Two years of sender rules: what is now table stakes

Two years ago this month, the first of the large mailbox providers began applying published requirements to bulk senders. A great many marketing teams spent that February in a DNS panel for the first time. Microsoft followed with its own set last May. The requirements now cover the majority of most brands' addressable inboxes.

What has changed since is not mainly technical. When we audit a programme today, the authentication records are almost always present and usually correct. Two years ago that was the finding. Today it is the starting position, and the interesting failures sit somewhere else entirely.

That shift is worth naming plainly, because plenty of teams still describe their authentication set-up as an achievement. It is not. It is the entry fee, and the things that separate a healthy programme from a struggling one are now downstream of it.

What the current baseline actually looks like

If you want a single description of where a competent programme sits at the start of this year, it is roughly this.

• SPF, DKIM and DMARC published for every domain and subdomain that sends, with alignment confirmed by inspection rather than assumed from a dashboard.
• A DMARC policy at enforcement, meaning quarantine or reject, not monitoring only.
• Aggregate DMARC reports parsed into something a person reads weekly, with an alert when an unrecognised source appears.
• Transactional, marketing and lifecycle traffic separated onto different subdomains so that one bad campaign cannot damage receipts.
• One-click unsubscribe present on every marketing stream, including the ones sent from systems marketing does not own, and honoured across all systems within the required window.
• Complaint rates monitored per mailbox provider, weekly, with a named owner.
• A written inactivity policy that actually stops mail going to people who have not engaged.

Every item on that list applies across the major providers. The specifics differ, and the Microsoft requirements brought their own details, which we went through in the Outlook sender requirements. Building one baseline that satisfies all of them is far easier than maintaining three variants.

The failures have moved from DNS to process

A record that was correct when it was published stays correct until somebody changes something. In practice, somebody always does.

The recurring causes of a broken set-up now are organisational rather than technical:

• A new tool starts sending as the company domain because a team bought it with a card and nobody was asked.
• A rebrand or domain migration moves the From address, and the authentication work follows six weeks later than the first send.
• An email platform rotates DKIM keys and the corresponding DNS record is never updated, because the person who owned that relationship has changed role.
• DMARC reports arrive at a mailbox nobody has opened since the project that created it ended.
• A subdomain created for a one-off campaign in a regional market inherits nothing and is never decommissioned.

The remedy for all five is the same, and it is dull. Somebody owns sender authentication as a named responsibility, there is a change process for anything that sends mail as the company, and the reports feed an alert rather than a folder.

We have started treating that ownership question as part of the audit rather than a recommendation from it. A programme where nobody can answer who is allowed to edit a DNS record will regress, whatever its records say today.

Enforcement is the step most teams still have not taken

Publishing a DMARC record in monitoring mode satisfies a compliance checkbox and protects nobody. It observes, and it instructs receiving servers to do nothing differently.

Moving to enforcement is what stops other people sending as you, and it remains the most common gap we find. The reason is usually a reasonable fear of blocking legitimate mail, and the answer is a staged path rather than a single change.

1. Complete the sender inventory from the aggregate reports, and keep reading them until a fortnight passes with no unidentified source.
2. Authenticate or relocate every legitimate source. Anything that cannot be authenticated moves to a subdomain of its own or stops.
3. Move to quarantine with a small percentage applied, raise it in steps, and watch the reports between steps.
4. Move to reject once quarantine has run clean for several weeks.
5. Set a policy for subdomains explicitly rather than relying on inheritance you have not checked.

The whole sequence takes a couple of months of mostly waiting. It is not difficult work and it is almost never scheduled, because nothing visibly breaks while it is left undone.

BIMI is a consequence, not a strategy

Every few months a brand team asks about getting the logo into the inbox. BIMI is a reasonable thing to want, and a poor thing to lead with.

It requires DMARC at enforcement, a logo in the right format, and for the major providers a certificate proving you own the mark. In other words, it requires you to have already finished the work above, plus a trademark process and an annual cost.

That is why we treat it as a reward rather than a goal. If a brand team's request for BIMI is what finally funds the move to enforcement, that is a good outcome. If it becomes the project, teams end up buying a certificate for a domain whose complaint rate is the actual problem.

Be realistic about the benefit too. Display varies by client and by context, and the sender name and subject line still do most of the work in deciding whether a message is opened. Recognition is worth something. It is not worth reordering the roadmap for.

Complaint rate and list hygiene are where the work now lives

With authentication settled, the deliverability problems we are called into trace back to who is on the list and how often they are mailed.

The complaint rate is the only requirement that cannot be configured. It is a behavioural measure, reported per provider, and it responds to a short list of things. The quality of the acquisition source, the frequency of sending, how easy the unsubscribe is to find, and whether dormant addresses are still being mailed.

Good list hygiene at this point means four habits, held to consistently:

• Every acquisition source is documented, measured separately, and can be switched off on its own.
• A sunset policy runs automatically, with a defined inactivity window and a final re-permission attempt before the stop.
• The preference centre offers a real choice of frequency and topic, because the alternative to a useful option is the spam button.
• Engagement is measured on clicks and site behaviour rather than opens, since machine-fetched opens make the open signal unreliable for this purpose.

That last point has grown more important as inbox clients have changed how mail is presented and categorised, something we looked at when Apple Mail introduced categories. Where a message lands and how it is grouped now affects engagement metrics in ways that have nothing to do with your sending set-up.

What to check this quarter

Pull the DMARC policy for every sending domain and subdomain, and write down which are at enforcement and which are not. If the answer to any is monitoring only, schedule the staged move now rather than after the next incident.

Then find the last six weeks of aggregate reports and look for a sender you cannot name. There is usually one, and it is usually a tool somebody bought in good faith. Finding it is a better use of a morning than any campaign optimisation available to you.