Research · Statistics
Email deliverability statistics for 2026
45 statistics on bounce rates, list decay, SPF and DMARC adoption, Gmail, Yahoo and Microsoft sender rules, spam complaints and fake signups. Every figure links to the provider document, standard or study it comes from, with the year it was published. Nothing is estimated, rounded or taken from unsourced roundups.
Last updated 25 sources
Bounce rates and list decay
A hard bounce means the address does not exist or no longer accepts mail. Sending platforms watch the rate closely, and lists lose valid addresses every year.
-
Under 2%
hard bounce rate Amazon SES recommends
Only hard bounces count toward the SES bounce rate; temporary failures such as a full mailbox do not.
-
5%
bounce rate that puts an SES account under review
At 10% or more, Amazon SES may pause the account until the cause is fixed.
-
Under 5%
of attempted messages should hard bounce, per Twilio SendGrid
SendGrid also notes that no single percentage guarantees deliverability problems; the limit is guidance, not a hard rule.
-
2.33%
average email bounce rate in GetResponse benchmarks
The figure covers all regions; the same report shows 2.78% and 2.79% in its country and industry tables.
Sample: more than 4.4 billion messages sent by GetResponse customers in 2023
-
23%
of addresses checked in 2025 were invalid
ZeroBounce uses this share as its estimate of how much of a typical list decays in a year.
Sample: all addresses ZeroBounce verified from January to December 2025, over 11 billion
-
62%
of addresses submitted for verification were valid
The rest were invalid, catch-all, unknown or otherwise risky, which is why unverified lists bounce.
Sample: all addresses ZeroBounce verified from January to December 2025, over 11 billion
-
Over 9%
of checked addresses were on catch-all domains
A catch-all server accepts mail for any address, so a mailbox check alone cannot confirm the person exists.
Sample: all addresses ZeroBounce verified from January to December 2025, over 11 billion
-
28%
minimum yearly database decay in the previous report
ZeroBounce reported that email databases degraded by at least 28% a year, based on the data it processed in 2024.
Sample: addresses ZeroBounce processed during 2024
Email authentication adoption
SPF, DKIM and DMARC let receivers confirm that mail really comes from the domain it claims. Large senders have mostly adopted them; enforcement is less complete.
-
98.6%
of major company domains publish DMARC
211 of 214 well-known company domains had a DMARC record at _dmarc.<domain>.
Sample: DNS lookups of 214 well-known company domains on October 2, 2026
-
77.7%
of those DMARC domains use p=reject
164 of the 211 domains with DMARC ask receivers to reject mail that fails authentication, the strictest policy.
Sample: DNS lookups of 214 well-known company domains on October 2, 2026
-
7.6%
of DMARC domains are still at p=none
16 of 211 domains publish DMARC in monitor-only mode, which asks receivers to take no action on failing mail.
Sample: DNS lookups of 214 well-known company domains on October 2, 2026
-
92.5%
of major company domains publish SPF
198 of 214 domains publish an SPF record; 14 of the rest publish DMARC without SPF and rely on DKIM alone.
Sample: DNS lookups of 214 well-known company domains on October 2, 2026
-
49.5%
of SPF records end in ~all (soft fail)
98 of 198 SPF records use soft fail, compared with 89 (44.9%) that use the stricter -all.
Sample: DNS lookups of 214 well-known company domains on October 2, 2026
-
14.9%
of 73.3 million domains have a DMARC policy
Only 2.5% enforce p=reject, and 83.9% have no visible DMARC record, a far lower rate than among large companies.
Sample: sample of 73.3 million widely used domains, December 2025
-
8.9%
of the top 1.8 million domains use p=reject with reporting
That is 159,691 domains combining the strictest policy with aggregate (RUA) reports, while 525,996 domains remained at p=none.
Sample: DNS records of the top 1.8 million domains by traffic, early 2026
-
95%
of Fortune 500 companies have a valid DMARC record
475 of the Fortune 500 had valid DMARC in early 2026, and more than 80% had moved to an enforcement policy.
Sample: DNS records of Fortune 500 company domains, early 2026
-
75%
drop in unauthenticated mail reaching Gmail users
Google reported the fall after it began requiring some form of authentication for mail sent to Gmail addresses.
-
RFC 9989
DMARC is now an IETF Standards Track specification
Published in 2026, RFC 9989 obsoletes RFC 7489, the 2015 informational DMARC document most guides still cite.
-
2017
US federal agencies were ordered to adopt DMARC p=reject
CISA Binding Operational Directive 18-01, issued October 16, 2017, gave agencies one year to set a reject policy on all second-level domains.
Gmail, Yahoo and Microsoft sender requirements
Since 2024 the largest mailbox providers have published hard requirements for anyone sending in volume: authentication, one-click unsubscribe and a spam rate ceiling.
-
5,000
messages a day to Gmail makes you a bulk sender
Google counts messages sent to personal Gmail accounts within 24 hours, and all mail from the same primary domain counts toward the limit.
-
Feb 1, 2024
Gmail bulk sender requirements took effect
From this date, senders of more than 5,000 messages a day to Gmail accounts had to meet the stricter authentication and unsubscribe rules.
-
June 1, 2024
deadline for one-click unsubscribe in Gmail
Senders that already had an unsubscribe link had until this date to add one-click unsubscribe to all commercial and promotional mail.
-
48 hours
for Gmail senders to honor unsubscribe requests
Google lists unsubscribes not honored within 48 hours as a reason delivery support and mitigations become unavailable.
-
Nov 2025
Gmail began rejecting non-compliant mail
Google said messages that fail the sender requirements would see disruptions, including temporary and permanent rejections.
-
2 days
for Yahoo bulk senders to honor unsubscribes
Yahoo also requires bulk senders to support one-click unsubscribe, sign with SPF and DKIM and publish DMARC at p=none or stricter.
-
5,000
emails a day triggers Outlook.com requirements
Domains above this volume to Outlook.com, Hotmail.com and Live.com must pass SPF and DKIM and publish DMARC at p=none or stricter.
-
May 5, 2025
Outlook.com started rejecting non-compliant bulk mail
Rejected messages get the error 550 5.7.515, which says the sending domain does not meet the required authentication level.
-
RFC 8058
defines the one-click unsubscribe header
Published in January 2017, it specifies the List-Unsubscribe-Post header that Gmail and Yahoo now require from bulk senders.
Spam complaints and inbox placement
Complaint rates decide whether mail reaches the inbox. The ceilings are low: a few complaints per thousand messages is enough to cause trouble.
-
0.10%
spam rate Google asks senders to stay below
The rate is the user-reported spam rate shown in Google Postmaster Tools. Google treats 0.30% as the line never to reach.
-
0.30%
spam rate Gmail senders should never reach
Since June 2024, bulk senders above 0.3% lose eligibility for mitigation until they stay below it for 7 consecutive days.
-
0.3%
maximum spam rate for all Yahoo senders
Yahoo applies the same ceiling to every sender, not only bulk senders.
-
0.1%
complaint rate that puts an SES account under review
Amazon SES may pause sending at a complaint rate of 0.5% or more.
-
87.2%
average global inbox placement rate in 2025
The rest went to spam or never arrived. Validity called the result a 3.7 percent uplift year over year, partly from fewer missing messages.
Sample: seed addresses at hundreds of mailbox providers, 2025 campaigns from opted-in Validity customers
-
77.4%
inbox placement at Microsoft mailboxes in 2025
Validity named Microsoft the toughest major mailbox provider to send to in its 2025 data.
Sample: seed addresses at hundreds of mailbox providers, 2025 campaigns from opted-in Validity customers
B2B contact data decay
Work addresses stop working when people change jobs and when companies close. Official labor statistics show how fast that happens.
-
4.1 years
median time US workers have been with their employer
Measured in January 2026, up from 3.9 years in January 2024; a work address usually lasts no longer than the job.
Sample: Current Population Survey January supplement
-
3.0 years
median tenure for workers aged 25 to 34
Workers aged 55 to 64 had a median of 9.6 years, so lists aimed at younger professionals decay faster.
Sample: Current Population Survey, January 2026
-
62.8 million
US job separations in 2025
Every separation can leave a dead work address behind; the total was 251,000 lower than in 2024.
Sample: JOLTS establishment survey, sum of monthly estimates
-
3.3%
of US employment separated in an average month of 2025
The monthly rate was unchanged from 2024: 2.0% quits and 1.1% layoffs and discharges.
Sample: JOLTS annual average of monthly rates
-
284,000
US business establishments closed in Q1 2025
Those closures cost 809,000 jobs; when a company shuts down, the addresses on its domain usually stop accepting mail.
Sample: private-sector establishments, Quarterly Census of Employment and Wages
Disposable and fake signups
Throwaway addresses, typos and bots fill signup forms with addresses that never engage or never existed, and they end up on mailing lists.
-
9,895
disposable email domains on the main open-source blocklist
The disposable-email-domains list on GitHub, which PyPI uses to block registrations, held 9,895 domains as of October 2026.
Sample: line count of the published blocklist file on October 18, 2026
-
2.3 million
emails collected from 7 disposable email services
Researchers found the services are mainly used to register online accounts without exposing a real address, and that those accounts can be hijacked.
Sample: 56,589 temporary inboxes monitored for three months, 210,373 sending services
-
8.4%
of email data entered on web forms was invalid
TowerData (now AtData) measured this across its real-time validation service; invalid covers typos, bad syntax and fake addresses.
Sample: millions of web form records validated in 2018
-
53%
of web traffic in 2025 was automated
Bots overtook humans, who accounted for 47% of observed traffic; automated signups are one of the ways fake addresses reach mailing lists.
Sample: Thales and Imperva network traffic across full year 2025
-
40%
of web traffic in 2025 came from bad bots
That was up from 37% the year before, according to Thales, which runs Imperva bot protection.
Sample: Thales and Imperva network traffic across full year 2025
How we chose these statistics
Every figure on this page was checked against its original source on or before October 18, 2026. We only kept a statistic when we could open the document it comes from and find the number there.
- Primary sources first. Mailbox provider documentation, IETF RFCs, government statistics, and original studies with a stated method. Where a vendor ran the study itself, we link to the vendor's own report.
- No secondhand numbers. Many widely shared figures appear only in roundup posts that cite each other. If we could not trace a number back to the study that produced it, we left it out.
- Exact figures. Numbers appear as the source states them, with the year it was published and a short note on the sample where one applies. We do not round, combine or extrapolate.
- Our own data. The authentication figures for major companies come from our SPF and DMARC adoption study, which publishes its raw data as a CSV.
Benchmarks from different studies use different samples, so compare figures within a source rather than across sources. If you spot an outdated number or a broken link, tell us and we will correct it.
FAQ
Deliverability statistics FAQ
How to read and reuse the numbers on this page.
What is a good email bounce rate?
Aim for a hard bounce rate below 2%. That is the level Amazon SES recommends, and SES places an account under review at 5% and may pause sending at 10%. Other sending platforms set their own limits, often lower. Verifying a list shortly before you send keeps hard bounces far below these levels.
What spam complaint rate do Gmail and Yahoo allow?
Google asks all senders to keep the spam rate reported in Postmaster Tools below 0.1% and never let it reach 0.3%. Yahoo uses the same 0.3% ceiling. Bulk senders who stay above 0.3% lose eligibility for mitigation and can see mail rejected or sent to spam.
Who counts as a bulk sender?
Google and Microsoft both use 5,000 messages a day. Google counts mail sent to personal Gmail accounts from the same primary domain, and once you cross the line you stay classified as a bulk sender. Microsoft applies its rules to domains sending more than 5,000 messages a day to Outlook.com, Hotmail.com and Live.com addresses.
How fast does an email list go bad?
Expect a meaningful share of addresses to stop working every year, mostly because people change jobs and abandon accounts. The median US worker has been with their current employer for under four years, so a B2B list that is never re-verified loses a steady stream of contacts. Verify lists that have not been mailed for a few months before sending to them again.
Can I use these statistics in my own article?
Yes. Use the Cite button on any card to copy a citation that links to the exact statistic on this page and names the original source. Where you can, link to the original source as well.
How often is this page updated?
We review it when mailbox providers change their rules and when the underlying studies publish new editions. The date at the top shows the last review. Figures from older studies stay on the page with their year until a newer edition replaces them.
Keep your own numbers out of the danger zone
Verify addresses before you send, so bounces and spam traps never push you past a mailbox provider's limits.
100 free credits · No card required · Credits never expire