Most email marketers learned the job from the same handful of rules. Build the biggest list you can. Find the magic send time (Tuesday morning, if you believed the blog posts). Write a subject line nobody could scroll past. For years that was more or less enough.
What happened next was gradual, which is probably why so many teams missed it. Spam filtering moved from keyword lists to machine-learning models that keep a running file on every sender. Gmail, Yahoo and then Microsoft put hard numbers on what they’d tolerate. And then, almost as an afterthought, AI started reading people’s mail before they did. On a recent iPhone, the line of text under your sender name may not be the preheader you agonized over. It may be Apple Intelligence’s own summary of your email.
So the rules shifted, and some of the old advice now works against you. The senders who seem to be coping best have started caring about things that used to sit at the bottom of the checklist, like authentication, complaint rates and visible proof that a message really comes from them. That’s why some brands now weigh the verified mark certificate cost against the value of a verified logo sitting next to their name at the moment someone decides whether to open.
How the inbox changed
Filters now keep a file on every sender
Filtering used to be a technical box to tick: authenticate the domain, steer clear of words like “FREE!!!”, stay off the blocklists. Mailbox providers now treat every sender as an ongoing case file. They look at how recipients engaged with your past mail, how often people complain, how steady your volume is, and whether your authentication passes. They keep looking with every campaign, so two companies can send word-for-word identical emails and land in completely different folders.
Gmail, Yahoo and Microsoft wrote the rules down
In February 2024, Gmail and Yahoo began enforcing requirements on bulk senders, which for Google means anyone sending roughly 5,000 or more messages a day to Gmail addresses. You now need SPF, DKIM and DMARC in place. You need a one-click unsubscribe, and you have two days to honor it. Spam complaints have to stay below 0.3%, and Google would really prefer under 0.1%. Microsoft brought similar standards to Outlook, Hotmail and Live addresses in May 2025. Google has since tightened enforcement, and it now temporarily or permanently rejects mail from senders who don’t comply.
An AI reads your email before people do
This part is newer, and most playbooks haven’t absorbed it yet. Apple Mail, with Apple Intelligence switched on, writes short pre-open summaries that appear in the inbox list in place of your preheader. Gmail’s Gemini adds summary cards to the top of longer emails and threads in its mobile app. Outlook’s Copilot summarizes too, though mostly after someone opens a message. Two audiences now read your email, and one of them is a model deciding how to describe you to the other.
| What the old playbook says | What today’s inbox does | What tends to work now |
|---|---|---|
| A bigger list means more reach | Inactive contacts quietly drag your reputation down | A smaller, cleaner, genuinely opted-in list |
| A clever subject line earns the open | An AI summary may replace your preview text | Clear copy that gets to the point early |
| Send to everyone on a fixed schedule | Sudden volume jumps attract extra scrutiny | Segments built on recent behavior |
| Open rate tells you how you’re doing | Privacy features inflate opens | Clicks, replies, conversions, complaints |
| Authentication is a one-off setup task | Providers require it, and BIMI rewards strict enforcement | DMARC at enforcement, watched over time |
The trouble with big lists
Chasing list size made sense when reach was everything. It makes much less sense once providers start grading you on how your recipients react.
Older or bought lists tend to contain spam traps, addresses that operators keep alive specifically to catch careless senders. Hitting them hurts, and some kinds can land you on a blocklist. The people who never really signed up don’t bother unsubscribing either. They click “report spam,” and with a ceiling of 0.3%, three complaints per thousand emails is enough to put you in trouble. Large inactive segments also pull down your overall engagement, which tells providers that people aren’t interested. In many countries, mailing people without consent is a legal problem on top of all that.
Cleaning a list feels like going backwards at first, since the subscriber count drops. Engagement usually climbs afterwards, though, and reputation tends to follow.
New domains need patience
A fresh domain or IP address arrives with no reputation at all. Fire off a hundred thousand emails from it on day one and, from the provider’s point of view, you look exactly like a spam operation. Recovering from that can take months.
Warming up is slow and unglamorous, and there isn’t really a shortcut. Begin with small sends to your most engaged contacts, let positive signals pile up, then raise volume gradually. Set up SPF, DKIM and DMARC before the very first message goes out. Providers expect it from the start now.
Subject lines meet the summary bot
Shouty capitals, a row of exclamation marks, a preview that promises one thing while the email delivers another: these were never good habits. They hurt you twice now.
The filters are the obvious problem, since providers trained their machine-learning classifiers on precisely these patterns. The less obvious problem is the AI summary. Imagine an Apple Mail user seeing your breathless “LAST CHANCE!!!” subject line right next to an Apple-written summary calmly explaining that the email is a routine newsletter. The mismatch makes you look worse than either line would on its own. And anyone who opens a message and finds less than you promised deletes it and remembers.
What helps is writing so that both the person and the model come away with the right idea. Put the actual point in the opening lines of the email. Keep important information in live text, because Apple’s summaries skip image text entirely. And let the subject line describe what’s really inside.
Making trust visible
Nearly every modern deliverability tactic comes back to one question that providers keep asking about each sender: should this sender be allowed into our users’ inboxes?
BIMI (Brand Indicators for Message Identification) turns a good answer into something people can see, namely your verified logo next to your messages in supporting inboxes such as Gmail, Apple Mail and Yahoo. Getting there is strict on purpose. Your domain’s DMARC policy has to be at enforcement, either quarantine or reject (p=none doesn’t qualify), and you need a mark certificate from an approved certificate authority.
You now have two certificate options. A Verified Mark Certificate requires a registered trademark, and it’s the only option that adds Gmail’s blue verified checkmark. A Common Mark Certificate, which Gmail accepts as well, suits brands without a registered trademark that can prove they’ve used their logo for at least a year. It shows the logo but not the checkmark.
AI makes all this more valuable than it would otherwise be. Software that can simulate real people convincingly also makes fake brand emails cheap to produce. A verified logo, backed by strict authentication, is one of the few signals a forger can’t simply copy.
Stop sending the same email to everyone
Blasting the entire list on a fixed schedule is about the clearest sign that nobody has updated a program in years. Sudden spikes in volume look odd to filters and bring extra scrutiny. Identical content sent to everyone also produces weak engagement, which providers read as a sign people didn’t want it.
Segments built on what people have actually done recently, such as clicks, purchases and visits, keep engagement healthy, simply because the email lands with people who’ve shown some interest. How often you send turns out to matter much less than whether anyone wanted the email.
Your favorite metric is misleading you
There’s another reason the old playbook keeps disappointing people: its favorite number stopped being reliable a while ago. Apple’s Mail Privacy Protection, which Apple launched in 2021, lets Apple Mail preload messages, tracking pixels included, whether or not anyone reads them. Open rates went up across the industry without anyone changing anything. A campaign can look healthy on paper while actual interest is sliding.
Clicks, replies, conversions and complaint rates are harder to fake, and they’re much closer to what mailbox providers pay attention to.
Where AI-written email fits in
Generative AI has made producing email almost free, for marketers and scammers alike. Phishing kits now write fluent, personalized messages, and providers have answered with machine learning of their own, which turns inbox defense into a quiet AI-versus-AI security contest. Ordinary senders sit in the middle.
None of this means you should avoid AI writing tools. It means the bar is higher. A flood of generic, AI-produced email that nobody engages with looks, to a filter, a lot like the spam it learned to catch. AI works best when it makes your emails better, not when it helps you send more of them.
A few common questions
Q. What do Gmail and Yahoo require from bulk senders?
If you send around 5,000 or more daily messages to Gmail, you need SPF, DKIM and DMARC, a one-click unsubscribe handled within two days, and spam complaints under 0.3%. Microsoft applies similar rules to Outlook addresses.
Q. Will an AI summary replace my preview text?
In Apple Mail with Apple Intelligence on, it can. Gmail’s Gemini summaries currently appear inside opened messages, mostly for longer emails and threads.
Q. Does BIMI in Gmail require a VMC?
Either a VMC or a CMC works, as long as DMARC is at enforcement. Only a VMC adds the blue checkmark.
Q. Can I still trust open rates?
Not by themselves. Clicks, conversions and complaint rates give a far more honest picture.
The bottom line
The old rules made sense at the time. Marketers just wrote them for an inbox that doesn’t exist anymore. Machine learning screens today’s inbox, published rules govern it, and AI increasingly describes it to its owner. That inbox favors senders who earn trust slowly and send fewer, better emails.
Related: AI Phishing Is Beating DMARC — Here’s What Still Works
