The single biggest risk in the volume model is not a law; it is a policy change at Google or Microsoft. In September–October 2025 Google ran the largest documented suspension wave against cold-email mailboxes: by the Salesforge newsletter's account, "reputable infrastructure providers estimate ~25% of clients" were hit, and whole accounts, not single inboxes, were locked. Microsoft moved the other way on volume — it cancelled its planned 2,000-a-day external-recipient cap in January 2026 — while tightening consumer Outlook delivery for bulk senders from May 2025.
Google enforces against how the account was obtained and how it behaves; Microsoft enforces against how much a tenant sends and whether it authenticates. That asymmetry is why infra vendors and agencies moved volume towards Microsoft and private SMTP after October 2025.
Timeline
| Date | Who | What changed | Effect on cold email |
|---|---|---|---|
| Oct 2023 (announced) → Feb 2024 (enforced) | Gmail, Yahoo | Bulk senders (5,000+/day to personal Gmail) need SPF, DKIM, DMARC, one-click unsubscribe, spam rate <0.3% (Hunter) | Mostly hits marketing mail; cold senders spread volume to stay below thresholds. See Google and Yahoo sender rules |
| Apr 2024 | Microsoft | Proposes a 2,000 external recipients/24h cap per mailbox (MERRL), scheduled for Jan 2025 (Office365itpros) | Would have capped one M365 mailbox well above cold-email norms; postponed |
| 5 May 2025 | Microsoft (Outlook.com, Hotmail, Live) | 5,000+/day senders must pass SPF, DKIM, DMARC; non-compliant mail goes to Junk, then may be rejected with 550; 5.7.515 (Microsoft's policy); senders report 550s from day one (Resend) | Consumer-only; B2B cold email rarely targets these domains. See Microsoft rules: Outlook.com and Microsoft 365 limits |
| Sep–Oct 2025 | Wave of suspensions on cold-email mailboxes; EDU, nonprofit and legacy G Suite "panels" targeted; whole accounts locked (Salesforge newsletter, 21 Oct 2025; Primeforge) | Largest documented hit to the infra layer | |
| Nov 2025 | Gmail | Reported start of stricter enforcement of the bulk-sender rules (Outboundsystem) | Unconfirmed from Google directly |
| 6 Jan 2026 | Microsoft | MERRL cancelled; tenant-level external recipient limit stays (Office365itpros) | Removes a threat to M365-based infra |
| Aug 2026 | Instantly | Launches AirMail private SMTP, pitched as free of "Google algorithmic restrictions or suspension risk", capped at 5,000 new accounts a week (Instantly help) | Largest sequencer hedges away from Google |
The autumn 2025 Google wave
What is documented:
- Timing. On 21 October 2025 Salesforge wrote: "For the last 3-4 weeks, Google has started lightly suspending cold-email mailboxes. In the last few days, it ramped up and whole accounts are being locked."
- Targets. "student.edus, free Gmail accounts", "irregular domains or shared infrastructure" (Salesforge); reseller "panels" that "posed as educational institutions or charities to create large numbers of free or discounted accounts, then resold them to cold emailers" (Primeforge).
- Scale. "~25% of clients" at reputable providers (Salesforge, vendor estimate); "hundreds of cold emailers and agencies have reported sudden suspensions" (Primeforge).
- Stated causes. ColdSire, another infra vendor, lists "scraped APIs, undocumented endpoints, and automated account creation scripts", pooled domains and credentials across customers "violating Google Partner agreements", and coordinated sending and rapid warmup, and says "several major cold email platforms have been banned by Google Workspace".
No source names which providers or panels were shut down, how many mailboxes were lost, or whether Google terminated any reseller partner agreements. Google made no public statement found by this pass. Every number here is a competitor's estimate — and each of those competitors used the moment to sell its own "compliant" inboxes.
EmailBison claims that about 22% of high-volume new Google accounts were suspended within 90 days, versus under 9% on Microsoft. No methodology or date range is given.
What it did to the infra providers
- Marketing pivoted to provenance. Primeforge advertises mailboxes "provisioned directly under Google or Microsoft with full admin access"; Premium Inboxes "Real Google Workspace & Microsoft 365 business accounts. Clear contracts, proper invoices"; Cheap Inboxes "Official Business Starter with Admin Access"; ColdSire claims "100,000+ mailboxes and 40,000+ domains without a single ban" and caps cold email at 15% of its mixed pool.
- Replacement guarantees became a feature. Premium Inboxes includes "unlimited replacement inboxes"; Maildoso sells "self-healing mailboxes" (Maildoso).
- Volume shifted to Microsoft and SMTP. Microsoft domain packs (Hypertide, Scaledmail, Inboxkit Azure tenants, Inframail) and private SMTP (Maildoso, Mailforge, AirMail) are the products most often pitched as Google-proof.
- Prices did not rise. Google inboxes from resellers still list at $2.50–3.50 in October 2026 (see Inbox & domain infrastructure), which suggests supply recovered or moved to sturdier sourcing.
What it did to the sequencers
- Instantly built its own SMTP network (AirMail, August 2026) and keeps domain ownership of its pre-warmed Google accounts (Instantly help).
- Smartlead resells several infra suppliers side by side through SmartSenders — Google, Outlook via Zapmail or InfraInbox, SMTP via Mailreef or AeroSend (Smartlead) — spreading supplier risk.
- Salesforge used the wave to push Primeforge and the advice to diversify (Salesforge newsletter).
Microsoft: tenant limits, not per-mailbox caps
Microsoft's documented constraints in October 2026 (Microsoft Learn):
- 10,000 recipients per mailbox per day; 30 messages per minute.
- A tenant-wide external recipient rate limit that grows with licences; trial tenants: 5,000 external recipients a day.
- onmicrosoft.com domains: 100 external recipients per organisation per day, rejected with
550 5.7.236.
The May 2025 Outlook consumer rules matter less to B2B cold email than headlines suggested: they apply to mail into outlook.com, hotmail.com and live.com at 5,000+ a day, and unauthenticated mail goes to Junk first and "may be rejected" later under Microsoft's policy, though senders report 550 5.7.515 rejections from day one (Resend). See Microsoft rules: Outlook.com and Microsoft 365 limits.
A vendor blog, Litemail, claims that in 2026 Microsoft requires domains to be 14 days old before sending, limits new domains to 200 a day, flags complaints at 0.10%, reviews senders with open rates under 8%, requires "bulk sender registration" at 5,000+ a day and "blocked over 3 million outbound accounts in Q1 2026". None of this appears in Microsoft's documentation reviewed for this page, and no primary source is cited. Treat as unverified.
Reading the risk
- Google's lever is the account. It can end an inbox, a domain's tenant or a reseller relationship. Recovery is slow. Its target in 2025 was gray-market sourcing and shared infrastructure.
- Microsoft's lever is throughput. It caps tenants and junks or rejects unauthenticated bulk mail. Recovery is faster, but trial and onmicrosoft.com tenants are deliberately starved.
- Neither has targeted warmup or sequencers by name. That is the next shoe; see Does warmup work?.
- Policy texts matter. Both acceptable-use policies forbid spam and abuse in broad language (Google AUP); see Provider rules: Google, Microsoft and the ESPs and Platform liability: what the sequencer itself risks.
What this means for an entrant
- Assume another Google wave within 12 months. Design for it: per-provider health monitoring, automatic pause on suspension signals, and one-click re-homing of a domain to Microsoft or SMTP.
- Do not source inboxes from opaque panels. If you resell infra, buy from suppliers who can show tenant ownership and invoices; the cheapest Google inbox is the one most likely to vanish with your customer's campaign.
- Make provenance and suspension history visible. A dashboard showing which supplier, which tenant type and how many suspensions per 1,000 inboxes is a trust feature no incumbent ships.
- Microsoft is the safer volume base in 2026. The MERRL cancellation removed the main threat; tenant limits are documented and predictable. Build Microsoft Graph sending as a first-class path, not an afterthought.
- Track this page's sources monthly. Google support pages, Microsoft's Exchange blog and the Outlook TechCommunity blog are where the next rule will land. See Infrastructure strategy: build or partner.