Why your emails hit spam now, and the 2026 fix

If your newsletters or follow-up emails have quietly stopped landing, the rules changed under you. Gmail and Yahoo set hard sender requirements that took effect in February 2024, Microsoft added its own for Outlook in May 2025, and through late 2025 all three moved from "we will put you in spam" to "we will reject you outright." The fix is not clever copy or a different send time. It is three DNS records and two habits.

What changed

Inbox providers now demand that bulk senders prove who they are and keep people happy. The specifics, from their own documentation:

• Authentication is mandatory. Gmail and Yahoo require SPF, DKIM and DMARC for bulk senders, meaning anyone sending more than 5,000 messages a day to their users. (Google's sender guidelines and the Yahoo Sender Hub both spell it out.) Microsoft brought in the same stack for Outlook, Hotmail and Live in May 2025.
• One-click unsubscribe is required on marketing and newsletter mail, and opt-outs must be honored within two days.
• Complaints are capped. Keep your spam complaint rate under 0.3%, ideally under 0.1%.
• Enforcement got teeth. Through November 2025 the providers escalated from spam-foldering to permanent rejection. Non-compliant mail to Microsoft now returns a 550 error, and Gmail issues hard 5xx rejections. (Proofpoint tracked the escalation.)

None of this is aimed at small businesses. It is aimed at spammers. But the rules catch anyone whose domain is not set up right, and most small senders never set it up at all.

Why it matters

Email is still the cheapest channel a small business owns outright. You do not rent your list from an algorithm. But that only holds if your mail arrives.

Two things go wrong when authentication is missing. Your campaigns bounce or vanish, which is the obvious problem. The quieter one is reputation. Every message that fails a check or gets marked as spam teaches inbox providers to trust your domain less, and that follows you into every future send, including the one-to-one sales email you really needed to land.

The complaint cap bites harder than people expect. At 0.1% you get one complaint per thousand emails. Sounds generous until you email a stale list that forgot it signed up.

The fix, step by step

This is a setup task, not an ongoing chore. Do it once, properly, then keep two habits.

The three records you publish in your domain's DNS look roughly like this. Your email platform gives you the exact DKIM key, and the SPF host depends on who sends for you.

; SPF: lists who is allowed to send for your domain
example.com.        TXT   "v=spf1 include:_spf.yoursender.com ~all"

; DKIM: the public key that verifies each message signature
selector._domainkey.example.com.  TXT   "v=DKIM1; k=rsa; p=MIGfMA0G...your-key..."

; DMARC: what inboxes should do with mail that fails the checks
_dmarc.example.com. TXT   "v=DMARC1; p=none; rua=mailto:reports@example.com"

1. Publish the three records. Add the SPF record listing who sends for you, turn on DKIM signing, and add a DMARC record. Start DMARC at the gentlest setting (p=none) so nothing breaks, confirm your mail passes, then tighten later. If DNS is not your world, your email platform's support docs walk through each one.
2. Turn on one-click unsubscribe. Reputable email tools add the required headers automatically. Make sure it is on, and make sure opt-outs actually process. Do not hide the link.
3. Only email people who asked. Clean your list. Drop addresses that bounce, stop emailing people who never engage. A smaller engaged list beats a big cold one on every metric that matters here.
4. Watch your reputation. Google Postmaster Tools is free and shows your spam complaint rate. Check it now and then. If it climbs, slow down and prune before it becomes a rejection problem.

How the tools differ

Most platforms now generate your DKIM keys and add one-click unsubscribe for you, so the work is mostly pasting records into DNS. What they differ on is what they send. Kit is built around newsletters and walks you through a verified sending domain. GoHighLevel handles domain authentication for CRM follow-up, so sequences leave from your own domain rather than a shared one. Instantly is a cold-email tool with inbox warm-up and rotation. For cold outreach the bulk thresholds technically do not apply, but receiving servers still expect SPF and DKIM.

Common sending tools, by how you send

Kitnewsletters, verified sending domain in setup

GoHighLevelCRM follow-up from your own authenticated domain

Instantlycold outreach with warm-up and rotation

This connects to the wider shift in our AI Overviews briefing for small businesses: search traffic is getting scarcer and each contact is worth more, so the channel you own outright is worth protecting. The growth hub has the rest of the follow-up picture, our Meta Advantage+ default briefing covers where many leads come from, and how AI tools surface recommendations covers being found in the first place.

Worth watching

The direction is one way: stricter. Gmail still accepts the gentlest DMARC setting, but the industry is nudging senders toward enforcing policies (p=quarantine or p=reject) that actively block forgeries. No confirmed deadline yet. Set DMARC up now at p=none and tighten over a few months, and you stay ahead of any future requirement.

Your own engagement is the other thing to watch. As providers lean harder on complaint and interaction signals, the list that opens and clicks is the list that lands.