Understanding Mailbox Provider Algorithms

Gmail, Outlook, Yahoo and Apple each decide for themselves whether your email reaches the inbox. None of them publishes its exact rules, but testing and the data they do share show how each one works. This article explains what each provider looks at, what it tells you, and how to adjust your sending for it.

Why the rules are secret

A mailbox provider is the company that runs your readers’ inboxes, such as Google for Gmail or Microsoft for Outlook.com. If providers published their filtering rules, spammers would simply work around them. So they keep the details private.

They all look at the same three groups of signals, though:

• You, the sender. Your sending history, your domain and IP address, and whether your email passes authentication (checks that prove the email really comes from you).
• The message. Its links, layout, attachments and wording.
• The reader. What each person does with your email: opens it, replies, deletes it unread, or reports it as spam.

The mix differs by provider, as the sections below show.

Gmail

Gmail is the largest consumer email service. Its filters lean more on how readers behave than any other provider’s do.

How Gmail decides

Gmail checks each message in roughly five steps:

1. Connection. Before it accepts anything, Gmail looks at the IP address (the number that identifies your sending server) connecting to it. It checks that IP’s history, public blocklists, whether the connection is encrypted with TLS, and how fast and how often you connect. New IPs get extra caution. IPs with a bad history may be turned away here.
2. Identity (authentication). Gmail checks SPF (a DNS record listing the servers allowed to send for your domain), DKIM (a digital signature on the message) and DMARC (a policy that ties both to the From address). It writes the results into the Authentication-Results header.
3. Content. Machine-learning models trained on huge numbers of emails look at the HTML, links, attachments, odd headers and similarity to known spam. Every link is checked against Google Safe Browsing, Google’s list of dangerous sites.
4. Reputation. Gmail keeps separate scores for your domain and your IP. It combines them with the results of steps 2 and 3 into a first placement decision.
5. Each reader’s history. Last, Gmail adjusts the decision for each person. If someone often opens your email, it goes to their inbox. If they always ignore or delete it, it drifts toward their spam folder.

So the same email can land in one person’s inbox and another person’s spam folder. That’s normal.

To see what Gmail decided about a message you received, paste its headers into the header analyzer.

Gmail’s tabs

Gmail sorts inbox mail into tabs. Primary is for personal email. Promotions gets most marketing. Updates gets receipts and alerts. Social and Forums get network notifications and group mail. Every tab is part of the inbox, not spam.

The tab still matters. People check Promotions less often than Primary, so email there gets fewer opens. Readers can also drag a message to another tab, and Gmail learns from that.

What Gmail tells you

Google Postmaster Tools is a free dashboard for senders. For your domain, it shows:

• Spam rate: the share of your email that readers reported as spam.
• Authentication: how much of your mail passed SPF, DKIM and DMARC.
• Encryption: how much arrived over TLS.
• Delivery errors: why Gmail rejected or delayed your mail.
• Compliance status: whether you meet Gmail’s rules for bulk senders.

Postmaster Tools has also rated your domain and IP as High, Medium, Low or Bad. Google has announced it will retire these ratings, so treat spam rate as your main number.

Google asks you to keep your spam rate below 0.1% and never let it reach 0.3%. Since 2024, anyone sending more than 5,000 messages a day to Gmail addresses must also have SPF, DKIM and DMARC (at least p=none) and a one-click unsubscribe.

Tips for Gmail

1. Put engagement first. Engagement means what readers do with your email: opening, clicking, replying.
2. Send to your most active readers first. Their opens and clicks help the rest of the send.
3. Check Postmaster Tools daily during campaigns.
4. Add one-click unsubscribe. With the List-Unsubscribe and List-Unsubscribe-Post headers, Gmail shows an unsubscribe button next to your name. People use it instead of the spam button.
5. Set up SPF, DKIM and DMARC. DMARC at p=none meets Gmail’s rule. Moving to p=quarantine or p=reject also stops others from faking your domain.

Microsoft (Outlook.com and Microsoft 365)

Microsoft runs Outlook.com, Hotmail.com, Live.com and MSN.com for consumers. It also runs Microsoft 365 for businesses.

How Microsoft decides

• IP reputation counts for more. Microsoft weighs your IP address’s history more heavily than Gmail does. A new dedicated IP (one only you use) often struggles at Microsoft, even when your domain has a good name.
• Content filters are stricter. HTML, links and layouts that pass at Gmail sometimes get filtered at Microsoft.
• Focused Inbox. Like Gmail’s tabs, Outlook splits the inbox into Focused and Other, learning from each reader. Marketing email usually lands in Other.
• Slow to change. Microsoft’s reputation scores update more slowly than Gmail’s. Damage shows up later, and recovery takes longer.

Since May 2025, Microsoft has also required bulk senders to Outlook.com to have SPF, DKIM and DMARC.

What Microsoft tells you

• SNDS (Smart Network Data Services) rates each of your IPs green, yellow or red. It also shows spam trap hits, how much of your mail was filtered, and complaint data.
• JMRP (Junk Mail Reporting Program) is a feedback loop: it sends you a report each time an Outlook.com user marks your email as junk, so you can stop emailing them.

Tips for Microsoft

1. Warm up new IPs slowly. Raise volume step by step so Microsoft can get to know you.
2. Sign up for SNDS and JMRP now. They’re your only view into how Microsoft sees you.
3. Check SNDS daily. Look into any yellow or red IP straight away.
4. Remove every JMRP complainer as soon as the report arrives.
5. Keep your HTML simple and your volume steady.

Yahoo and AOL

Yahoo and AOL belong to the same company and share the same filters.

How Yahoo decides

• Volume. Yahoo reacts quickly when a sender it doesn’t know suddenly sends more. It slows you down before it rejects anything.
• Complaints. Yahoo relies heavily on spam reports when it scores your reputation.
• Authentication. In 2014, Yahoo became the first big provider to publish a strict DMARC policy (p=reject) for its own yahoo.com addresses. That broke many mailing lists overnight. Since 2024, Yahoo has applied the same bulk-sender rules as Gmail.

Yahoo warns you through its replies to your sending server. A 421 code means “try again later” (a deferral). A 5xx code, such as 554, is a permanent rejection. As your reputation slips, the replies usually get worse in this order:

You’ll find these codes in your SMTP logs (your sending server’s record of each delivery attempt). The SMTP probe shows you a live conversation with a receiving server.

What Yahoo tells you

• Complaint Feedback Loop (CFL) reports each spam complaint back to you. It’s one of the most useful feedback loops any provider offers. It only covers mail signed with DKIM.
• Yahoo’s postmaster site lists its sender rules and has a contact form for delivery problems.

Tips for Yahoo

1. Join the CFL and stop emailing everyone who complains.
2. Grow volume slowly. Yahoo throttles sudden spikes hard.
3. Watch your logs for 421s. They’re Yahoo’s early warning.
4. Add one-click unsubscribe. Yahoo shows its own unsubscribe button when the headers are there.

Apple (iCloud Mail)

Apple runs iCloud Mail, with addresses at icloud.com, me.com and mac.com. Most people read it in the Mail app on iPhone, iPad and Mac.

• Mail Privacy Protection (MPP). Since iOS 15 in 2021, the Apple Mail app can download images and tracking pixels ahead of time, through Apple’s servers. A tracking pixel is a tiny invisible image senders use to detect opens. Most Apple Mail users turn MPP on. It applies to every account read in Apple Mail, including Gmail accounts, not just iCloud addresses. So your email looks “opened” even when nobody read it.
• Gentler filtering. Apple’s spam filtering has been less aggressive than Gmail’s or Microsoft’s, though it is getting stricter.
• Almost no sender tools. Apple has nothing like Postmaster Tools or SNDS.
• Hide My Email. iCloud+ users can create random addresses that forward to their real inbox. They can switch one off at any time. After that, your email to it bounces (comes back as undeliverable).

Tips for Apple

1. Don’t trust opens from Apple Mail. Use clicks to measure interest instead.
2. Report Apple Mail readers separately so they don’t skew your numbers.
3. Watch for bounces from iCloud addresses, especially Hide My Email ones.
4. Set up SPF, DKIM and DMARC anyway. Apple checks them, even though it doesn’t share the results with you.

What all providers have in common

• Reader behaviour counts everywhere, though the weight differs.
• Authentication is the minimum. Failing SPF, DKIM or DMARC hurts you at every provider.
• Spam complaints always hurt.
• Sudden volume spikes look suspicious everywhere.
• List quality matters everywhere. Bounces, spam traps and inactive addresses drag you down.

So track each provider separately. Totals hide problems: you could be fully blocked at Microsoft while your overall numbers dip only a little. Split delivery, bounces, complaints and engagement by provider. When one provider moves away from the rest, look into it straight away. The cause is usually specific to that provider, such as throttling or a content filter.

What to do next

• Send a test email to the Mailwel test inbox to check your SPF, DKIM and DMARC.
• Sign up for Google Postmaster Tools, Microsoft SNDS and JMRP, and the Yahoo CFL.
• Split your sending reports by provider.
• Read How senders earn long-term inboxing to start building reputation with all of them.