---
title: Black Friday Email Deliverability — A 2026 Checklist for Online Stores
description: Get store email ready for Black Friday 2026 — Gmail, Yahoo and Outlook sender rules, a volume ramp plan, spam checks, and how to keep order emails out of spam.
source: https://pingvera.com/blog/black-friday-email-deliverability.html
---
# Black Friday Email Deliverability: A 2026 Checklist for Online Stores

You can get Black Friday email deliverability in order in the next five weeks. Confirm that every domain you send from passes SPF, DKIM and an aligned DMARC check, with one-click unsubscribe on marketing mail. Raise your sending volume in steps, starting with your most engaged subscribers, so the peak week is not the first time mailbox providers see your full list. Then keep order confirmations, shipping notices and password resets on a separate stream, so a promotional campaign that draws complaints cannot drag them into spam.

As of October 2026 the stakes are higher than in previous peaks. Gmail said it would ramp up enforcement on non-compliant traffic from November 2025, with temporary and permanent rejections, and Outlook.com has applied its own high-volume sender requirements since May 2025. Black Friday falls on 27 November 2026 and Cyber Monday on 30 November, so reputation problems found in late November leave little time to recover.

## At a glance

- Gmail treats a sender as a bulk sender after it sends 5,000 or more messages to personal Gmail accounts in a day, and once a sender meets that criterion it is classed as bulk permanently. A first big Black Friday send can put a small store into that category.
- Bulk senders to Gmail and Yahoo need SPF and DKIM, a DMARC record of at least `p=none`, From-domain alignment, and one-click unsubscribe on marketing and subscribed messages. Yahoo asks that unsubscribes be honoured within two days.
- Google asks senders to keep the user-reported spam rate in Postmaster Tools below 0.1% and never reach 0.3%. Above 0.3%, a bulk sender loses eligibility for mitigation until it stays under that level for seven consecutive days.
- Outlook.com requires SPF, DKIM and DMARC for domains sending more than 5,000 messages a day; non-compliant mail goes to Junk and may be rejected with `550 5.7.515`.
- Google's guidance warns that doubling your previous volume at once can lead to rate limiting or a reputation drop. Ramp up gradually instead.

## Why it matters now

Google's sender guidelines FAQ says: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic." Messages that fail the requirements "will experience disruptions", which the FAQ describes as temporary or permanent rejections or delivery to spam. Last year's peak fell in the first weeks of that ramp.

The same FAQ states that "senders who meet the above criteria at least once are permanently considered bulk senders." A store that normally sends 1,500 newsletters a week to Gmail users can cross 5,000 in a single Black Friday morning. From that point the stricter rules apply to it, including DMARC and one-click unsubscribe.

Microsoft moved earlier. Since 5 May 2025, Outlook.com has required domains sending more than 5,000 emails a day to its consumer mailboxes to pass SPF, DKIM and DMARC. The Outlook postmaster policy page says non-compliant messages from high-volume senders go to the Junk folder and, if problems persist, may be rejected with `550; 5.7.515 Access denied, sending domain [SendingDomain] does not meet the required authentication level.`

Yahoo's sender best practices set similar rules for bulk senders: SPF and DKIM, a DMARC policy of at least `p=none` that passes, one-click unsubscribe, unsubscribes honoured within two days, and a spam rate below 0.3%.

Peak season is when stores send the most mail to the least engaged parts of their lists, so it is when enforcement is most likely to hit.

## Step-by-step: prepare your store email this week

1. List every sending source. Write down each system that sends mail as your domain: store order emails, the email marketing tool, any SMTP relay, the help desk, review requests and invoicing. Note the From address, the Return-Path domain and the DKIM `d=` domain for each. A forgotten source is the usual cause of a DMARC failure.
2. Send one test message from each source to a Gmail address and open "Show original". You want `SPF: PASS`, `DKIM: PASS` and `DMARC: PASS`, with the DKIM or SPF domain matching the From domain. For a deeper look at how these checks break after DNS or hosting changes, see our guide to [SPF, DKIM and DMARC failures](https://pingvera.com/blog/email-authentication-spf-dkim-dmarc-broken.html).
3. Check DKIM key length. Gmail requires a DKIM key of 1024 bits or longer for mail to personal accounts and recommends 2048 bits where your provider supports it.
4. Publish or confirm DMARC. A record of `v=DMARC1; p=none; rua=mailto:...` meets the minimum for Gmail, Yahoo and Outlook. Changing the policy to `quarantine` or `reject` five weeks before peak is a separate decision; make it only after aggregate reports show every legitimate source passing.
5. Confirm one-click unsubscribe on marketing mail. Marketing messages need both `List-Unsubscribe` with an HTTPS URI and `List-Unsubscribe-Post: List-Unsubscribe=One-Click`, plus a visible unsubscribe link in the body. RFC 8058 also requires both headers to be covered by a valid DKIM signature. Most email marketing platforms add these headers; verify them in a received message rather than in the platform's settings page.
6. Separate transactional from promotional mail. Order confirmations should not share a reputation with a 40% off campaign sent to people who last opened in 2024. Common options are a different sending subdomain, a different provider or IP pool for transactional mail, or both. Our article on [transactional message deliverability](https://pingvera.com/blog/transactional-message-deliverability.html) covers how to map each event to a channel.
7. Register each sending domain in Google Postmaster Tools and check the Compliance status, Spam rate and Delivery errors dashboards. The Compliance status dashboard reports on primary domains, not subdomains, and the spam rate covers only DKIM-authenticated mail.
8. Clean the list. Suppress hard bounces, addresses that have never opened or clicked over a long period you define, and anyone who unsubscribed or complained. Large sends to stale addresses are where complaint and bounce rates jump.
9. Plan the ramp (see the schedule below) and put it in the campaign calendar with named owners.
10. Decide the stop rule. Agree in advance who pauses a campaign, and at what spam rate, bounce rate or error code, before Black Friday week starts.

## Ramp schedule (illustrative)

Google's guidance is to start with "a low sending volume to engaged users", increase over time, send at a consistent rate rather than in bursts, and reduce volume if bounces or deferrals appear. The schedule below applies that to a store whose usual weekly send is 20,000 messages and whose Black Friday plan is 80,000 per day. All numbers are illustrative; size your steps from your own history.

If a step shows rising complaints or deferrals, hold at that level for a few days before the next step.

## Risk table: who checks what

## Copyable artefact: pre-send checklist for Black Friday campaigns

Paste this into the campaign ticket and tick each line before the send button.

BLACK FRIDAY SEND CHECK (campaign: ________ send time: ________)

Authentication
[ ] Test copy received at Gmail: SPF=PASS DKIM=PASS DMARC=PASS
[ ] DKIM d= domain or SPF domain aligns with From domain
[ ] Test copy received at Outlook.com lands in Inbox, not Junk

Unsubscribe
[ ] List-Unsubscribe header has an HTTPS URI
[ ] List-Unsubscribe-Post: List-Unsubscribe=One-Click present
[ ] Both headers signed by DKIM (listed in h= tag)
[ ] Visible unsubscribe link in body works

Audience and volume
[ ] Segment matches this week's ramp step
[ ] Hard bounces, complainers and unsubscribes suppressed
[ ] Send spread over time, not one burst

Monitoring
[ ] Yesterday's Postmaster spam rate: ____ % (stop if >= 0.3)
[ ] Named person watching bounces for 2 hours after send: ________
[ ] Stop rule: pause on spam rate >= ____ % or repeated 4xx/5xx codes

Transactional stream
[ ] Test order placed today; confirmation arrived in Inbox at Gmail and Outlook.com

A matching DNS record for the minimum DMARC policy looks like this (replace the reporting address with one you read):

_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

Worked scenario (illustrative)
A homeware store on WooCommerce sends about 3,000 newsletter emails a week, roughly half to Gmail addresses. Order emails go out through the same SMTP relay and the same domain as the newsletter. For Black Friday the marketing lead plans one send to the full list of 60,000 contacts, including 25,000 who have not opened anything in over a year.

That single send would make the store a bulk sender at Gmail for good, and the dormant contacts would generate complaints on the domain that carries order confirmations. Instead, the agency first confirms DMARC passes for both the relay and the email platform. It moves order emails to a subdomain with its own DKIM key, and the marketing team ramps from the 30-day engaged segment in late October to buyers from the last year by mid-November. The dormant contacts get one low-volume re-permission email in early November, and only those who click stay on the peak list. On the day, one person watches Postmaster Tools and the bounce log, with a written rule to pause at 0.3%.

## Common mistakes

- Testing authentication only from the marketing platform. The order emails from the store and the help desk replies also carry your domain and fail DMARC just as easily.
- Reading "0.0%" in Postmaster Tools as a clean bill of health. Google notes that dashboards may omit data on low-volume days, and that the spam rate counts only reports on mail delivered to the inbox, so a low figure can also mean less mail reached the inbox.
- Tightening DMARC to `reject` in November without reading aggregate reports first. A source you missed will stop delivering at the worst moment.
- Retrying hard after `4.7.28` rate-limit errors. Google's advice is to pause for at least 10 minutes, find the cause, then resume on one connection and add connections one at a time.
- Assuming the transactional exemption covers everything. One-click unsubscribe is required only for marketing and promotional messages, but transactional mail still needs authentication, and its inbox placement suffers if it shares a reputation with complaints.

Some limitations apply. The figures above are the published thresholds; mailbox providers also use engagement and other signals they do not publish, so meeting every requirement does not guarantee inbox placement. Postmaster Tools covers Gmail only. If your store uses a hosted platform's built-in email, some settings, such as DKIM keys or headers, may be fixed by the platform, and you will need its documentation or support.

## FAQ

### Do order confirmation emails need an unsubscribe link?

No. Google states that one-click unsubscribe is required only for marketing and promotional messages, and gives password resets and reservation confirmations as examples of exempt transactional mail. Order emails still need to pass SPF, DKIM and DMARC.

### What spam rate is too high for Black Friday?

Google asks senders to stay below 0.1% and never reach 0.3% in Postmaster Tools. Yahoo's limit is also 0.3%. If you pass 0.3% at Gmail, you need seven consecutive days below it before you are eligible for mitigation again, which can cover most of the peak period.

### Is it too late to warm up my list for Black Friday?

As of 19 October 2026 there are about five weeks left, enough for a stepped ramp like the one above if you start this week. If you start later, use smaller steps, send peak campaigns only to recently engaged contacts, and leave dormant segments out of the peak entirely.

## Sources

- [Email sender guidelines (Google)](https://support.google.com/a/answer/81126)
- [Email sender guidelines FAQ (Google)](https://support.google.com/a/answer/14229414)
- [Postmaster Tools dashboards (Google)](https://support.google.com/mail/answer/14668346?hl=en)
- [Sender best practices (Yahoo Sender Hub)](https://senders.yahooinc.com/best-practices/)
- [Outlook.com postmaster policies, practices and guidelines (Microsoft)](https://substrate.office.com/ip-domain-management-snds/Postmaster/Policies)
- [Fix NDR error "550 5.7.515" in Outlook.com (Microsoft Support)](https://support.microsoft.com/en-gb/outlook/fix-ndr-error-550-5-7-515-in-outlook-com)
- [Strengthening the email ecosystem: Outlook's new requirements for high-volume senders (Microsoft Tech Community)](https://techcommunity.microsoft.com/blog/outlook/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730)
- [RFC 8058: Signaling one-click functionality for list email headers](https://www.rfc-editor.org/rfc/rfc8058)

Last reviewed: 19 October 2026

For the wider peak plan beyond email, see our [ecommerce peak sales readiness checklist](https://pingvera.com/blog/ecommerce-peak-sales-readiness.html). On busy days teams tend to skip the last line of the send check, confirming that real customer-facing mail arrives. Pingvera can run part of it for you: its end-to-end form check submits a test lead through your site's contact form and confirms the email lands in the inbox, and its WooCommerce connector alerts when the site is up but orders have stopped arriving.