What the inbox requires now

Two things hollowed out the open rate. Apple Mail Privacy Protection pre-loads tracking pixels on the sender's behalf whether or not a person ever views the message, and Apple Mail is a large share of all opens. Apple privacy now accounts for close to half of all tracked opens, about 49%, so for a typical campaign roughly half of recorded opens are machine-generated. The number inflates and stops reflecting attention.

The second is bot and scanner traffic. Through 2025, automated link scanners (security tools and AI agents) generated large volumes of phantom opens and clicks, hitting security-sensitive B2B, government, and education domains hardest. As of late 2025 the major ESPs began filtering known bot clicks, so a small dip in click-through during that window is usually cleaner data, not weaker performance.

What open data can and cannot do now

Measure these instead

Move primary measurement to actions: clicks (after bot filtering), conversions and revenue per email, reply rate where it applies, list growth against churn, and spam-complaint rate. Treat clicks as directional, not absolute. Conversions are the one metric that survives every privacy change.

The 2024 Google and Yahoo bulk-sender rules turned former best practices into hard requirements. Microsoft brought its high-volume senders onto the same footing in May 2025, so the major consumer providers now share one baseline. The grace periods are over. A "needs work" status on Gmail's compliance dashboard behaves as a delivery problem, not a warning.

The bigger shift is that engagement is now the dominant placement signal, not a tiebreaker. A sender can be fully authenticated and compliant and still land in spam if people do not open, click, or reply. Filtering leans on sender history and recipient behavior. Content scanning is a smaller share of the decision than it was a decade ago, so spam placement on a previously healthy sender almost always means reputation degraded, not that the content changed.

The direction is one-way: more authentication, lower spam tolerance, harder enforcement. The 0.3% complaint ceiling is widely expected to tighten toward 0.1% as the enforced number rather than the recommendation, and Apple iCloud Mail has not published formal bulk-sender rules yet but is the obvious next provider to follow. Build to the stricter end now and you do not have to re-engineer later.

The hard numbers

Placement runs in two tiers

Two years into enforcement, the field has split between senders who did the work and senders who did not. Gmail placement for disciplined senders sits well above Microsoft and Outlook, and B2B programs face a structurally harder environment because corporate filters are more aggressive and strip tracking more often.

These records prove that mail claiming to come from your domain is authorized by you. The three core records are expected for bulk send today, and they have to align to the visible From: domain, not just exist somewhere.

BIMI (Brand Indicators for Message Identification) shows your verified logo beside authenticated mail in supporting inboxes. It is a reputation reward, not a deliverability requirement, and it sits on top of DMARC. The hard prerequisite is DMARC at p=quarantine or p=reject with pct=100. A p=none domain cannot qualify, and no provider reads your BIMI record without enforcement in place.

Logo must be SVG Tiny PS. The optional a= tag points to your mark certificate.

VMC vs CMC, which certificate

CMC arrived to widen eligibility for brands without a registered trademark. Only a VMC triggers Gmail's checkmark. Some setups also require DMARC to have been at enforcement for about 30 consecutive days before a logo displays. Apple's "Branded Mail" via Apple Business Connect is a separate, free program from BIMI for Apple surfaces. Outlook remains the gap: Microsoft has cycled a consumer Outlook.com preview on and off since 2023 and has repeatedly delayed its Microsoft 365 rollout, with no general availability and no committed date, so treat all Outlook and Microsoft 365 inboxes as non-displaying when you weigh the cost. Even with everything correct, display stays at each provider's discretion based on your reputation.

Each major provider exposes its own view of how it sees you. Register your sending domain with all of them, then check on a cadence. Dashboards usually lag sending by 24 to 48 hours and most send no alerts, so the checking has to be a habit.

The companion file email-domain-audit.mjs queries DNS for your SPF, DKIM, DMARC, and BIMI records and flags the things that quietly break delivery. It is plain Node, no dependencies, Node 18 or newer. It recursively counts SPF lookups against the limit of 10, reports the DMARC policy and whether it is at enforcement, checks DKIM when you pass a selector, and notes BIMI readiness.

It exits non-zero when a check fails, so you can drop it into a cron job or a CI step and have it fail the build when SPF drifts past 10 lookups or DMARC slips back to p=none. It never sends or changes anything.