Why recruiting emails go to spam, and how to fix deliverability

Recruiting emails usually go to spam for four reasons: the sending domain is not authenticated with SPF, DKIM and an aligned DMARC record; too many recipients mark the messages as spam; volume jumps suddenly from a mailbox or domain with little sending history; and the list contains guessed or stale addresses that bounce. As of October 2026, Gmail and Yahoo have enforced published sender requirements since February 2024, and Microsoft's Outlook.com has applied similar rules to domains sending more than 5,000 messages a day since May 5, 2025. A sourcing sequence that breaks them is filtered or rejected however good the copy is.

This page covers the sending side of outreach, from DNS records to complaint rates, using the mailbox providers' own pages. For what to write, see the candidate outreach email templates; for emails to prospective clients and the CAN-SPAM rules that apply to them, see the business development templates.

What do Gmail, Yahoo and Outlook require from senders?

The three largest consumer mailbox providers publish requirements, and they overlap heavily. Candidates often give personal addresses, so these rules govern most outreach that reaches them. Google's sender guidelines FAQ is explicit that its requirements apply to mail sent to personal Gmail accounts, not to Google Workspace accounts.

Enforcement has tightened over time. Google's FAQ says that from November 2025 Gmail is "ramping up its enforcement on non-compliant traffic", including temporary and permanent rejections. Microsoft's April 29, 2025 update says messages that fail its requirements are rejected with the error "550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level." Yahoo does not publish a volume threshold for "bulk"; its FAQ says only that it means "a significant volume of mail."

Does a recruiting team count as a bulk sender?

More often than recruiters assume. Google counts every message sent from the same primary domain to personal Gmail accounts in a 24-hour period, so mail from example.com and careers.example.com adds up. The FAQ adds that senders who cross roughly 5,000 once "are permanently considered bulk senders."

Add up everything that leaves your domain, not just sourcing sequences: the applicant tracking system's application acknowledgements, interview invitations and rejection emails, job alerts, scheduling tools, marketing newsletters and ordinary staff email. An example with invented numbers: 15 recruiters each sending 120 sequence steps a day, plus 2,000 ATS notifications, plus a company newsletter, can pass 5,000 Gmail recipients on a busy day even though no single recruiter sends much. The safe assumption for any employer with a busy careers site is that the bulk-sender rules apply to the whole domain.

How do you set up SPF, DKIM and DMARC for recruiting email?

This is a job for whoever runs your domain's DNS, usually IT, but recruiting operations should drive it, because recruiting tools are often the senders nobody listed.

1. List every system that sends as your domain. Your mailboxes (Google Workspace or Microsoft 365), the ATS, any sequencing or CRM tool, scheduling software, assessment platforms and job-alert emails. Ask each vendor whether it sends from its own servers using your From address.
2. SPF. Publish one SPF record listing the servers allowed to send for the domain (RFC 7208). The standard limits DNS-querying terms, such as include, a, mx and redirect, to 10 per check, so a record that keeps growing with every new tool eventually fails. Google's guidelines warn that third-party senders missing from your SPF record are more likely to be marked as spam.
3. DKIM. Turn on DKIM signing with your own domain in every tool that sends for you (RFC 6376), rather than accepting the vendor's default signature. Yahoo asks for keys of at least 1024 bits.
4. DMARC. Publish a DMARC record at _dmarc.yourdomain starting with v=DMARC1; p=none and a rua address so you receive aggregate reports. The current standard is RFC 9989, published in May 2026, which obsoletes RFC 7489; records still begin with v=DMARC1, and the pct tag has been removed.
5. Check alignment. DMARC passes only if the domain in the visible From address matches the domain that passed SPF or DKIM. A sequencing tool that signs with its own domain will pass DKIM but fail DMARC alignment.
6. Move toward enforcement. Once reports show every legitimate sender passing, move from p=none to quarantine and then reject. Microsoft's FAQ advises moving gradually, "none, quarantine, reject", to avoid losing legitimate mail. Enforcement also stops scammers from spoofing your exact domain in fake job offers; see recruitment scams impersonating your company.
7. Test. Send a message from each tool to a personal Gmail address, open it, and use "Show original" (Google's help page on tracing an email with its full headers explains where) to confirm SPF, DKIM and DMARC each show PASS.

Should recruiting outreach use a separate domain or subdomain?

Separating mail streams is standard advice. Google recommends sending different message types from different IP addresses and keeping a consistent From address per category; Yahoo recommends segregating email types "by IP or DKIM domain" so bulk mail does not share a reputation with your staff's everyday email. A subdomain such as talent.example.com for sourcing sequences does that. It does not take you under Google's 5,000-message line, because Google counts the primary domain.

Avoid lookalike domains such as example-careers.com. They start with no reputation, they cannot inherit your main domain's DMARC policy, and they look exactly like the domains scammers register to impersonate employers, which teaches candidates to trust the wrong thing.

How many outreach emails can one recruiter send a day?

Mailbox platforms set hard ceilings, and they are much higher than a sensible sourcing volume:

• Google Workspace allows 2,000 messages a day per user (1,500 for mail merge), 3,000 external recipients a day and 2,000 unique external recipients a day, measured over a rolling 24 hours. A user who hits a limit cannot send for up to 24 hours.
• Exchange Online allows 10,000 recipients a day per mailbox and states that customers who need to send "legitimate bulk commercial email" should use third-party providers.

Sequencing tools that send through a recruiter's own mailbox inherit those ceilings. The practical limit is reputation, and Google describes how to protect it: start with a low volume to engaged recipients, send at a consistent rate rather than in bursts, increase gradually, and avoid sudden spikes, noting that "immediately doubling previously sent volumes" can cause rate limiting or a reputation drop. A new recruiter's mailbox, or a new outreach subdomain, should ramp up over weeks. An example ramp, not a provider rule: 20 new contacts a day in week one, 40 in week two, 60 in week three, holding there while the spam rate and bounce rate stay low.

What spam complaint rate is too high?

Google asks senders to keep the user-reported spam rate in Postmaster Tools below 0.10% and never to reach 0.30%. At 0.10%, that is one "Report spam" click per 1,000 messages delivered; at 0.30%, three. Yahoo's ceiling is 0.3%, calculated on mail delivered to the inbox, and senders who sign with DKIM can enroll in its Complaint Feedback Loop to receive a copy of each complaint. Microsoft offers the Smart Network Data Services portal for senders to Outlook.com.

Recruiting outreach is vulnerable here because it is unsolicited by nature. Google's guidelines list "Don't send messages to people who didn't sign up to get messages from you" among practices to avoid, so cold sourcing survives only on relevance: the right person, a role that plausibly fits them, and a short sequence that stops when they reply or opt out. Open rates do not tell you much; Google states that it does not track open rates and that low open rates are not necessarily an indicator of a deliverability problem.

Do recruiting emails need an unsubscribe link?

For bulk senders, Gmail requires one-click unsubscribe on marketing and subscribed messages: two headers, List-Unsubscribe and List-Unsubscribe-Post: List-Unsubscribe=One-Click, as defined in RFC 8058, plus a visible link in the body. A mailto link in the body does not meet the requirement. Google recommends processing unsubscribes within 48 hours, and Yahoo says within two days.

Transactional messages, such as an application confirmation or an interview time a candidate booked, are excluded. A sourcing sequence is the grey area: Google says the recipient, not Google, decides what kind of message it is, and a passive candidate who never applied may see your third follow-up as marketing. The practical answer is to give every sequence a working opt-out, record it in the ATS or CRM the same day, and check that your sequencing tool adds the one-click headers.

Which list and content habits send recruiting email to spam?

• Guessed and enriched addresses. Unverified addresses bounce, and bounces damage reputation. Remove hard bounces immediately; Google suggests automatically unsubscribing recipients with multiple bounces.
• Bought lists. Google's guidelines say not to purchase email addresses from other companies.
• Fake reply threads. Google says not to start subject lines with "Re:" or "Fwd:" unless the message is a real reply or forward, a common sequencing trick.
• Hidden content. Using HTML or CSS to hide text can cause messages to be marked as spam.
• Unclear links. Google asks that links be visible and that recipients know what to expect when they click.
• Sequences that keep going. Every message after "not interested" is a likely spam report. Stop the sequence on any reply.
• Sending from a no-reply address. Microsoft's recommendations include a From or Reply-To address that can receive replies. Candidates should be able to answer the recruiter who wrote to them.

How do you tell what is going wrong?

Seed-test regularly: send each new sequence to colleagues' personal Gmail, Yahoo and Outlook.com addresses and check where it lands before it goes to 300 candidates.

A recruiting email deliverability checklist

1. Every system that sends as your domain is listed, in SPF and signing DKIM with your domain.
2. DMARC is published with reporting, and someone reads the reports monthly.
3. Outreach goes from a real subdomain of your domain, never a lookalike.
4. New mailboxes and domains ramp up gradually; nobody uploads 500 contacts on day one.
5. Addresses are verified before sending, and hard bounces are removed the same day.
6. Sequences stop on reply and carry a working one-click opt-out, honored within two days.
7. The spam rate in Postmaster Tools stays under 0.10%.
8. Opt-outs and "not interested" replies are recorded in the ATS or CRM so a colleague does not email the same person next week.

Once the mail arrives, the message has to earn the reply. The candidate rediscovery templates are written for past applicants, who complain far less than strangers, and the LinkedIn InMail templates cover a channel where these email sender rules do not apply.