the footer is not the same thing.

The 5,000 threshold is per provider per day, and it is not a commitment you make, it is a measurement they take. A brand mailing a 40,000-person list monthly crosses it on send day.

The enforcement timeline, and why "we set this up years ago" is not an answer

• February 2024. Google and Yahoo began enforcing the requirements above.
• 5 May 2025. Microsoft began applying them to high-volume senders into Outlook.com, Hotmail.com and Live.com, and rejecting mail that fails, returning 550 5.7.15 rather than delivering to junk.

The change in failure mode is the important part. A message filed in spam is recoverable: somebody finds it, some deliverability is retained, the reporting looks bad but not empty. A rejected message never existed. If a meaningful share of your list is on Outlook, Hotmail or Live addresses, which for older and more general-audience brands can be substantial, that is revenue that disappeared without an error anywhere in your marketing platform.

The Shopify-shaped complication

A typical D2C brand sends from more places than it realises, and each one has to be authenticated under your domain and aligned for DMARC.

• Shopify itself, for order confirmations, shipping notifications and password resets.
• Your marketing platform, for campaigns and flows.
• Your helpdesk, for support replies.
• Reviews, loyalty and post-purchase apps, each of which may send under your brand.
• Whatever your finance or ops team uses for invoices.

Every one of those needs its own DKIM record published in your DNS and needs to align with your From domain. Publishing a DMARC record before you have inventoried the senders is how brands break their own transactional mail: you move to enforcement, an unauthenticated sender you had forgotten starts failing, and order confirmations stop arriving. Order confirmations are the emails customers actually want.

Sequence it: inventory every sender, authenticate each one, publish DMARC at p=none, read the aggregate reports for a few weeks until you can account for every source, then tighten. Skipping the reading step is the mistake.

Subdomains, and why your root domain is worth protecting

Send marketing from a subdomain rather than your root domain. Reputation attaches to the sending domain, so a promotional campaign that generates complaints damages the subdomain rather than the domain your order confirmations and password resets depend on. A common split is one subdomain for marketing and another for transactional mail.

New subdomains have no reputation, so they need warming: start with your most engaged segment, the people who opened in the last 30 days, and increase volume over a few weeks. Sending 50,000 cold messages from a domain with no history is the fastest way to teach the providers to distrust it.

Complaint rate is the number you actually control

Authentication is a one-time project. Complaint rate is a daily practice, and the 0.3 percent ceiling is easier to breach than it sounds: three complaints per thousand delivered messages.

• Sunset the unengaged. Stop mailing people who have not opened or clicked in six months, apart from a deliberate winback attempt. This feels like shrinking your list. It is removing the people most likely to report you, and it usually raises revenue rather than lowering it, because deliverability improves for everyone who remains.
• Make unsubscribe easy and obvious. The alternative to an unsubscribe is a complaint, and a complaint is far more expensive. Honour the one-click header immediately.
• Never buy, scrape or rent a list. Beyond the legal exposure, purchased lists are full of addresses that will complain or bounce.
• Keep signup honest. A popup that harvests an address for a discount, then enrols it in daily promotions, produces exactly the behaviour the complaint threshold measures.
• Watch bounces. Rising hard bounces mean list decay, and providers read repeated sends to dead addresses as a signal about your hygiene.
• Segment by engagement, not just by purchase. Frequency that suits your best customers is punishing for someone who bought once.

SMS is a different regime entirely

SMS is not email with fewer characters. It is a registered, carrier-policed channel, and the rules are country-specific.

India. Commercial SMS runs through the TRAI-mandated DLT registration system. You register as a principal entity, register your sender ID header, and register every message template before it can be sent. Since 1 October 2024, URLs and other call-to-action elements have to be whitelisted on the DLT platform in advance, and messages containing a non-whitelisted link are blocked at delivery. That single rule catches brands constantly, because a campaign built around a fresh short link fails silently. Promotional messages are also restricted to the 10am to 9pm window, while transactional messages and one-time passwords are not.

United States. Business messaging over standard numbers requires A2P 10DLC registration of your brand and each campaign, and carriers have filtered or blocked unregistered traffic heavily since enforcement began in February 2025. On top of that sit the TCPA, which requires prior express written consent for marketing messages and carries statutory damages per violation, and carrier rules covering quiet hours in the recipient's local time and immediate handling of STOP replies.

Two habits that keep you out of trouble in both regimes: collect SMS consent separately from email consent rather than bundling it into one checkbox, and keep evidence of when and how each consent was given. Bundled consent is the single most common compliance failure we see, and it is the hardest to fix retroactively because you cannot re-consent a list by emailing it.

What to monitor

• Google Postmaster Tools. Your actual spam rate, domain reputation and authentication pass rates, from the provider itself rather than your ESP's estimate. Set it up even if you think everything is fine.
• DMARC aggregate reports. They tell you every source sending as your domain, which is both a deliverability tool and the way you discover someone spoofing you.
• Delivered rate per provider. A drop concentrated in one mailbox provider is an authentication or reputation problem, not a content problem. Blended delivery rate hides it.
• Complaint rate per campaign. Watch which sends generate complaints. It is usually the discount-led broadcast to the whole list.
• SMS delivery rate by country. A collapse in Indian delivery is nearly always a template or URL whitelisting failure rather than a carrier fault.

Common mistakes

• Assuming your platform handles authentication. It handles its part. SPF, DKIM and DMARC records live in your DNS and are your responsibility.
• Publishing DMARC before inventorying senders. Tightening the policy with a forgotten sender still active breaks transactional mail.
• Sending marketing from the root domain. One bad campaign then damages the domain your order confirmations depend on.
• Mailing the whole list to hit a revenue number. The short-term lift costs you complaint rate, and complaint rate costs you the next quarter.
• Treating SMS consent as included in email consent. It is not, in either India or the US, and it is not retroactively fixable.
• Never opening Postmaster Tools. It is free, it is the provider's own measurement, and it is the only place your real spam rate is visible.

FAQ