What Mailbox Providers Actually Measure

Exactly one engagement signal has a documented, numeric, sender-visible threshold: the spam-complaint rate. Google and Yahoo both publish it and both put the line in the same place — keep it below 0.3%. Reply rates, thread depth, link counts, image ratios and send-timing tricks are not documented as reputation inputs by any provider.

Key takeaways

• Complaint rate is the only published number. Gmail and Yahoo both say keep spam rate below 0.3%; Gmail adds a working target of below 0.10%.
• Authentication and DNS are pass/fail, not scored. SPF or DKIM, TLS, and valid forward and reverse DNS are required of every sender at any volume.
• Volume change is documented as a risk. Google warns that suddenly doubling previous volumes can cause rate limiting or reputation drops.
• Most “warmup science” is folklore. No provider publishes a reply-rate metric, a safe link count, an HTML-to-image ratio, or a timing-jitter signal.
• Your visibility is partial. Gmail’s Postmaster Tools only reports on mail sent to personal Gmail addresses, so most B2B sending never appears there.

What do providers actually publish a number for?

Two things: complaint rate and volume tiers.

Google’s sender guidelines tell every sender to “keep spam rates reported in Postmaster Tools below 0.3%” and to aim “below 0.10%” so a single bad campaign does not push you over (Google). Yahoo’s sender best practices use the identical number: “Keep your spam rate below 0.3%” (Yahoo).

The volume tiers are equally concrete. Google defines a bulk sender as one who sends “more than 5,000 messages per day to Gmail accounts” — meaning personal @gmail.com and @googlemail.com addresses. Microsoft applies its consumer requirements at “5,000 or more messages” a day to Outlook.com, Hotmail, Live.com and MSN from the same From domain (Microsoft). Yahoo, notably, publishes no number at all: “We will not specify a volume threshold” (Yahoo). Every blog that says “Yahoo’s limit is 5,000 a day” copied that figure from Google.

What is checked as pass or fail?

Authentication and message hygiene are not graded on a curve. Google requires of all senders, at any volume: SPF or DKIM on the sending domain, a TLS connection, valid forward and reverse DNS records for the sending address, and messages formatted to RFC 5322. Above 5,000 a day it becomes SPF and DKIM and a DMARC policy — p=none is accepted — with the From domain aligned to either the SPF domain or the DKIM domain (Google).

Microsoft’s consumer rejection for failing this is explicit and permanent: 550 5.7.515 Access denied, sending domain does not meet the required authentication level (Microsoft). Yahoo asks bulk senders to “Implement both SPF & DKIM” and “Publish a valid DMARC policy with at least p=none” (Yahoo).

These are the cheapest wins in deliverability because they are binary. You either pass or you are rejected with a clear message.

What is documented but not numeric?

A middle tier exists: behaviours providers describe in words without attaching a threshold.

• Volume change. Google’s guidance is to “start with a low sending volume to engaged users, and slowly increase the volume over time,” that “the more email that you send, the more slowly you should increase sending volume,” and that daily sending allows a faster ramp than weekly sending. It warns that immediately doubling previous volumes can cause rate limiting or reputation drops (Google).
• Engagement. Google advises unsubscribing recipients who never open your mail and not sending to people who did not sign up. Engagement is clearly an input; the mechanism and any weighting are unpublished.
• Content presentation. Google says links “should be visible and easy to understand,” warns against hiding content with HTML and CSS, and tells senders not to put subject lines, recipient names or emoji into the From display name (Google).
• Stream separation. Yahoo tells senders not to send bulk and transactional mail from the same addresses (Yahoo).
• List hygiene. Yahoo asks senders to “Monitor hard and soft bounces as well as inactive recipients” and “Remove invalid recipients from your list promptly” (Yahoo).

You can act on all of this. You cannot tune it to a number, and anyone selling you a number for it made it up.

What is pure folklore?

The following are repeated constantly in deliverability content and are documented by no mailbox provider anywhere:

None of these are necessarily harmful practices. The problem is treating them as measured inputs, and optimising against them while a high bounce rate or broken DMARC alignment goes unfixed.

Why can’t I see most of my own reputation?

Because the reporting only covers part of your traffic. Gmail’s Postmaster Tools states that its data “only applies to messages sent to personal Gmail accounts” and that data may be missing when “the total number of messages for a given day is too low,” to protect user privacy (Google).

For most B2B outreach the recipient is on a company domain, not a personal Gmail address, so that mail is invisible in Postmaster Tools. An empty dashboard is not a clean bill of health; it usually means too little consumer-mailbox volume to measure.

How WarmySender handles this

WarmySender is built against the documented list, not the folklore one. The scheduler paces every send inside per-mailbox and per-domain caps and a gradual ramp, which is the behaviour Google actually asks for. Warmup starts a brand-new mailbox at a handful of messages in its first hour and increases from there, and ramp progress is preserved across pauses rather than restarting from zero.

Where placement data shows a mailbox landing in spam at a high rate, the scheduler clamps its daily volume down rather than pushing harder — always a ceiling, never a floor. Every warmup subject also carries a short reference tag, so you can filter warmup mail out of your own inbox with an ordinary mail rule.

The same rules apply when an AI agent is driving. Claude, ChatGPT, Cursor, Codex, OpenClaw and Hermes Agent can build, launch, pause and manage campaigns in plain language, but the agent never sends a message itself and can never raise a limit — the scheduler paces every action identically regardless of who triggered it. See how warmup protects deliverability, the deliverability reference and the agent safety and rate limits notes.

Frequently asked questions

Does reply rate affect deliverability?

No provider documents reply rate as a reputation metric or publishes a threshold for it. Replies are a good business signal and correlate with mail people actually want, but there is no evidence any filter measures your reply percentage. Optimise for relevance and low complaints, which are documented.

Does moving an email out of spam help my sender reputation?

There is no published provider documentation that a single recipient rescuing a message from spam changes your global sender reputation. It plausibly affects that one recipient’s future filtering. Treating it as a reputation lever — the core promise of many warmup schemes — is not supported by any provider source.

How many links can I safely put in a cold email?

There is no published safe number. Google’s only documented content rule about links is that they “should be visible and easy to understand,” alongside a warning not to hide content with HTML or CSS (Google). One clear, plainly-worded link is a reasonable habit, not a rule.

Is the Promotions tab a deliverability problem?

Promotions is a categorisation of delivered mail, not a spam action, and no provider describes it as a reputation penalty. If your open rate falls after a move to Promotions, that is a visibility effect, not a filtering one. Spam-folder placement and outright rejection are the failures worth chasing.

What should I monitor instead?

Complaint rate against the published 0.3% line, bounce rate, authentication status, and whether volume is increasing gradually. Those four are documented, checkable, and account for nearly every real deliverability failure.