Email Deliverability Going Into 2027: What B2B Senders Should Fix Before January
The short version: Gmail and Outlook are now enforcing their sender rules, and mail that fails authentication can be rejected outright instead of filtered to spam. For most B2B teams on Marketo, getting ready for 2027 comes down to aligned authentication, unsubscribe handling you understand, and a list that reflects who you can actually reach. The end of the year is the right time to do it, before your Q1 sends.
If your team looked at the sender requirements when they landed in 2024 and decided they were mostly for consumer senders, that was a reasonable call at the time, but a lot has changed since. Rejections are now part of enforcement, Google has said stricter alignment is likely on the way, and Postmaster Tools no longer shows the reputation charts many teams used as an early warning. The personal addresses in your database haven’t gone anywhere either. Here’s what’s being enforced, who it applies to in a B2B list, and what we’d fix before the year ends.
If your team looked at the sender requirements when they landed in 2024 and decided they were mostly for consumer senders, that was a reasonable call at the time, but a lot has changed since. Rejections are now part of enforcement, Google has said stricter alignment is likely on the way, and Postmaster Tools no longer shows the reputation charts many teams used as an early warning. The personal addresses in your database haven’t gone anywhere either. Here’s what’s being enforced, who it applies to in a B2B list, and what we’d fix before the year ends.
What Changed Going Into 2027
Gmail. Gmail has been stepping up enforcement on mail that doesn’t meet its sender requirements, including temporary and permanent rejections. Google says enforcement for bulk senders is gradual and progressive, and rejected mail comes back with an error code that names the requirement that failed. Google treats you as a bulk sender once you send close to 5,000 messages a day to personal Gmail accounts from the same primary domain, and that status doesn’t expire.
Microsoft. Outlook.com requires SPF, DKIM and DMARC from domains sending more than 5,000 emails a day to its consumer addresses. Microsoft’s announcement describes both routing non-compliant mail to Junk and rejecting it with a 550 5.7.515 error, so it’s safest to plan for the rejection.
Where it’s heading. Today, Google only needs your From domain to align with either SPF or DKIM. Google recommends aligning both, though, and says that will likely become a requirement. At the same time, Google has retired the domain and IP reputation charts in Postmaster Tools, so the signal many teams watched for trouble is gone. Compliance status and spam rate are what Google shows you now.
One thing to watch: neither provider has published a date for a new rule, and the wording on both sides has changed more than once. Re-read Google’s email sender guidelines and Microsoft’s Outlook.com sender requirements before you act on a specific number.
Microsoft. Outlook.com requires SPF, DKIM and DMARC from domains sending more than 5,000 emails a day to its consumer addresses. Microsoft’s announcement describes both routing non-compliant mail to Junk and rejecting it with a 550 5.7.515 error, so it’s safest to plan for the rejection.
Where it’s heading. Today, Google only needs your From domain to align with either SPF or DKIM. Google recommends aligning both, though, and says that will likely become a requirement. At the same time, Google has retired the domain and IP reputation charts in Postmaster Tools, so the signal many teams watched for trouble is gone. Compliance status and spam rate are what Google shows you now.
One thing to watch: neither provider has published a date for a new rule, and the wording on both sides has changed more than once. Re-read Google’s email sender guidelines and Microsoft’s Outlook.com sender requirements before you act on a specific number.
Do Gmail and Outlook Sender Rules Apply to B2B Email?
Not directly, and it’s worth being precise about this. Google’s sender guidelines apply to mail sent to personal Gmail accounts, not Google Workspace accounts. Microsoft’s high-volume requirements cover Outlook.com’s consumer service (outlook.com, hotmail.com and live.com addresses), not business mailboxes on Microsoft 365.
If your database is mostly corporate addresses, you won’t see Gmail or Outlook.com rejections the way a consumer sender would. Mail to corporate mailboxes is filtered by each organization’s own systems instead.
Now the honest part: that doesn’t make any of this optional. Almost every B2B database holds personal addresses, from people who signed up with a Gmail account to contacts imported from events. Authentication is also something most receiving servers check, whether the mailbox is corporate or personal. So the B2B picture is different from the consumer one, but it isn’t a reason to wait.
If your database is mostly corporate addresses, you won’t see Gmail or Outlook.com rejections the way a consumer sender would. Mail to corporate mailboxes is filtered by each organization’s own systems instead.
Now the honest part: that doesn’t make any of this optional. Almost every B2B database holds personal addresses, from people who signed up with a Gmail account to contacts imported from events. Authentication is also something most receiving servers check, whether the mailbox is corporate or personal. So the B2B picture is different from the consumer one, but it isn’t a reason to wait.
How to Set Up SPF, DKIM and DMARC in Marketo
SPF. Adobe’s setup guide has you add Marketo’s include (include:mktomail.com) to your domain’s SPF record. While you’re in there, check that the record covers every other service sending as you, including tools marketing added without telling IT. SPF allows a maximum of 10 DNS lookups, so a record that keeps growing can stop working altogether.
SPF won’t align with your From domain on its own in Marketo, though. Unless you’ve set up a branded return-path, Marketo mail goes out with Adobe’s mktomail.com return-path, so SPF passes for Adobe’s domain rather than yours.
DKIM. This is the piece that does the real work for DMARC in Marketo. Adobe recommends aligning DMARC on DKIM rather than SPF, so set up a custom DKIM signature for every domain and subdomain you send from, and verify each one in Admin > Email > DKIM. If you also want SPF alignment, that takes a branded return-path set up through Adobe Support. Adobe doesn’t support strict SPF alignment.
DMARC. Google requires bulk senders to publish a DMARC record with a policy of at least p=none, and to have the From domain aligned with either SPF or DKIM. A p=none policy meets the requirement, but it asks receivers not to act on mail that fails, so it won’t stop anyone spoofing your domain.
Moving to p=quarantine and then p=reject is what tells receivers to block spoofed mail. No mailbox provider requires it today, but Adobe and Microsoft both recommend getting there gradually, and that’s what we’d do. Before you start, turn on DMARC aggregate reports, read them for a month and confirm every legitimate sender is passing. Only then tighten the policy. Skipping the reports is how a sending tool nobody documented ends up blocked.
SPF won’t align with your From domain on its own in Marketo, though. Unless you’ve set up a branded return-path, Marketo mail goes out with Adobe’s mktomail.com return-path, so SPF passes for Adobe’s domain rather than yours.
DKIM. This is the piece that does the real work for DMARC in Marketo. Adobe recommends aligning DMARC on DKIM rather than SPF, so set up a custom DKIM signature for every domain and subdomain you send from, and verify each one in Admin > Email > DKIM. If you also want SPF alignment, that takes a branded return-path set up through Adobe Support. Adobe doesn’t support strict SPF alignment.
DMARC. Google requires bulk senders to publish a DMARC record with a policy of at least p=none, and to have the From domain aligned with either SPF or DKIM. A p=none policy meets the requirement, but it asks receivers not to act on mail that fails, so it won’t stop anyone spoofing your domain.
Moving to p=quarantine and then p=reject is what tells receivers to block spoofed mail. No mailbox provider requires it today, but Adobe and Microsoft both recommend getting there gradually, and that’s what we’d do. Before you start, turn on DMARC aggregate reports, read them for a month and confirm every legitimate sender is passing. Only then tighten the policy. Skipping the reports is how a sending tool nobody documented ends up blocked.
What Marketo's One-Click Unsubscribe Does, and Where It Stops
Here’s the good news: Marketo has added one-click unsubscribe to marketing emails automatically since January 2024, so there’s nothing to build. There are two limits worth knowing about, though.
It only applies to marketing emails. That matches Google, which requires one-click unsubscribe for marketing and promotional messages but not transactional ones. It also means your operational email classification matters more than it might seem. Google says recipients decide what counts as promotional, so an email marked operational in Marketo that’s really promotional is a gap worth closing.
It unsubscribes the person from the whole instance. Someone leaving one brand’s newsletter is unsubscribed from every brand you run out of that instance. Unsubscribed people still receive operational emails, so anything sent as operational keeps arriving, but every marketing program stops. It’s recorded on the person record, so if you run several brands from one instance, build a report your brand owners actually check.
It only applies to marketing emails. That matches Google, which requires one-click unsubscribe for marketing and promotional messages but not transactional ones. It also means your operational email classification matters more than it might seem. Google says recipients decide what counts as promotional, so an email marked operational in Marketo that’s really promotional is a gap worth closing.
It unsubscribes the person from the whole instance. Someone leaving one brand’s newsletter is unsubscribed from every brand you run out of that instance. Unsubscribed people still receive operational emails, so anything sent as operational keeps arriving, but every marketing program stops. It’s recorded on the person record, so if you run several brands from one instance, build a report your brand owners actually check.
List Hygiene: Bounces, Inactive Records and Bot Form Fills
Complaint rate is the one metric Google puts a hard number on. Keep the user-reported spam rate below 0.1% and don’t let it reach 0.3%, since bulk senders above 0.3% lose access to Google’s delivery mitigation. Google calculates the rate daily, so one send to a segment that doesn’t remember opting in can push a single day over the line.
Bounce handling. In Marketo, Email Invalid stays checked until someone resets it, either by hand or with a smart campaign. Email Suspended works differently: it blocks mailing for 24 hours after certain hard bounces, and then the person is mailable again. The box stays checked afterward, though, so a smart list filtered on Email Suspended will undercount who you can actually send to. Check when the suspension happened instead. We covered the recent branded return-path and bounce processing change in Three Marketo Changes to Check Before the End of September, and our earlier look at the Gmail sender requirements is Cracking Down on Spam: Gmail’s 2024 Update and Its Impact on Email Marketing.
Inactive records. Records that haven’t engaged in a year aren’t adding anything to your engagement signals, they count toward your contracted database size, and addresses at abandoned mailboxes eventually start hard bouncing. A quick win: define engagement by email clicks and form fills rather than opens, since Apple Mail Privacy Protection can load an email’s images whether or not anyone reads it. One thing to watch: Marketo only keeps web page visits for 90 days, so they can’t support a 12-month lookback on their own. If visits matter to your definition, stamp a “last engaged” date field whenever someone clicks, fills out a form or visits, and build your inactive smart list on that field instead.
Bot form fills. Junk submissions inflate your database and can carry addresses that bounce or belong to people who never asked to hear from you, which is how complaints start. We’d fix this at the form rather than cleaning up the list afterward. A challenge-based CAPTCHA stops the record from being created, while score-based options still let it in for you to handle later, so pick based on how much cleanup your team can take on.
Bounce handling. In Marketo, Email Invalid stays checked until someone resets it, either by hand or with a smart campaign. Email Suspended works differently: it blocks mailing for 24 hours after certain hard bounces, and then the person is mailable again. The box stays checked afterward, though, so a smart list filtered on Email Suspended will undercount who you can actually send to. Check when the suspension happened instead. We covered the recent branded return-path and bounce processing change in Three Marketo Changes to Check Before the End of September, and our earlier look at the Gmail sender requirements is Cracking Down on Spam: Gmail’s 2024 Update and Its Impact on Email Marketing.
Inactive records. Records that haven’t engaged in a year aren’t adding anything to your engagement signals, they count toward your contracted database size, and addresses at abandoned mailboxes eventually start hard bouncing. A quick win: define engagement by email clicks and form fills rather than opens, since Apple Mail Privacy Protection can load an email’s images whether or not anyone reads it. One thing to watch: Marketo only keeps web page visits for 90 days, so they can’t support a 12-month lookback on their own. If visits matter to your definition, stamp a “last engaged” date field whenever someone clicks, fills out a form or visits, and build your inactive smart list on that field instead.
Bot form fills. Junk submissions inflate your database and can carry addresses that bounce or belong to people who never asked to hear from you, which is how complaints start. We’d fix this at the form rather than cleaning up the list afterward. A challenge-based CAPTCHA stops the record from being created, while score-based options still let it in for you to handle later, so pick based on how much cleanup your team can take on.
Your Before-January Checklist
Authentication
- Check your SPF record. Make sure it includes Marketo and every other service sending as you, within the 10-lookup limit.
- Confirm custom DKIM on every sending domain. Include subdomains, and verify each one in Marketo.
- Confirm DMARC passes through aligned DKIM. The record needs a policy of at least p=none, and Marketo mail should pass with DKIM aligned to your From domain. If you have a branded return-path, check SPF aligns too, since Google expects that to become a requirement.
- Turn on DMARC aggregate reports. Read them for a month before you tighten the policy.
Unsubscribes and list hygiene
- Review your email classification. Anything promotional should be sent as a marketing email, not operational.
- Tell your brand owners how one-click unsubscribe works. It applies across the whole Marketo instance.
- Review Email Invalid records. Reset only the ones with a corrected address, or they’ll hard bounce again.
- Suppress twelve-month non-engagers. Base it on email clicks and form fills, or a “last engaged” date field, and do it before your heaviest sending weeks.
Monitoring
- Check Google Postmaster Tools. Look at the Compliance status page and compare your spam rate to the 0.1% line, not the 0.3% one. With the old reputation charts retired, these are now the main signals Google gives you.
- Set up blocklist monitoring. You want a listing to surface before a campaign does.
- Re-read the provider guidance. Check Google’s and Microsoft’s pages before acting on any specific threshold.
Most of these are quick checks. The DMARC reporting and monitoring items take longer and matter more.
Start With Authentication, Then Clean the List
Check authentication first, because it’s the hard requirement with published consequences. Then work on list hygiene, because it drives the complaint and bounce rates that decide everything else.
Treat the end of the year as your deadline. It beats finding out in February, when a Q1 launch underperforms and nobody can say why.
Treat the end of the year as your deadline. It beats finding out in February, when a Q1 launch underperforms and nobody can say why.
