Why sending marketing email from Outlook or Gmail doesn't work — and what to do instead

Key takeaways

• Email clients have daily sending caps, CC and BCC recipients count toward them, and exceeding a cap produces no clear error.
• The Google, Yahoo and Microsoft bulk sender rules apply at 5,000 or more messages a day to that provider’s users.
• Google requires bulk senders to keep their spam rate below 0.30%, with the stated guidance to stay below 0.10%.
• A new domain cannot skip reputation: set up SPF, DKIM and DMARC first, then warm up week by week starting with your most engaged subscribers.
• Once the same content goes to more than roughly 50 external recipients who never explicitly subscribed, stop using Outlook or Gmail.

It usually goes like this. Someone in marketing exports 800 customers from the CRM, pastes the addresses into the BCC field in Outlook, writes the message, and hits send.

The first 200 go out fine. Then it slows down. The next day a colleague mentions that a customer asked about a strange email — and that they could see other people’s addresses on it. A week later, mail from the company domain starts landing in Gmail’s spam folder in bulk. Including quotes and contracts.

That is not bad luck. That is a chain of entirely predictable mechanisms. Here they are, one at a time.

Wall one: sending caps, and they fail silently

Email clients are built for one-to-one correspondence, and providers enforce that with hard quotas.

Platform	Daily sending cap	Notes
Gmail (free account)	~500/day	Exceeding it temporarily locks the account from sending
Google Workspace	~2,000/day	Built-in mail merge has its own, lower cap (~1,500)
Outlook / Microsoft 365	~300/day	In practice BCC lists start behaving unpredictably past 30–50 addresses

Two things to know:

1. CC and BCC recipients count toward the quota. A message with 500 people in BCC is not one email, it is 500.
2. You do not get a clear error when you exceed it. Outlook locks sending on a rolling 24-hour basis, with no admin override to speed up the reset. What you see is “some people got it, some didn’t”, followed by a day of guessing why.

Wall two: the bulk sender rules at the inbox providers

This wall only went up properly after 2024, and plenty of Hong Kong businesses still do not know it exists.

Google and Yahoo began enforcing new bulk sender requirements in February 2024; Microsoft followed on 5 May 2025. The threshold in each case is 5,000 or more messages a day to that provider’s users.

Google states its bulk sender requirements plainly:

• Set up SPF and DKIM for your sending domain
• Set up DMARC for your sending domain; the enforcement policy may be p=none
• Alignment: the domain in the From: header must align with either the SPF domain or the DKIM domain
• Transmit mail over a TLS connection
• Sending domains or IPs must have valid forward and reverse DNS (PTR) records
• Marketing and subscribed messages must support one-click unsubscribe, carrying both List-Unsubscribe-Post: List-Unsubscribe=One-Click and List-Unsubscribe headers (RFC 2369, RFC 8058)
• Keep the spam rate in Postmaster Tools below 0.30%, with the stated guidance to stay below 0.10% and never reach 0.30%

Microsoft’s version is broadly the same, with one clause worth remembering: once your domain has ever crossed the 5,000/day threshold, the authentication requirements apply permanently, even if your volume later drops below it.

Sending manually from Outlook or Gmail, you cannot satisfy a single one of those. There is no way to inject a List-Unsubscribe header from a mail client, and no way to align the From: domain with authentication you control separately.

Wall three: the complaint rate only moves one way

0.30% sounds generous until you convert it: send 1,000 emails and three “report spam” clicks put you at the threshold.

Manual bulk sending almost guarantees a high complaint rate, because:

• There is no one-click unsubscribe. For anyone who wants out, the only available button is “report spam”.
• The list has usually never been cleaned — it holds addresses from years ago, departed staff, and typos.
• Recipients can see each other (BCC breaks the moment one person hits reply-all), and that alone generates complaints.

Worse, complaint damage accumulates and recovers slowly. One runaway send lowers your domain’s standing for weeks afterwards, and ordinary business mail suffers with it. That is why, in the story at the top, even the quotes ended up in spam.

Wall four: you are flying blind

After a manual send, all you know is that you pressed send. You do not know:

• Which addresses hard-bounced (the mailbox does not exist) versus soft-bounced (full mailbox, temporary error)
• How many never reached an inbox at all
• Who opened, who clicked
• What your complaint rate is

Without bounce classification you cannot clean the list. Without a clean list, the next send’s complaint rate is higher still. It is a loop that gets worse on its own.

(The same problem exists in SMS — see SMS DLR status codes explained. “Submitted” has never meant “delivered”.)

Wall five: the law

In Hong Kong, a promotional email is a commercial electronic message under the Unsolicited Electronic Messages Ordinance, which covers email, fax, SMS and pre-recorded telephone messages. It requires clear and accurate sender information, an unsubscribe facility and unsubscribe statement, and that unsubscribe requests are honoured within 10 working days.

Separately, the Personal Data (Privacy) Ordinance regulates direct marketing, and its definition of direct marketing means explicitly includes email. Data subjects have the right to require that their personal data stop being used for direct marketing.

A manual BCC blast has no unsubscribe mechanism and no unsubscribe log to prove you acted within 10 working days. See Hong Kong promotional messaging compliance checklist.

Why “just use a new domain” doesn’t work

This is the self-rescue plan we hear most often, and it almost always fails.

Inbox providers do not only ask whether a domain has a bad history — they ask whether it has a good one. A brand new domain with no sending record is an unknown, and in spam filtering an unknown defaults to suspicious.

A brand new domain sending 5,000 marketing emails on day one is the textbook signature of a spammer. You are not washing off a bad reputation; you are starting from zero in the worst possible way.

Reputation accumulates. It cannot be skipped. Which brings us to what actually works.

What works: an EDM platform plus a gradual reputation build

Step one: finish authentication before the first send

SPF, DKIM and DMARC should all be in place before email number one, and you need to confirm alignment. SPF passing on its own is not enough — the From: header domain must align with SPF or DKIM for DMARC to pass.

Start DMARC at p=none. It blocks nothing, but it begins returning reports so you can see who is sending as your domain.

Step two: warm up, over two to six weeks

Warming up means raising volume week by week on a new domain or new dedicated IP so inbox providers can build trust in you incrementally.

The industry-consensus approach:

• Start with your most engaged subscribers. For the first two weeks, send only to people who have opened or clicked recently.
• Weeks three and four, expand to anyone who engaged in the last 60 days.
• For the first 45 days, avoid addresses with no engagement in the past 90 days.
• Add older segments in chunks of around 15% of existing volume, and never increase daily volume by more than about 20% in a day, however good the numbers look.
• Reaching full target volume typically takes four to eight weeks, depending on that target and on list engagement.

Why start with the most engaged? Because inbox providers are reading engagement signals. Opens, replies and rescues from the spam folder all score positively. Building the score up on a high-engagement group first gives you the headroom to introduce weaker segments later without the score collapsing.

Step three: list hygiene, continuously

Two lines to watch:

• Hard bounce rate: above 2% and you should stop and audit where the list came from
• Complaint rate: target below 0.10%; 0.30% is the line you never cross

Remove hard-bounced addresses immediately rather than retrying them next time. Classify soft bounces, and treat repeated soft bounces as invalid too.

Step four: monitor

Three instruments, minimum:

1. Google Postmaster Tools — the only place you can see your actual Gmail complaint rate
2. DMARC reports — who is sending as your domain, and what is passing
3. Your platform’s bounce and complaint classification reports

Without those three, you are flying blind.

When Outlook or Gmail is still the right tool

Honestly: one-to-one, or small internal notices.

• A follow-up to a single customer — obviously Outlook
• A meeting notice to 20 colleagues — fine
• Fifty personal notes to past customers where you actually edit each one — acceptable, and about the limit

Once the same content goes to more than roughly 50 external recipients who never explicitly subscribed, change tools. That is not a sales pitch, it is mechanics: an email client cannot inject a one-click unsubscribe header, cannot classify bounces, and cannot run a warm-up schedule. For what an email service platform does, see Going mad sending email!.

FAQ

I only send 1,000 a day, well under 5,000 — can I ignore all this?
The threshold sets what is mandatory, not what is filtered. SPF/DKIM/DMARC and your complaint rate affect inbox placement at any volume. And Microsoft’s rule is that once a domain has crossed the threshold, the requirements keep applying.

If I use BCC, recipients can’t see each other — surely that isn’t bulk sending?
To an inbox provider it absolutely is. Every BCC recipient is a separate message, and each one counts against your daily quota.

Can I attach a mail merge tool to our Microsoft 365 account?
You can, but it still lives under the Microsoft 365 sending quota, and mail still leaves from your corporate mail domain — no independent warm-up path, no bounce classification. It solves “pasting addresses is tedious”, not deliverability.

Does warming up require a dedicated IP?
Not necessarily. At modest volume a shared IP pool is often more stable, because the pool’s reputation is already supported by aggregate traffic. Dedicated IPs suit large, steady senders — and mean the reputation rests entirely on you.

Is DMARC at p=none worth anything?
Yes. It blocks nothing, but it satisfies the Google and Microsoft bulk sender DMARC requirement and starts producing reports that show you the problems. Tighten to quarantine or reject later.

We are already being marked as spam. How do we recover?
Stop all bulk sending, fix authentication and unsubscribe, purge hard bounces and long-dormant addresses, then warm up again from your most engaged segment and build back slowly. There is no shortcut; four to eight weeks is typical.

---

Sources

• Google Workspace Admin Help: Email sender guidelines
• Microsoft Learn: Outlook’s new requirements for high-volume senders
• RFC 8058 (one-click unsubscribe), RFC 2369 (List-Unsubscribe headers)
• Hong Kong Unsolicited Electronic Messages Ordinance (Cap. 593); PCPD Guidance on Direct Marketing