Deliverability and Compliance in 2026: Gmail, Yahoo and Microsoft Sender Rules, A2P 10DLC and the TCPA

Key takeaways

• Every reminder email and text clears three separate gates: mailbox and carrier rules (whether it's accepted), the law (whether you may send it) and verification (whether the address or number is real). Passing one proves nothing about the other two.
• Gmail treats you as a bulk sender at about 5,000 messages a day to personal Gmail accounts, counted across your whole primary domain. The status never expires.[1]
• As of October 4, 2026, the FCC's one-to-one consent rule is not in force. The Eleventh Circuit vacated it on January 24, 2025.[2]
• Text opt-outs must be honored within 10 business days, by any reasonable method, since April 11, 2025. The FCC adopted changes on September 30, 2026 that are not yet effective.[3][4]
• The email unsubscribe footer is a CAN-SPAM and Gmail/Yahoo rule, not a TCPA rule.[5]
• Even senders who test their mail reached the inbox 87.2% of the time in 2025. About one email in eight never got there.[6]

Your reminder emails and texts are one attendance system, and every message has to clear three gates that most guides treat as one.

Mailbox and carrier rules decide whether the message is accepted: the Gmail, Yahoo and Microsoft authentication rules for email, and A2P 10DLC registration for texts. The law decides whether you may send it: CAN-SPAM for commercial email, the TCPA and state laws for texts. Verification decides whether the address or number is real.

As of October 4, 2026, the FCC's one-to-one consent rule is not in force, because a federal appeals court vacated it. The 10-business-day opt-out rule is in force. The "revoke-all" provision is waived until January 31, 2027, and the FCC voted on September 30, 2026 to rewrite it. That vote isn't effective yet.

This guide covers all three gates for a coaching, course or event business where the CRM, the webinar tool, Stripe receipts and the community platform all send as one brand.

Deliverability is attendance

A reminder that never lands is a no-show you paid for.

We learned that the expensive way. A welcome text went to a live event's full registrant list in one burst, from a number those people had never heard from, with a raw link in it. Carriers filtered a large share of it, and the failures pushed the account past its sending limits. Every other text on the account, including the event reminders, stopped until the next day. The full post-mortem is here.

That literally hurts our attendance rate so much.

Email has the same problem, only quieter. Validity's 2026 benchmark, built on seed-address tests across hundreds of mailbox providers, put global inbox placement for 2025 at 87.2%. Another 6.6% went to spam and 6.1% went missing. Microsoft was the hardest major inbox at 77.4%, and Gmail placed 89.8%.[6]

87.2%

Global inbox placement in 2025. 6.6% of mail went to spam and 6.1% never arrived.

On the domains we manage, our target after remediation is 90% or better inbox placement on pre-send seed tests. That's only a few points above the global figure, and those few points are the difference between a reminder that reaches the inbox and one that doesn't.

Now put that next to show rate. In our experience, a free one-day event run well shows 35% to 45% of registrants, and "run well" includes the reminder cadence. Every reminder that goes to spam or gets filtered takes seats out of that range. We cover the rest of the attendance system in our guide to event show rates.

The three gates competitors blur: registration, consent, verification

Most deliverability content covers one channel at a time. Email guides explain SPF and DMARC. SMS providers explain A2P registration. Law firms cover the TCPA. Nobody puts them in one place, so operators assume that clearing one gate clears the others.

It doesn't.

What each gate proves, and what it doesn't

Gate	Who sets the rules	What passing proves	What it does not prove
Acceptance: mailbox rules, A2P 10DLC	Gmail, Yahoo, Microsoft; carriers through The Campaign Registry	Your domain is authenticated and your texting brand and campaign are registered	That this recipient agreed to hear from you
Permission: CAN-SPAM, TCPA, state law	FTC, FCC, courts, state legislatures	You may send this kind of message to this person, at this time	That the message will be delivered
Verification: lookups, passcodes, confirmed opt-in	You	The address or number is real, reachable and, with a passcode, controlled by the person who signed up	Consent

Registration and authentication are platform and carrier policy. Consent is law. Verification is your own data hygiene.

Two examples make the point. An approved A2P campaign proves nothing about one attendee's consent. CTIA's guidance says consent is tied to the campaign the person opted in to and isn't transferable to someone else.[7] And a one-time passcode proves the phone works. It doesn't prove the owner agreed to marketing.

One attendee's journey

Follow one registrant for a free event with a paid VIP upgrade:

1. They fill in the registration form. That form is where consent to texts is captured, or isn't.
2. The CRM sends a confirmation email from your domain.
3. A reminder text goes out from a number on your registered A2P campaign.
4. They buy the VIP upgrade, and Stripe sends a receipt that can carry your domain.[8]
5. The webinar or streaming platform sends its own join reminder.
6. The community platform sends the replay link.

That's at least four different systems mailing or texting as one brand. Each one has to clear all three gates, and each one counts toward the same domain reputation.

Alex Hormozi's Core Four in $100M Leads is a useful lens here. It splits lead generation into one-to-one outreach and one-to-many publishing. A text or email to your list arrives like one-to-one outreach: one sender, one personal inbox, one person. Sending it at speed doesn't change that, so consent and reputation attach to every single message, not to the campaign as a whole.

What's actually in force (last verified 2026-10-04)

Rule	Applies to	Status	Governing source
Gmail bulk-sender requirements: SPF, DKIM, DMARC, alignment, one-click unsubscribe, spam rate under 0.3%	About 5,000+ messages a day to personal Gmail accounts	In force since 2024-02-01. Rejections from November 2025	Google[9][1]
Yahoo sender requirements	Bulk senders (no volume number published)	In force since February 2024	Yahoo Sender Hub[10]
Outlook.com high-volume sender rules	5,000+ messages a day to Outlook.com, Hotmail, Live	In force. Rejected with "550 5.7.515" since 2025-05-05	Microsoft[11]
CAN-SPAM	Commercial email	In force. Up to $53,088 per email (2025 level, kept for 2026)	FTC[5][12]
One-to-one consent and "logically and topically related" limits	Marketing calls and texts	Vacated 2025-01-24	11th Cir.[2]
Prior express written consent (2012 rule)	Autodialed or prerecorded marketing calls and texts	In force	47 CFR 64.1200(f)(9)[3]
Opt-outs by any reasonable method, honored within 10 business days	Calls and texts	In force since 2025-04-11	FCC 24-24; 64.1200(a)(10)[13][3]
"Revoke-all": one informational opt-out stops everything	Informational calls and texts	Waived to 2027-01-31	DA 25-312; DA 26-12[14][15]
FCC 26-67: category-specific informational opt-outs, a designated opt-out method	Calls and texts	Adopted 2026-09-30, not yet effective. Effective 30 days after Federal Register publication, which hadn't happened as of 2026-10-04	FCC 26-67[4]
National Do Not Call protections cover texts	Marketing texts	In force	DA 25-90[16]
Federal quiet hours: no solicitations before 8 a.m. or after 9 p.m. local time	Telephone solicitations	In force. Some states are stricter	47 CFR 64.1200(c)(1)[3]
Unregistered 10DLC traffic	Business texts from US long codes	Blocked by providers	Twilio error 30034; Bandwidth[17][18]
CTIA Messaging Principles	All business texting	Current edition May 2023, enforced by carriers	CTIA[7]

Platform policy (Gmail, Yahoo, Microsoft, CTIA, carriers) is not law, but it decides whether your mail and texts are accepted. Last verified 2026-10-04 for every row.

Why so many TCPA pages are wrong

Search "one-to-one consent rule" and you'll still find pages saying it took effect on January 27, 2025. It didn't.

The Eleventh Circuit granted the petition in Insurance Marketing Coalition v. FCC on January 24, 2025, and vacated Part III.D of the FCC's 2023 order, the part that created the one-to-one requirement.[2] The same day, before the ruling came out, the FCC's consumer bureau had already postponed the rule in DA 25-90.[16] That sequence is why some pages say "postponed" or "delayed". The correct word is vacated.

The stale claims have real sources behind them. The FCC's own one-to-one FAQ, a PDF still live on fcc.gov, says the rule "takes effect on January 27, 2025".[19] A National Law Review headline still says the rule is in effect from that date.[20]

There's a second reason to read the rule itself instead of a summary. In June 2025 the Supreme Court held in McLaughlin Chiropractic v. McKesson that district courts aren't bound by the FCC's interpretations of the TCPA.[21] Courts read the statute themselves, so pages that only paraphrase FCC guidance can go stale in a new way.

We hold ourselves to the same standard. An early research pass for this guide repeated the "took effect" claim, and we caught it only by opening the court's opinion. That's why every row above carries a date and a link.

Email: the send-as inventory

Most email advice assumes one sending tool. Info businesses rarely have one.

Every tool that mails as you

List every platform that sends email with your domain in the From line:

• The CRM. HighLevel or similar: nurture, confirmations, reminders.
• The webinar or streaming platform. Registration confirmations and join links.
• Checkout. Stripe receipts can send from your own domain once you add its records.[8]
• The community or course platform. Replay links, notifications, digests.
• The calendar tool. Booking confirmations for sales calls.
• Staff mail. Google Workspace or Microsoft 365.

Here's why the list matters. Google counts volume toward its roughly 5,000-a-day bulk threshold across everything sent from the same primary domain, and once you're classed as a bulk sender, the status doesn't expire.[1] One careless tool can pull the whole domain into bulk-sender rules, and every other tool then has to meet them.

Ray's advice on this is blunt: stop using multiple domains. He doesn't mean put everything on the root. He means one brand domain, with a sending subdomain for each tool, instead of a scatter of lookalike domains nobody manages.

SPF, DKIM, DMARC and alignment

For bulk senders, Gmail requires SPF and DKIM, a DMARC record, and a From domain aligned with SPF or DKIM.[9] Yahoo requires a DMARC policy of at least p=none that passes.[10] Microsoft requires all three for domains sending more than 5,000 messages a day to Outlook.com, with DMARC at p=none or stronger, aligned with SPF or DKIM.[11]

In plain terms:

• SPF lists which servers may send for your domain.
• DKIM signs each message so the receiver can check it wasn't altered and came from your domain.
• DMARC tells receivers what to do when a message fails, and sends you reports.

Note what the rules ask for: p=none is enough to comply. It isn't enough to protect your domain from spoofing. Our SPF, DKIM and DMARC guide for GoHighLevel walks through the full inventory method, tool by tool, and how to move DMARC to enforcement without breaking your receipts.

Spam rate, one-click unsubscribe and the footer

Spam rate. Google says to keep your user-reported spam rate below 0.1% and never let it reach 0.3%.[1] Yahoo also draws the line at 0.3%.[10] On the client domains we manage, the target we hold is Google's: under 0.1%. Treat 0.3% as the wall, not the goal.

One-click unsubscribe. Gmail and Yahoo require marketing mail to carry the one-click unsubscribe header defined in RFC 8058, a 2017 standard: List-Unsubscribe-Post: List-Unsubscribe=One-Click, covered by the DKIM signature.[22][9] Google excludes transactional messages from that requirement and recommends processing unsubscribes within 48 hours.[1] Yahoo requires them to be honored within 2 days.[10]

The footer. The visible footer with a postal address and an opt-out link comes from CAN-SPAM, the federal law for commercial email. The FTC's guide requires a valid physical postal address and a clear way to opt out. Opt-outs must be honored within 10 business days, and the mechanism must keep working for at least 30 days after you send.[5] Penalties run up to $53,088 per violating email, and the FTC kept that 2025 level for 2026.[5][12]

You'll hear the footer rule credited to the TCPA. It isn't a TCPA rule. The TCPA governs calls and texts.

In our experience, a missing footer is one of the fastest ways to sink a sender. As Ray puts it on audits, Google, Microsoft and even GoHighLevel all check whether that unsubscribe link is there. The bulk sender checklist lays out every provider's rules side by side, with enforcement dates.

When it's already broken

If mail is already landing in spam, don't redesign the templates. Strip them down.

While a domain recovers, we send plainer emails: fewer images, less HTML, one link. We remove invalid and long-inactive addresses before the next send, seed-test before every launch email, and fix authentication before we touch copy. Our guide on why emails go to spam has the full recovery order.

SMS: carrier rules and A2P 10DLC

Texting from a regular 10-digit number for business is application-to-person (A2P) traffic, and US carriers require it to be registered.

Brand, campaign, number: what registration does

A2P 10DLC is the carrier standard that lets long-code traffic be identified as verified and consensual.[23] It has three layers:

1. Brand. Your business identity, registered with The Campaign Registry through your provider.
2. Campaign. What you'll send (marketing, account notifications, mixed), with sample messages and your opt-in flow.
3. Number. Each sending number is attached to an approved campaign.

The fees are small. The Campaign Registry's schedule lists brand registration at $4.50 and a Marketing or Mixed campaign at $10 a month, with Low Volume Mixed at $1.50 a month. Providers can mark these up.[24]

Skipping it isn't an option. Twilio blocks US messages from 10DLC numbers that aren't on an approved campaign (error 30034).[17] Bandwidth says unregistered outbound traffic has been blocked across the industry since February 1, 2025. That's a provider statement, and we didn't find a carrier notice that says it directly.[18]

Registration is about acceptance, not permission. An approved campaign tells carriers who you are. It says nothing about whether a given registrant agreed to your texts. Our A2P 10DLC registration guide covers how to get approved the first time.

Throughput caps and why bulk blasts fail

Registration also sets how much you can send. Twilio's documentation lists T-Mobile daily caps of 1,000 segments for Sole Proprietor brands, up to 2,000 for Low-Volume Standard brands, and 2,000 to unlimited for Standard brands depending on their Trust Score.[23]

A blast to an old list runs into that cap, and into filtering, at the same time. A burst of failures from one send can also trip platform-level limits that pause every other workflow on the account. That's what happened in the welcome-text story above.

Blasting also costs money for nothing. In our experience, usage (email, SMS, carrier and A2P fees) runs 1.5 to 3 times the HighLevel plan fee in launch months for the event funnels we run. Every text to a landline or a dead number is part of that bill.

So we never bulk-blast. We validate, dedupe and then drip: small batches, spaced apart, widened only while the logs stay clean. The SMS pre-flight checklist is the version we run before any large send.

Links: why the first text should carry none

Carriers aren't strict at random. Americans reported $470 million in losses to text scams in 2024, more than five times the 2020 figure.[25] A first text from an unknown number that carries a link looks exactly like a scam.

CTIA's guidance is specific: senders who shorten links should use a shortener with a web address dedicated to their exclusive use.[7] Twilio publishes a vendor figure in the same direction. Across more than 63 million messages, links from third-party shorteners were filtered at 1.96%, against 0.07% for its own branded shortener. It's undated marketing data with no published method.[26]

Our rules follow from that. No raw link in the first text to a new contact. Send the reminder first, then the link in a follow-up, as a trigger link on the brand's own domain. Send from a dedicated number on the registered campaign, and drip the send. With that setup, the target we hold is 95% or better delivery on reminder sends. No method-disclosed industry delivery benchmark exists to compare it with.

Twilio's error 30007 means a message was filtered by Twilio or the carrier as spam or unwanted content.[27] If you see it in bulk, look at links, registration and pacing before you look at copy. The carrier-filtering post-mortem shows the fix step by step.

The 98% open rate isn't a measurement

Nearly every SMS pitch quotes a 98% open rate. Trace it and you land on CTIA's 2022 comments to the FCC, which say open rates "are estimated to be 98 percent" and cite an FCC advisory committee report.[28] We couldn't trace an original measurement. SMS has no open tracking, so nobody can measure it the way email opens are measured. Plan on delivery and clicks, which you can see.

SMS: consent and the TCPA

Registration gets your texts accepted. Consent is what makes them lawful.

Prior express written consent: what the form must say

The rule that matters for autodialed marketing texts is the FCC's prior express written consent requirement. That's the 2012 rule, still in force after the one-to-one vacatur. Under 47 CFR 64.1200(f)(9), it's a written agreement bearing the person's signature that authorizes the seller to send marketing messages to a specific number. An electronic signature that's valid under the E-SIGN Act counts. The agreement must also disclose that signing isn't a condition of purchase.[3]

CTIA adds the carrier layer: express written consent for promotional texts, one opt-in per campaign that isn't transferable, and no opt-in lists that were rented, sold or shared.[7]

For an event registration form, that means a clear text-consent line, next to the phone field, naming your brand and what you'll send. Whether a specific reminder counts as marketing or informational is a question for counsel. If a reminder promotes an upsell, assume it's marketing. Our guide to SMS consent explains why registration, consent and verification are three different things on the form.

Opt-outs within 10 business days, and what the FCC changed on 2026-09-30

Since April 11, 2025, a person can revoke consent by any reasonable method, and you must honor it within a reasonable time that doesn't exceed 10 business days. Replies such as stop, quit, end, revoke, opt out, cancel and unsubscribe all count.[13][3] Ten business days is the legal ceiling. Your platform should process STOP instantly.

One piece was held back. The "revoke-all" provision, under which an opt-out in reply to one informational message would cover every message you send, was waived until April 11, 2026, and then extended to January 31, 2027.[14][15]

On September 30, 2026, the FCC adopted FCC 26-67, released October 1. It lets senders treat an opt-out from an informational message as covering only that category, and lets them designate an exclusive method for revoking consent. The 10-business-day limit stays, and the FCC is asking for comment on whether to shorten it. The changes take effect 30 days after Federal Register publication, which hadn't happened as of October 4, 2026.[4] Until then, plan on the current rules.

The stakes are statutory. The TCPA allows $500 per violation, up to $1,500 if willful or knowing.[29] WebRecon tracked 2,810 TCPA lawsuits in 2025, up 0.8% on 2024, and 68% of December 2025 filings were class actions.[30]

Quiet hours: federal 8 to 9, stricter states

Federal rules bar telephone solicitations before 8 a.m. or after 9 p.m. in the recipient's local time.[3] Some states are stricter. Florida, for example, sets the evening cutoff for commercial telephone solicitation at 8 p.m.[31]

We schedule inside the stricter window when a list spans those states, and we send by the recipient's time zone, not ours. The TCPA status guide has the full state-by-state rows we track.

Verification: real numbers and real addresses

Verification is the gate operators skip, because it feels like hygiene rather than compliance. It's both.

Old lists decay. People type a home or office line into a form, numbers get disconnected and reassigned, and nobody re-checks records collected years ago. In our experience, on lists texted for years without validation, only about 40% to 45% of raw contact records end up as unique, SMS-capable numbers after deduplication and a line-type lookup. We haven't found any public industry figure to compare that with, so treat it as our rule of thumb from list cleans.

Three kinds of bad numbers matter:

• Landlines. They can't receive texts, and every send to one is a wasted fee and a failure on the account.
• Invalid or dead numbers. Typos, fake entries and disconnected lines.
• Reassigned numbers. The number works, but it now belongs to someone who never agreed to hear from you. That's a consent problem, not only a delivery problem.

For email the equivalent is invalid addresses, role addresses and long-inactive subscribers. Remove them before a launch, not after the bounces.

None of this proves consent. A lookup proves a number can receive texts. A passcode proves the person on the form controls it. Our phone verification statistics page separates the numbers that exist from the ones that don't.

The pre-send audit we run before every launch

Pre-send audit: email and SMS

• Inventory. Every tool that sends as the brand is listed, with its sending domain or subdomain.
• Email authentication. SPF, DKIM and DMARC pass and align for each tool. Checked in a real message's headers, not the tool's settings page.
• Spam rate. Gmail Postmaster Tools shows under 0.1% for the sending domain.
• Unsubscribe. Marketing mail carries the one-click header and a visible footer with a postal address.
• A2P. Brand and campaign approved, and the sending number attached to the campaign.
• Consent. The form's text-consent language names the brand and matches what we'll send.
• List. Deduplicated, line-type checked, opt-outs and bounces suppressed.
• First text. No raw link. Links go in a follow-up, as trigger links on the brand's domain.
• Pacing. Drip mode on, with batch sizes inside the campaign's daily cap.
• Timing. Scheduled by recipient time zone, inside the strictest quiet-hours window on the list.
• Seed test. Inbox placement checked on a seed list before the first launch email.

Common mistakes

• Treating registration as consent. An approved A2P campaign doesn't make a text lawful for a person who never opted in.
• Crediting the email footer to the TCPA. The footer is CAN-SPAM plus the Gmail and Yahoo rules.
• Saying one-to-one consent "took effect". It was vacated before it could.
• Stopping at p=none. It passes the mailbox rules and protects nothing.
• Blasting an old list. Validate, dedupe and drip, or one send can shut down every workflow on the account.
• Putting a raw link in the first text. Send the reminder first and the link second, on your own domain.

If you want us to run this audit on your stack, ask us for a funnel audit. We'll check all three gates and tell you which one is costing you attendance.