Email deliverability updates news for Q4 2026 comes down to five changes. DMARCbis replaced the original DMARC standard, Microsoft cut external sending limits for new tenants, Validity launched the Heatwave blocklist, Google is moving everyone to Postmaster Tools v2, and Gmail ends Send As for third-party accounts in January 2027.
Key Takeaways
- Your existing v=DMARC1 record still works. Add np=reject and stop relying on pct.
- Microsoft’s new limits hit tenants in their first 60 days, plus trial tenants.
- Heatwave is a public blocklist for synthetic warmup, and you can look up any domain.
- Postmaster Tools v2 drops the old reputation charts, and API users must migrate.
- Gmail’s Send As for outside addresses ends in January 2027.
There was a time when you set up SPF, DKIM and DMARC once and mostly forgot about them. Limits stayed put, warmup ran in the background, and the dashboards looked the same next quarter.
That stopped being true. A new DMARC standard, tighter Microsoft limits, a new blocklist and a rebuilt Postmaster Tools all landed within a few months of each other.
We plan to run this roundup every quarter, starting now.
Email Deliverability Updates News at a Glance
Four of the five changes are already live, and the fifth lands in January.
| Change | Date | Who it hits | Your move |
| DMARCbis (RFC 9989) | Published May 2026 | Anyone with a DMARC record | Add np=reject |
| Microsoft external limits | Rolling out from Sep 14 | New, trial and free-EDU tenants | Check tenant age |
| Heatwave blocklist | Launched Sep 3 | Domains with synthetic warmup | Look up your domain |
| Postmaster Tools v2 | Old version postponed, no date | Anyone on v1 or its API | Migrate API code |
| Gmail Send As | Ends January 2027 | Third-party Send As users | Send from the provider |
DMARCbis Is Official, and You Do Not Need to Panic
DMARCbis is the rewritten DMARC standard, published in May 2026 as RFC 9989, 9990 and 9991. It replaces RFC 7489, and your existing v=DMARC1 record keeps working, so nothing breaks today.
Three tags are gone: pct, rf and ri. Security Boulevard says pct was inconsistently implemented across receivers, which is why a new t flag replaces it. The np tag now sets a policy for subdomains that do not exist, psd marks public suffix domains, and t switches a record into test mode.
The bigger shift sits under the hood. Receivers used to find your organizational domain with the Public Suffix List, a shared file that different receivers could hold in different versions. Now they check for _dmarc records at each level of the DNS tree, capped at eight lookups, according to Postbox.
Postbox’s practical advice is short:
- Add np=reject so made-up subdomains cannot spoof you.
- Skip pct for gradual rollouts. Hold at quarantine, read aggregate reports for a week or two, then move to reject.
- Check discovery_method in your aggregate reports to see which receivers already use the tree walk.
Receiver support for t and np is still thin, so treat them as extra protection. Gmail and Yahoo’s email sender requirements still ask bulk senders for DMARC, and requiring a record is a separate matter from a receiver adopting DMARCbis.
Seeing a “DMARC policy not enabled” warning? Our fix guide covers it, and the free DMARC Record Generator builds a starter record in under a minute. For the basics, start with our SPF, DKIM and DMARC guide.
E-Warmup’s Deliverability Agent also flags missing or failed DMARC, SPF, MX and DKIM records on every plan, Free Forever included.
Microsoft’s New Sending Limits and Why Tenant Age Matters
Microsoft is cutting external recipient limits for new and trial Microsoft 365 tenants, and the cut depends on how old the tenant is. Message Center notice MC1454397 says the change began rolling out on September 14 and should finish by the end of November.
The standard daily quota is 500 × (purchased email licenses^0.7) + 9,500. Tenant age decides how much of that a tenant gets:
| Tenant age | Share of standard daily quota |
| Under 31 days | 10% |
| 31 to 60 days | 25% |
| Over 60 days | 100% |
Take a tenant with 100 licenses. It normally gets about 22,059 external recipients a day, so in its first month it gets roughly 2,200.
Trial tenants drop from 5,000 to 500 a day no matter how many licenses they hold, and tenants with free education licenses move to a new formula. Established paid tenants keep the current one.
Go over and external mail is blocked until your rolling 24-hour count drops. Senders see error 550 5.7.232 on trial tenants and 550 5.7.233 on the rest.
If you spin up fresh tenants to host sending mailboxes, plan campaign volume around that first-month ceiling. The Tenant Outbound External Recipients Rate report, under Reports, Mail flow in the Exchange admin center, shows your quota and usage.
Exchange Web Services Is Also on the Way Out
Microsoft started switching off Exchange Web Services on October 1. Per MC1227454, EWS is blocked by default for tenants without an app allow list and EWSEnabled set to True, and it goes away permanently on April 1, 2027.
If a tool in your stack reads or sends through your Microsoft mailboxes over EWS, ask the vendor which API it uses. Microsoft’s replacement is Microsoft Graph.
Synthetic Warmup Gets a Label
Validity launched its Heatwave blocklist on September 3, 2026, and it lists domains whose warmup looks synthetic. In its press release, Validity describes deceptive warming services that connect to a customer’s email tenant, register lookalike domains and generate messages, opens, clicks and replies among networks of fake accounts.
Validity says more than 1 million domains are listed. The signal is mirrored into its DNS reputation zones, and anyone can check a domain at the Heatwave lookup. The release carries quotes from Comcast and Spamhaus.
Two things remain open. Validity has not published a false-positive rate, and Postbox reports that delisting needs a manual review request, typically decided in two to five business days.
Check your sending domain first, then any lookalike domains a tool registered for you. Then ask your warmup vendor whose inboxes send and open your mail.
Postmaster Tools: What V2 Changes
Google postponed retiring the old Postmaster Tools interface and has not set a new date, but it already sends you to v2. Google’s help page says no action is required for the web interface, and that v1 “will eventually be retired.”
The API is a separate job. Developers must move integrations to the v2 API, which uses a different schema, and Google says migration documentation is coming. If a dashboard or script of yours pulls Gmail Postmaster Tools data, start there.
What leaves is the part you will notice. The Domain and IP Reputation dashboards, the High, Medium, Low and Bad grades many senders checked first, are being retired and replaced.
That makes spam rate and delivery errors the numbers to watch, and a placement test the way to see where mail lands. E-Warmup’s placement tests run across 40,000+ real inboxes. We walked through the new layout in our Postmaster Tools V2 guide.
Also From Google: Send As Ends in January
Gmail is ending Send As for third-party accounts in January 2027, on web and mobile. Google’s help page says Gmailify and POP fetching end at the same time. Gmail-to-Gmail aliases and Google Workspace addresses are not affected.
If you send from a custom-domain address through Gmail’s Send As, switch to the provider’s own site or app, or a desktop client over IMAP and SMTP, before the cutoff. Google also warns that extensions offering to replicate Send As often ask for your credentials.
Your Q4 Action List
These nine checks cover the quarter, and most take minutes.
- Confirm your DMARC record starts with v=DMARC1.
- Add np=reject to your DMARC record.
- Stop using pct for gradual rollouts.
- Look up your sending domains at lookup.validity.tools.
- Note the age of every Microsoft 365 sending tenant.
- List tools that connect over EWS. Move them to Graph.
- Point Postmaster API scripts at v2.
- Stop using Gmail Send As for outside addresses.
- Run a placement test after each change.
Email Deliverability Updates News: FAQs
What is DMARCbis?
DMARCbis is the updated DMARC standard, published in May 2026 as RFC 9989, 9990 and 9991. It replaces RFC 7489 and keeps the v=DMARC1 record format, so existing records still work. It drops the pct, rf and ri tags and adds np, psd and t.
Do I need to change my DMARC record because of DMARCbis?
No change is required today. Adding np=reject is a low-risk upgrade, and you should stop depending on pct because the new spec dropped it.
What are Microsoft’s new Exchange Online sending limits?
From September 14, tenants under 31 days old get 10% of the standard daily external recipient quota, and tenants aged 31 to 60 days get 25%. Trial tenants drop from 5,000 to 500 recipients a day. Established paid tenants keep the standard formula.
What is the Heatwave blocklist?
Heatwave is a Validity blocklist, launched September 3, 2026, that lists domains showing patterns of synthetic email warming. Validity says it holds more than 1 million domains, and anyone can check a domain at lookup.validity.tools.
Is Google Postmaster Tools v1 shut down?
Not according to Google. It postponed the retirement of the old web interface without a new date and redirects users to Postmaster Tools v2. The reputation dashboards are being retired, and API users must migrate to the v2 API.
Does email warmup still work after Heatwave?
Validity describes Heatwave as aimed at fake-account networks and lookalike domains, not warmup as a practice. It has not published a false-positive rate, so ask any vendor how its inboxes engage. E-Warmup warms through real inboxes and, on Growth and above, uses AI Read Emulation that opens and reads emails.
Keep Your Setup Current
Email deliverability updates news now arrives in clusters, and a setup that passed in June can fail a check in October. Pick one item from the action list today. If it is the DMARC change, run a placement test before and after so you can see what moved.
E-Warmup watches your authentication records, tests placement across 40,000+ real inboxes and keeps warmup running while you adjust. Setup takes under 30 seconds, and the Free Forever plan needs no credit card. Keep your setup current, free forever.
