Key Takeaways
- Since 1 February 2024, Gmail has required senders of more than 5,000 messages a day to personal Gmail accounts to set up SPF, DKIM and DMARC (Google, 2024).
- Google asks senders to keep the spam rate in Postmaster Tools below 0.10% and never to reach 0.30% (Google, 2024).
- Microsoft’s April 2025 update says Outlook.com rejects failing mail from domains sending over 5,000 emails a day (Microsoft, 2025).
- Apple Mail Privacy Protection loads remote content whether or not the recipient engages, so opens overstate attention (Apple, 2025).
- Transformance actions 100% of overdue invoices within 24 hours; manual teams reach 30-40% (Transformance customer data, 2026).
In This Article
- Key Takeaways
- Why do dunning emails land in spam?
- What do Gmail, Yahoo and Outlook require from senders?
- How do SPF, DKIM and DMARC work together for invoice and reminder emails?
- Why should dunning have its own sending stream?
- Why are open rates misleading for dunning emails?
- What should you measure instead of open rates?
- How do you fix a dunning domain that already lands in spam?
- How does Vero handle dunning emails?
Why do dunning emails land in spam?
Dunning emails land in spam for five reasons: failed authentication, a sending domain with a poor reputation, month-end volume bursts, stale contacts that bounce, and recipient complaints.
A dunning email is a payment reminder that receiving servers judge like any mail: by who sent it, whether the sender can prove it, and how recipients reacted before. Google warns that mail from senders who miss its requirements “might be marked as spam” (Google, 2024).
In AR the causes look like this:
- Unauthenticated senders. The ERP or a billing relay sends “from” your domain but is missing from SPF and does not sign with DKIM.
- Shared reputation. Marketing and AR use one domain, so a newsletter that draws complaints drags the reminders down.
- Bursts. The whole reminder run leaves on the second working day, at many times the usual daily volume.
- Stale contacts. The AP clerk on file left two years ago; the address bounces every month.
- Complaints. A customer who disputes the invoice clicks “report spam” instead of replying.
The sender name counts too: Google says a display name should identify the sender and not carry message content such as “URGENT REQUEST”. Wording and cadence are in our dunning email templates.
What do Gmail, Yahoo and Outlook require from senders?
Since February 2024, Gmail has required senders of over 5,000 messages a day to authenticate with SPF, DKIM and DMARC; Yahoo and Outlook.com apply similar rules to bulk senders.
Sources: Google (2024), Yahoo Sender Hub (2024), Microsoft (2025).
Google’s FAQ says that from November 2025 Gmail is ramping up enforcement, with “temporary and permanent rejections” (Google, 2025). A rejected reminder never arrives, and its bounce may land in a mailbox nobody in AR watches.
These are consumer-mailbox rules (Google’s cover @gmail.com and @googlemail.com, Microsoft’s outlook.com, hotmail.com and live.com). Most B2B customers sit on business mail systems with their own filters, but the rules are the clearest public baseline, and some customers use consumer addresses.
The 5,000 is easy to reach: Google counts “all messages sent from the same primary domain,” subdomains included, and a sender that crosses the line once is “permanently considered” a bulk sender.
How do SPF, DKIM and DMARC work together for invoice and reminder emails?
SPF lists the servers allowed to send for your domain, DKIM signs each message, and DMARC tells receivers what to do when the visible From domain aligns with neither.
Take a reminder sent “from” ar@company.com through a third-party AR tool. SPF checks the envelope sender, often the tool’s bounce domain, and DKIM may be signed with the tool’s domain. Both pass, yet DMARC fails, because neither matches the From address your customer sees. Google: “The authenticating domain must be the same domain that appears in the message From: header.”
The fix is alignment: have the tool sign DKIM with your domain or subdomain, and use a custom return-path where possible. Google requires DKIM keys of at least 1024 bits for personal Gmail accounts and recommends 2048 bits. Yahoo strongly recommends a DMARC “rua” tag so aggregate reports reach you.
List every system that sends with your domain in the From line: ERP output management, billing, the AR tool, the e-invoicing portal, shared mailboxes. Start DMARC at p=none, read the reports for a few weeks, and move to quarantine once every legitimate sender passes; that last step is common practice, not a provider requirement.
Why should dunning have its own sending stream?
Give dunning its own authenticated subdomain so that a marketing campaign cannot damage the reputation of the emails that bring in cash.
Google asks large senders to “send email at a consistent rate” and “avoid sending email in bursts” (Google, 2024). M3AAWG’s sender best practices, still linked from Yahoo’s Sender Hub, explain why streams should not mix: “combining transactional and marketing email or mail from more than one entity can create irregular traffic volumes” (M3AAWG, 2015).
- A subdomain such as ar.company.com, with its own SPF, DKIM and DMARC. It separates the stream, not the count: Gmail still adds it to the primary domain’s volume.
- A monitored reply-to. Microsoft asks large senders for a From or Reply-To address that “can receive replies.” In AR every reply is a lead: a dispute, a promise, a new contact.
- Steady daily volume. Send reminders as invoices fall due, not in one month-end batch; see dunning automation for multi-entity groups.
- Bounce handling. Yahoo tells senders to “remove invalid recipients from your list promptly,” and Microsoft asks for regular removal; then find the right contact.
Google’s FAQ requires one-click unsubscribe “only for marketing and promotional messages” and adds that “message recipients, not Google, determine the nature of the messages they receive.”
Why are open rates misleading for dunning emails?
Apple’s Mail Privacy Protection downloads remote content, including tracking pixels, in the background, regardless of whether the recipient engages, so opens overstate attention.
Apple says Protect Mail Activity “downloads remote content in the background by default” (Apple, 2025). An “open” can be a machine fetching an image.
The error runs both ways. A client that blocks remote images never loads the pixel, so a clerk can read the reminder, forward it for approval and never register an open. An open rate has never paid an invoice.
What should you measure instead of open rates?
Measure delivery and outcomes: authentication pass rate, bounces, spam complaints, reply rate, promises to pay captured, and the share of reminded invoices paid within seven days.
Seven dunning email metrics that replace open rates:
- Authentication pass rate per sending system, from DMARC aggregate reports.
- Hard bounce rate per send, plus contacts removed after repeated bounces and replaced.
- Spam complaint rate in Google Postmaster Tools, against Google’s target of below 0.10%.
- Reply rate by type: dispute, promise, wrong contact, already paid.
- Promises to pay captured per 100 reminders, and how many are kept; see how AI tracks promises to pay.
- Share of reminded invoices paid within 7 days of the touch.
- Share of overdue invoices actioned within 24 hours of falling due.
The first three tell you whether reminders arrive; the last four whether they work. Low replies with clean authentication point at the message or the contact; high bounces point at your customer master. DSO and CEI sit in our collections KPI guide. When a customer stops replying altogether, see what to do when a B2B customer goes silent on overdue invoices.
For the seventh, a benchmark: Transformance actions 100% of overdue invoices within 24 hours, where manual teams reach 30-40% (Transformance customer data, 2026).
How do you fix a dunning domain that already lands in spam?
Fix authentication first, cut volume, remove repeated bounces, then ramp back up slowly while watching the spam rate in Google Postmaster Tools.
- Confirm SPF, DKIM and DMARC pass and align for every sending system.
- Cut volume “until the SMTP error rate decreases,” as Google advises.
- Remove addresses that bounce repeatedly and correct the contact in the ERP customer master.
- Move dunning to its own subdomain with a monitored reply-to.
- Increase volume slowly instead of resending the backlog at once.
Bulk senders above 0.3% stay ineligible for Google’s mitigation until the rate holds below 0.3% for 7 consecutive days.
Meanwhile overdue invoices age, so switch channel for the items that matter: a phone call does not pass through a spam filter. The AI calling agent in Transformance makes 15-20 calls an hour in 70+ languages and identifies itself as AI at the start of every call; see the AI calling agent guide.
How does Vero handle dunning emails?
Vero, the AI agent in Transformance, works from Customer 360, its working memory of one graph per customer, inside a 4-level approval model: read, recommend, execute, post.
That per-customer view is what outcome metrics need: the reminder, the reply, the promise and the payment belong to one customer, not to a mailbox report. A person stays in the loop for ERP postings, with a full audit trail. More in how AI automates collections and on CollectPulse.
Ask any tool, ours included: which domain do reminders come from, who sets up SPF, DKIM and DMARC, where do replies go, and can it report replies, promises to pay and cash after the touch instead of opens?
Conclusion: deliver like a bank alert, measure like a collector
Deliver a dunning email like a bank alert, from its own authenticated subdomain at steady volume to clean contacts. Then judge it like a collector, by replies, promises to pay and cash received.
Frequently Asked Questions
Why do our dunning emails go to spam?
Most often a sending system, such as the ERP or an AR tool, fails SPF, DKIM or DMARC alignment. Shared marketing domains, month-end bursts, bouncing contacts and spam reports follow.
Do the Gmail and Yahoo sender rules apply to B2B payment reminders?
They apply to mail sent to Gmail and Yahoo addresses. Basic authentication covers every sender, and Gmail’s bulk rules depend on volume from your primary domain. Business mail systems run their own filters.
Should we track open rates on dunning emails?
Don’t rely on them. Apple Mail Privacy Protection loads remote content whether or not anyone reads, and clients that block images record nothing, so opens are inflated in some inboxes and missing in others.
Should dunning emails come from a separate subdomain?
Yes, a subdomain such as ar.company.com keeps your reminders’ reputation apart from marketing mail. It still counts toward Gmail’s 5,000-a-day total.
What should AR teams measure instead of open rates?
Measure whether reminders arrive (authentication, bounces, complaints) and whether they work (replies, promises to pay per 100 reminders, invoices paid within 7 days).
What do you do when a customer says they never received the reminder?
Check delivery first: sending logs for a bounce or rejection, DMARC reports for an authentication failure. Then confirm the contact, resend and call if the amount is overdue. If it is the invoice that never arrived, see what to do when a customer says the invoice never arrived.
