Email deliverability changes: the dated log

Deliverability advice goes stale fast: the DMARC spec was replaced in May 2026, Google deleted its reputation dashboards in late 2025, and Microsoft went from "no published requirements" to hard rejections inside one spring. This log records the changes that actually shipped — dated, sourced, most recent first — so you can check whether the guide you are reading predates the rule it describes.

July 2026 — APRF proposed: placement and engagement reports from mailbox providers

An IETF individual draft by Alex Brotman (Comcast), Tom Corbett (Iterable), and Emil Gustafsson (Google) introduced APRF, the Aggregate Performance Reporting Format on July 19: DKIM-keyed daily JSON reports covering inbox-vs-spam classification and engagement signals (rescued-from-spam, marked-safe, complaints, unsubscribes, deletes). Comcast is the only mailbox provider sending beta reports so far, and there is no timeline and no requirement. Nothing to do yet — but with a Google engineer co-authoring, this is the most plausible successor to Postmaster-Tools-style feedback, so it is worth watching.

June 2026 — Microsoft relaunches SNDS; Apple consolidates Hide My Email domains

On June 19, Microsoft relaunched its SNDS portal with updated access controls, completing the platform migration that rebuilt JMRP earlier in the year — if you monitor Outlook reputation through SNDS, re-verify your access. Separately, Apple began consolidating Hide My Email and Sign in with Apple addresses onto private.icloud.com from June 15. Existing relay addresses keep working — only newly generated ones use the new domain — so update any segmentation or suppression logic keyed to privaterelay.appleid.com.

May 2026 — DMARC becomes RFC 9989/9990/9991; pct= is gone

On May 20, the IETF published DMARCbis as RFC 9989 (core, Standards Track), with aggregate reporting split into RFC 9990 and failure reporting into RFC 9991, obsoleting RFC 7489 (Word to the Wise). The Public Suffix List is replaced by a DNS Tree Walk, new tags psd= and np= arrive, and pct=, rf=, and ri= are removed — the pct=25→50→75→100 rollout ramp taught by nearly every existing guide no longer exists in the spec (its replacement is the binary t=y/n). Existing records keep working — dmarcian confirms RFC 9989 is compatible with RFC 7489 — and no mailbox provider has announced a mandate to adopt the new tags. During the transition, Proofpoint's advice is sound: publish both tag sets, and put an explicit _dmarc record on every domain and subdomain you actually send from so discovery never depends on which algorithm the receiver runs.

May 2026 — GMX, WEB.DE, and mail.com start rejecting on inbound DMARC

On May 6, United Internet's GMX / WEB.DE / mail.com — roughly 42 million active users, dominant in Germany — moved to inbound DMARC enforcement: mail from a domain publishing p=reject that fails DMARC is now refused during the SMTP transaction with 554 Transaction failed Reject due to domain's DMARC policy. This bites senders who tightened their policy to p=reject while alignment was still broken, and forwarded mail streams that fail both SPF and DKIM. If you send to German-speaking audiences, confirm DMARC passes with alignment before — not after — publishing a strict policy.

April 2026 — Microsoft-only DKIM failures traced to header formatting

A wave of DKIM failures occurring only at Microsoft was traced to over-long or improperly wrapped headers, with follow-up troubleshooting guidance in May. If DKIM passes everywhere except Outlook/Hotmail, check header length and wrapping before you rotate keys. In industry news the same month, Apple announced it will enter the B2B mailbox space, with AWS WorkMail being discontinued within a year — a shift to track if your recipients skew B2B.

March 2026 — Yahoo adds new sending IP ranges

Yahoo brought new outbound sending IP ranges into service on March 1. This matters if you operate inbound mail infrastructure or maintain allow-lists keyed to Yahoo's previous ranges — update them so replies and feedback-loop traffic from Yahoo are not dropped.

February 2026 — Microsoft rebuilds JMRP; Outlook rate-limiting incident

On February 14, Microsoft rebuilt the Junk Mail Reporting Program on a new platform with updated enrollment — if you depend on JMRP complaint feedback, re-check that your enrollment survived the move. On February 26, a rate-limiting incident caused widespread 451 4.7.650 deferrals at Outlook consumer domains; Microsoft acknowledged "an issue that may result in certain IP addresses being temporarily rejected at higher rates." The lesson generalizes: not every deferral spike is your reputation — rule out provider-side incidents before firefighting your own sending.

January 2026 — Gmail's two-day filtering glitch, inside a multi-provider wobble

On January 24–25, a Gmail glitch delivered mail that should have gone to Promotions or Spam into the Primary tab; measurement by Steven Lunniss (Cordial) found engagement rose slightly, but "along with that engagement lift came an even greater boost in unsubscribes." It was part of a broader early-2026 glitch cluster: Google misclassified mail, Yahoo and Apple rejected non-spam for a time, and Microsoft added a warning banner to its sender support form. If your metrics swung suddenly in January–February 2026, re-baseline before attributing the change to anything you did.

November 2025 — Gmail ramps up enforcement; broken PTR records the top rejection driver

Google added a new line to its sender guidelines FAQ (spotted November 3 by Spam Resource): "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic," with both temporary (4xx) and permanent (5xx) rejections. The requirements did not change — only enforcement intensity did. When Scott Ziegler (Valimail) and Al Iverson later analyzed Google's SMTP rejection data from DMARC aggregate reports, the largest single driver of rejections was not authentication at all but "sending IPs with broken or missing PTR records" — "Gmail alone rejected tens of millions of messages for this reason in a matter of weeks." Action: verify every sending IP has a PTR record whose forward DNS resolves back to the same IP; almost no compliance checklist includes this.

September–October 2025 — Google Postmaster Tools v1 retired; reputation dashboards removed

Google retired the old Postmaster Tools interface — the v1 UI on September 30, 2025, per Twilio SendGrid, with the v1 API decommission at the end of October vendor-reported. Google's own deprecation notice states: "All the dashboards in old Postmaster Tools are available in v2, with the exception of the Domain and IP Reputation dashboards, which will be retired" (Google). "Check your domain reputation in Postmaster Tools" is now impossible advice, though many guides still give it. What you can observe instead: the spam-rate dashboard (keep it below 0.1%) and the v2 Compliance Status checks, which grade eleven requirements as COMPLIANT or NEEDS_WORK.

September 2025 — Laposte.net sends all unauthenticated mail to spam

France's Laposte.net began redirecting 100% of unauthenticated email to the spam folder (Red Sift). Its postmaster page states that at least one authentication protocol is mandatory and that SPF failures are rejected outright. If French consumers are in your audience, passing SPF or DKIM is the floor, not a nice-to-have.

July 2025 — Google embeds SMTP rejection data in DMARC aggregate reports

Google began including its SMTP rejection data in the DMARC aggregate reports it sends (per the Valimail/Iverson analysis that used it). If you process DMARC RUA reports, you can now see what Gmail rejected and why — this is the dataset that later exposed the PTR problem behind the November 2025 enforcement ramp. If you are not collecting and parsing aggregate reports yet, start: it is the only free rejection telemetry Gmail offers.

May 2025 — Microsoft enforcement begins: straight to rejection with 550 5.7.515

Outlook.com enforcement of the new high-volume sender requirements began May 5 — and skipped the announced junk-folder phase, going straight to rejecting non-compliant mail, stricter than Google or Yahoo at the equivalent stage; Microsoft's own support article documents the rejection with an NDR. The under-reported gotcha: Microsoft requires SPF and DKIM and DMARC to all pass — mail that is fully DMARC-compliant by Gmail's or Yahoo's standards can still take a hard 550 5.7.515, and forwarded mail that breaks SPF gets rejected (Spam Resource, November 2025). A caution on attribution: a large share of that spring's "small sender" pain was traced to the Google Domains → Squarespace migration breaking DKIM signing, not to Microsoft enforcement. If Outlook rejects you with 5.7.515, fix all three mechanisms — passing DMARC alone is not enough there.

April 2025 — Microsoft announces Outlook.com requirements for 5,000+/day senders

On April 2, Microsoft announced sender requirements for domains sending more than 5,000 emails per day to consumer Outlook.com/Hotmail/Live: SPF must pass, DKIM must pass, and DMARC at minimum p=none aligned with SPF or DKIM. A late-April update to the same post reversed the enforcement plan from junk-foldering to outright rejection from day one. Note what Microsoft has never published: how the 5,000/day counts across subdomains, and whether bulk status is permanent — do not assume Gmail's aggregation rules carry over.

February 2025 — Apple publishes iCloud Mail bulk sender requirements

Apple's Postmaster information for iCloud Mail page (published February 25, 2025) sets a blunter bar than most senders assume: "All requirements must be met in order to send a bulk email. If not, the email will be rejected." The thirteen-item list includes explicit opt-in provenance (no purchased, rented, or appended lists) and "Add ARC headers to forwarded emails" — Apple is the only major provider that requires ARC outright. Apple also confirms it offers no feedback loop, no allow-list, and no reputation dashboard, so treat these requirements as the entire visible contract with iCloud.

July 2024 — Gmail/Yahoo enforcement reaches full strength

Enforcement of the February 2024 requirements phased up through April and June, with Stripo putting full enforcement around July 2024. The one survey with a stated methodology — Sinch Mailgun, 1,100 senders, surveyed July 2024 — found 23% self-reported a deliverability challenge they attributed to the requirements, while 36.9% were not familiar with the requirements at all. The predicted apocalypse did not happen; the requirements simply became the permanent floor.

June 2024 — SORBS decommissioned

Proofpoint shut down the SORBS blocklist on June 5, 2024, emptying all 18 zones; at its peak it listed over 12 million hosts and was used by more than 200,000 organisations (CSO Online). Any deliverability checklist or monitoring dashboard that still includes SORBS is out of date. Remove it from your blocklist monitoring configuration.

June 2024 — one-click unsubscribe deadlines land at Gmail and Yahoo

June 1, 2024 was Google's deadline for bulk senders who already had unsubscribe links to implement RFC 8058 one-click unsubscribe, and bulk senders with spam rates above 0.3% became ineligible for Gmail delivery mitigation the same month (Gmail FAQ); Yahoo began List-Unsubscribe enforcement in parallel. Gmail's bar is specific: an HTTPS URL in the List-Unsubscribe header plus List-Unsubscribe-Post — mailto: links, body links alone, and preference-page links all fail the requirement (sender guidelines). Yahoo is more lenient and still accepts the mailto: method.

April 2024 — Gmail moves from deferrals to rejections

Google escalated from the temporary errors of February to rejecting a percentage of non-compliant traffic. This was the scheduled next step of the gradual rollout, and the last cheap warning: 4xx codes on authentication failures were about to become 5xx.

February 2024 — Gmail and Yahoo sender requirements take effect

The requirements went live February 1: for all senders, SPF or DKIM, valid forward and reverse DNS (PTR), TLS, and spam rates below 0.3%; for senders of 5,000+/day to Gmail, SPF and DKIM, DMARC at minimum p=none, From-domain alignment, and one-click unsubscribe (Google, Yahoo). Enforcement began gently, with temporary 4xx errors on a slice of non-compliant traffic (Gmail FAQ). Yahoo, notably, refuses to publish a volume threshold — and Yahoo's Marcel Becker was explicit that "If you send 4,999 messages, you still have to follow the requirements."

February 2024 — Seznam.cz joins the Certified Senders Alliance

The largest Czech mailbox provider joined the CSA, the European certification program whose criteria include hard reputation thresholds (complaint rate ≤0.3%, hard bounces ≤1.0%). If you send to Czech recipients, Seznam's published bulk-sender rules — SPF and DKIM mandatory, purchased lists prohibited — now sit inside the same framework the big German providers use.

October 2023 — Google and Yahoo announce the bulk sender requirements

Neil Kumaran announced Gmail's requirements on the Google blog on October 3, 2023, and Yahoo announced parallel requirements the same month, both effective February 2024. This is the announcement that reset the industry baseline: authentication, low complaint rates, and working unsubscribe went from best practice to a gate.

---

This log is maintained by WarmEnvelopes and reviewed monthly against primary sources — provider documentation, RFCs, and named practitioner reporting. Last reviewed August 20, 2026.