I was in the room when a deliverability engineer stood up at DS2026 and said, quietly, that DMARC p=reject was no longer advanced practice. It was the floor. Half the audience nodded. The other half went pale.
That reaction tells you something. For years the industry talked about these authentication standards as aspirational. In 2026, inbox providers started using them as trust signals at the base level. If you are not at p=reject, you are not competing. You are just hoping the filters look the other way.
Below are the 9 specific fixes that came out of DS2026, in order of priority. These are not predictions. They are actions.
1. Move DMARC to p=reject
If your DMARC policy is still at p=none or p=quarantine, you are operating below the 2026 baseline. Inbox providers now use DMARC enforcement as a sender trust signal. p=none means you are watching but not acting. Providers notice that too.
What to do: Audit your DMARC record at MXToolbox. If you are at p=none, move to p=quarantine for 30 days while monitoring your DMARC aggregate reports. Once you confirm alignment across all sending sources, move to p=reject. The DMARC specification is clear on this path.
2. Audit Every Link for HTTPS
Gmail now applies spam filter weighting to emails containing HTTP (non-secure) links. Not HTTPS. HTTP. This was confirmed at DS2026 and verified across multiple deliverability platforms’ data.
What to do: Pull your last three email sends. Search the HTML source for http:// that is not immediately followed by s. Replace every instance. This includes tracking links, unsubscribe URLs, image source URLs, and footer links. One HTTP link can degrade the entire send.
3. Write Alt Text That Reads Like Content
AI inbox middleware, deployed by Gmail and Outlook, reads your email before the human does. It scores entity recognition, text coherence, and image-to-text ratio. Alt text is part of that scoring.
Alt text that says “image1.jpg” or “banner” contributes nothing. Alt text that says “Sendability dashboard showing inbox placement rate 94% for May 2026 campaign” tells the AI what this email is about and who sent it.
What to do: Open your email template. Every image that contains useful information needs alt text that describes that information. Treat alt text as a second content layer, not a disability compliance checkbox.
4. Stop Using the Hard/Soft Bounce Binary
The old bounce classification is obsolete. DS2026 established three categories:
- Permanent failures: address does not exist, domain gone, MX record missing. Suppress immediately.
- Transient failures: mailbox full, temporary server reject, greylisting. Retry with exponential backoff. Do not suppress after one event.
- Engagement-based suppression: address valid, delivery confirmed, but no opens or clicks in 180+ days. This is not a bounce. It is a different problem requiring a re-engagement sequence or quiet suppression, not the same treatment as a dead address.
Treating category 3 as category 1 destroys good addresses and inflates your suppression list. Treating category 2 as category 1 removes valid contacts after a single server hiccup.
What to do: Review how your platform classifies bounces. If it gives you one bucket labeled “hard” and one labeled “soft,” you are working with an incomplete model. The re-engagement path for 180-day inactive contacts is separate from your bounce suppression path.
5. Clean Your List at Acquisition, Not Just at Send Time
Single-layer list cleaning, run once before a campaign, is not enough. DS2026 documented a multilayered approach that runs at the moment someone submits their email address:
- Syntax validation (does this look like a real email address?)
- MX record validation (does this domain have mail servers?)
- Catch-all detection (does this domain accept everything, making deliverability unpredictable?)
- Abuse and role address detection (postmaster@, info@, noreply@, abuse@, admin@ – these generate complaints)
What to do: If your acquisition forms have no real-time validation beyond basic syntax, you are building a list problem that compounds over time. Every bad address you allow in costs you twice: once when it bounces, once in the reputation damage it causes.
6. Monitor Absolute Complaint Volume, Not Just Complaint Rate
The industry has focused on complaint rates because that is what the tools show. DS2026 shifted this: absolute complaint volume is what inbox providers are now tracking at scale.
A 0.08% complaint rate sounds fine. At 100,000 sends, that is 80 complaints. Eighty complaints from a single send is a signal that triggers scrutiny at the provider level, regardless of the percentage. The math matters.
What to do: Calculate your actual complaint volume after every campaign. Set an alert at 50 absolute complaints per send, not just a percentage threshold. If you are sending 500K emails, even a 0.02% complaint rate produces 100 complaints. The volume tells a different story than the rate.
7. Set Up BIMI
BIMI (Brand Indicators for Message Identification) is moving from experimental to expected in 2026. It displays your brand logo next to your email in the inbox. More importantly, it requires DMARC at p=reject or p=quarantine to work, which means it also functions as a verification gate.
DS2026 confirmed that providers now grant partial inbox trust signals for BIMI with a=self self-assertion, even without a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC). A=self is free and can be implemented today.
What to do: Start with a=self. Prepare an SVG version of your logo (the spec requires SVG Tiny P/S format). Once you have stable DMARC at p=reject, implement BIMI with a=self while you evaluate whether a VMC certificate makes financial sense for your volume. The BIMI Group has implementation guides for every major sending stack.
8. Design for AI Readability, Not Just Human Readability
The AI middleware deployed by inbox providers evaluates four things in your email before a human sees it: entity recognition (do they know who sent this and why?), text coherence (does the written content make sense?), image-to-text ratio (are there enough words relative to images?), and structural signals (headings, links, hierarchy).
Emails that rely heavily on images with thin text fail AI readability checks. Your beautiful hero image with three words on it is invisible to the filter. What it reads is the preheader, the first paragraph, the alt text, and the link anchors.
What to do: Ensure every email has a minimum of 200 words of actual text (not counting images). Use proper heading structure. Name your entities explicitly: brand name in the first paragraph, product name in context, URL spelled out in footer. This is not an accessibility exercise; it is a deliverability one.
9. Stop Managing These as Separate Projects
This is the friction point DS2026 was honest about. DMARC enforcement, BIMI setup, three-category bounce logic, multilayered list cleaning, complaint volume monitoring, and AI readability optimization are related disciplines. Running them as separate initiatives means none of them reach full implementation because the coordination cost is too high.
The teams that came out of DS2026 with a clear plan had one thing in common: they were treating infrastructure as a managed stack, not a collection of tickets.
If you want to see how all nine of these work together in a single sending environment, Sendability is the managed platform that runs them: independent MTA infrastructure, Mautic CRM, DMARC and BIMI implementation, multilayered list hygiene, and ongoing deliverability monitoring. Everything DS2026 said you need to have operational by Q3 2026.
The baseline has moved
DS2026 did not introduce new technology. It documented where the standards have landed after two years of provider enforcement. The email marketers who take this seriously in Q2 2026 will have a structural advantage in the second half of the year. The ones who wait will be playing catch-up when their sends start underperforming in September.
These nine fixes are not complicated individually. The difficulty is doing all of them, at the same time, without dropping the ones that do not have an immediate visible effect. That is the work.