The 0.10% Spam Rate Is the New Ceiling: What Gmail's November 2025 Shift Means for Customer.io Broadcast Cadence

The US Consumer Product Safety Commission tells you when to worry about carbon monoxide. Below 70 parts per million, most people will not feel symptoms, although heart patients can experience chest pain at lower levels. Above 70 ppm, headache, fatigue, and nausea start kicking in. CPSC's standing guidance is to install a UL 2034-certified alarm in every home, calibrated to trip before CO reaches levels at which a person loses the ability to react.

Read that carefully. The NIOSH workplace exposure limit for CO is 35 ppm averaged across an eight-hour shift, half the level at which the residential alarm triggers. The alarm is deliberately set higher than the safe operating level so it doesn't sound every time someone burns toast. Anyone telling you to ventilate at 35 ppm, not wait for the alarm, is right.

The alarm point is the legal threshold. It is not the safe operating point. The gap between them is real, and ignoring it carries real cost.

Gmail's published spam-complaint thresholds work the same way. 0.30% is the alarm. 0.10% is the safe operating point. The two numbers have been documented since the February 2024 bulk sender rollout, but until November 2025 the gap between them was theoretical. Now it costs you a week.

This post is what specifically changed, why 0.10% is now the working ceiling for any Customer.io workspace sending broadcasts at scale to Gmail audiences, and the concrete cadence playbook to keep you on the right side of it.

What actually changed in November 2025

The thresholds didn't move. The response did.

Google's documented sender requirements have read the same since February 2024: keep your user-reported spam rate below 0.1%, never let it reach 0.3%. The new wrinkle is what happens when you breach them. Until November 2025, enforcement was mostly soft: warnings in Postmaster Tools, spam foldering, the occasional 4.7.x temporary failure with a polite rate-limit message.

Google's Email sender guidelines FAQ now reads: "Starting November 2025, Gmail is ramping up its enforcement on non-compliant traffic. Messages that fail to meet the email sender requirements will experience disruptions, including temporary and permanent rejections."

Two error classes matter:

• 4.7.x temporary failures are rate limiting. Annoying but recoverable per-send.
• 5.7.x permanent rejections are SMTP-level bounces. Treated as undeliverable.

Red Sift's deliverability team described the shift on 14 November 2025: "Gmail's enforcement now includes temporary failure codes (4.7.x series) that rate-limit non-compliant mail and permanent failure codes (5.7.x series) that block messages outright."

The other change, the one most teams haven't internalised, is what 0.30% now costs. Spam rate is calculated daily. Once you cross 0.30%, you become ineligible for Google's mitigation channel until you stay below 0.30% for seven consecutive days. A single bad broadcast can lock you out of Google's support escalation for a week. Even if your spam rate drops to 0.05% by Tuesday, the clock resets on the next 0.30% day.

The underlying authentication requirements (SPF, DKIM, DMARC, one-click unsubscribe per RFC 8058) haven't changed, but they're now enforced with teeth. If you haven't built that foundation yet, start with the deliverability fundamentals before the cadence playbook will matter.

Why 0.10% is the working ceiling, not 0.30%

Because the alarm is not the safe operating point.

Treating 0.30% as your ceiling assumes you have surgical control over your spam rate on any given day. Almost no one does. Spam complaints lag the send by hours or days. Some recipients open at lunchtime, some don't open until the weekend. By the time you see a 0.18% reading on Monday, the broadcast that caused it went out on Wednesday.

Every spam complaint is a receipt for a decision the recipient made days or weeks ago. The unsubscribe arrives later. The "report spam" click arrives during your next send because they've finally had enough. What the unsubscribe button is really telling you covers this lag in detail.

The implication is operational, not theoretical. If 0.30% is the trapdoor, you need enough room above it to absorb a bad day. The Customer.io deliverability team uses the same number in their BFCM playbook: "Your spam complaint rate stays below 0.10%" is their success benchmark, and "complaint rate spikes above 0.20%" is their problem signal.

Operating rules I use with Customer.io clients:

• 0.10% is the ceiling. Sustained operation above this is a sign the segment is wrong, the cadence is wrong, or the offer is wrong.
• 0.15% is the alarm. Pause the next broadcast. Audit before sending again.
• 0.20% is the action threshold. Stop broadcasts. Move to triggered messages only.
• 0.30% is the trapdoor. You've already lost mitigation access for at least seven days.

Most accounts I see have never built the 0.15% alarm into their workflow because the published Gmail number is 0.30%. The gap is the whole point.

The Customer.io broadcast cadence change

Three knobs in Customer.io directly affect your daily spam rate: who's in the broadcast segment, how big each send is, and how often you send. Most teams have set all three by intuition. The November enforcement shift makes that costly.

Default audience: 30 days engaged, not 90

Tighten the default broadcast segment to people who opened or clicked in the last 30 days.

Customer.io's own deliverability team is explicit about this. From their BFCM playbook: "Most engaged subscribers opened or clicked in the last 30-60 days. They get your full campaign cadence." And: "You should avoid sending to any 180-day inactive subscribers, as they hurt deliverability when you include them in high-volume sends."

Most Customer.io accounts I audit still default to a 90-day or 120-day engagement window, sometimes with no window at all. The pushback is always the same: "we're leaving revenue on the table." The arithmetic doesn't survive contact with the November rules. A 90-day window includes people who haven't engaged in three months. In a 100,000-recipient broadcast, that's tens of thousands of people more likely to complain than convert. The 0.10% ceiling does not give you room for that.

The right call: engagement-based segmentation in Customer.io is the foundation, and the default broadcast segment is "engaged in the last 30 days" (clicked or opened, using Customer.io's Human Opened metric for the open signal).

A note on opens. Do not rely on raw email_opened for the 30-day window, because Apple Mail Privacy Protection pre-fetches every tracking pixel and inflates open data. Apple MPP has already broken the open signal, and the migration to Human Opened and Human Clicked metrics is the fix.

Segment size: cap each broadcast at 30-40% of your daily Gmail volume

Spam rate is calculated daily. The smaller each broadcast is relative to your daily volume, the less any single send can move the rate.

Concrete example. If your Customer.io workspace sends 50,000 emails a day to Gmail accounts across all activity (lifecycle, triggered, transactional, and broadcasts combined), a single broadcast of 50,000 to Gmail recipients is 100% of your day. If 0.15% of those recipients complain, the daily spam rate is 0.15%. You're inside your alarm zone, and one slightly worse send away from the trapdoor.

The same broadcast split across three days, 17,000 each, hits a different rate. Each daily total is roughly 67,000, and 0.15% complaints on the 17,000 broadcast portion only contributes part of the daily total. The same volume of complaints is dispersed across more total volume.

Rule of thumb: no single broadcast should exceed 30-40% of your daily Gmail volume to that segment. For workspaces sending 50,000+ Gmail emails daily across all activity, individual broadcasts should land at 15,000 to 20,000 recipients maximum.

Cadence: weekly send versus daily send for the same revenue

The counterintuitive move is to send more often, not less.

Most broadcast programmes are built around a weekly newsletter, sometimes a bi-weekly. The thinking is "don't fatigue the list." The thinking is wrong in this environment. A weekly send to your full engaged audience creates a spiky daily complaint rate, because all the complaints concentrate on one day. Five smaller broadcasts to slices of the engaged audience, spread Monday to Friday, produce a flatter daily curve.

The trade-off is real. You need five pieces of content instead of one. For a typical lifecycle programme, that means smaller, more topical sends: "what's new this week," "this customer story," "the bit of the product most people miss," each going to a different slice. Some teams resist this because it looks like more work. It is more work, but it's the work that pays.

The other option is the one most teams actually take: send weekly, accept the spiky rate, and hope you never have a bad week. November 2025 made that a worse bet than it was before. What it comes down to is the art of not sending: admitting that the right answer is sometimes to send something different to fewer people more often.

The double-warmup pattern after any audience expansion

When you do need to expand the audience for a re-engagement push, a new product launch, or a seasonal sale, do not promote the expanded list straight into the broadcast cadence.

The pattern that works:

1. Build the expanded segment as a separate audience.
2. Send it through a low-volume re-engagement campaign first. Triggered, not broadcast. One message, soft offer.
3. Watch the complaint rate for that audience specifically for five to seven days.
4. Only the recipients who engaged with the re-engagement message get promoted into the broadcast audience.

This is warming up your list, not your IP. The IP warm-up most teams know from migrations is about ramping volume on a new sending IP. This is the same idea applied to a new segment of recipients: prove they want your mail before you send it at scale.

If the re-engagement campaign produces a complaint rate above 0.15% on the expanded segment, that segment should not be promoted. Move them to a sunset workflow instead.

Wiring Postmaster Tools into your weekly review

Google added a Compliance Status dashboard to Postmaster Tools in 2025. Most lifecycle teams have not added it to their weekly review.

The signals worth tracking weekly:

• User-reported spam rate. The headline number. Track daily peaks, not just the seven-day average. A 0.22% daily spike inside a 0.06% weekly average is the dangerous reading.
• Domain reputation. Bad, Low, Medium, or High. If yours drops out of High, treat it as a P1.
• IP reputation. Same scale. Customer.io shared-IP users will see ranges; track the trend, not the absolute.
• Authentication results. SPF, DKIM, DMARC pass rates. Should be at or near 100%. Anything else is a misconfiguration or a third-party tool sending on your behalf without proper auth.
• Compliance Status. The newer dashboard's red flags map to specific failures. Treat any non-green status as an action item.

Suggested weekly review structure: alarm at 0.15% on any single day in the last seven, action threshold at 0.20%, and any drop in domain reputation gets the same priority as a P2 bug.

Owner matters. Postmaster Tools is not the deliverability vendor's job, the agency's job, or "we'll look at it next quarter." It belongs to the head of CRM, weekly, with the same cadence as a campaign performance review. If you don't have a lifecycle marketing scorecard that replaces vanity metrics, the Postmaster Tools signals are the first thing to put on it.

Recovering from a complaint spike without a full sunset

If you've already spiked above 0.30%, the recovery path is operational, not technical.

Days 1-3. Stop all broadcasts. The reflex is to "re-engage" the audience to prove they still want the messages. Don't. Re-engagement to a spiking audience makes the rate worse. The only sends to the engaged audience during this window should be triggered lifecycle automations (welcome flows, abandonment, post-purchase) that the recipient is actively expecting. The rest stops.

Days 4-7. Build a tighter audience. Active engagement in the last 14 days, not 30. Stricter activity filters. Build a Customer.io subscription centre that gives recipients granular control if you don't already have one, so recipients have somewhere to dial down before hitting "Report spam." Suppress anyone in the last broadcast who hit the complaint button.

Days 7-14. First broadcast back, at no more than 25% of the previous typical broadcast size, to the 14-day engaged audience only. Watch the rate for 48 hours. If it stays below 0.10%, go to 50% of previous size next send. Below 0.10% again, return to normal cadence with the new 30-day default segment.

If you spike again during recovery, treat it as evidence your engaged audience is genuinely smaller than the size you were sending to. Resize permanently. The audience is what it is.

Frequently asked questions

Q: What is the Gmail spam rate threshold in 2026?

Gmail's published threshold is 0.30% maximum, with 0.10% as the target. From November 2025, exceeding 0.30% means losing access to Gmail's mitigation support until you stay below 0.30% for seven consecutive days. In practice, 0.10% is now the working ceiling, not the target.

Q: What is a 5.7.x error from Gmail and what should I do about it?

5.7.x is the family of SMTP permanent-rejection codes Gmail introduced to bulk sender enforcement in November 2025. The specific codes (5.7.25, 5.7.27, 5.7.29, 5.7.30 and so on) tell you which requirement failed: missing PTR record, SPF failure, missing TLS, DKIM failure. They are not retryable. Fix the underlying authentication issue, then resume sending.

Q: How is the spam complaint rate calculated by Gmail?

Daily, based on user-reported complaints from personal Gmail accounts only (not Google Workspace recipients). The denominator is the number of messages you sent that day. Google publishes the rate per primary domain in Postmaster Tools, including a graph for trend analysis. The November 2025 enforcement uses the daily rate, not a weekly or rolling average.

Q: How long does it take to recover from a Gmail complaint spike?

The minimum is seven consecutive days below 0.30% before Gmail will re-enable mitigation eligibility. Full domain reputation recovery takes longer, often two to four weeks, because reputation is a lagging signal. The 14-day quiet period in the recovery playbook above is the floor, not the ceiling.

Q: Do shared sending IPs in Customer.io affect my Gmail reputation?

Less than most teams assume. Gmail's reputation model weights domain reputation more heavily than IP reputation for established senders, especially with DMARC alignment. Shared IPs are fine for the majority of Customer.io accounts. Move to a dedicated IP when you reliably send more than 250,000 emails per month, which is the threshold Customer.io's deliverability team uses.

Q: Will Apple Mail Privacy Protection-inflated open rates trick me into sending too often?

Yes, if you build your "engaged" segment on the raw email_opened event. Apple MPP pre-fetches every tracking pixel for opted-in Apple Mail users, which is a substantial slice of consumer email globally. Use Customer.io's Human Opened and Human Clicked metrics instead. The full migration recipe is in the dedicated post on Apple MPP and Customer.io triggers.

Q: Are Yahoo's and Microsoft's spam rate thresholds the same as Gmail's?

Yahoo aligned with Gmail's threshold in early 2024 as part of the joint sender requirements rollout. Microsoft joined Google and Yahoo with similar requirements through 2025. The 0.10% target and 0.30% ceiling are now effectively the cross-provider standard for personal consumer mailboxes. The enforcement teeth vary by provider, but the operating rules are the same.

Q: Can I check my spam complaint rate inside Customer.io?

Customer.io exposes spam complaint rates as a metric inside campaign and broadcast reports. The reporting is per send, not per day at the workspace level, so for the day-level rate Gmail enforces against, you still need Postmaster Tools. Use Customer.io reporting to spot which send is causing the spike, and Postmaster Tools to track the rate Gmail sees.

Q: What is the safest cadence for a Customer.io broadcast to a Gmail-heavy list?

Multiple smaller sends to slices of the engaged audience, spread across the week, with each broadcast no larger than 30-40% of your daily Gmail volume to that audience. The exact cadence depends on your engagement profile, but a typical SMB Customer.io account sending 30,000 to 80,000 Gmail emails daily should plan three to five broadcasts a week, each 10,000 to 20,000 recipients, rather than one big weekly send.

Q: What is Google Postmaster Tools' new Compliance Status dashboard?

Added by Google in 2025 alongside the November enforcement ramp-up, it's a separate dashboard within Postmaster Tools that shows real-time compliance status against each bulk sender requirement (SPF, DKIM, DMARC, one-click unsubscribe, spam rate, TLS, PTR). Red flags mean you are out of compliance for that requirement and likely to see 4.7.x or 5.7.x failures.

Q: Should I shrink my broadcast list to fix a complaint spike, or just send less often?

Both. Shrinking the list (tighter engagement window, stricter filters) reduces the complaint rate per send. Sending less often gives the audience time to forget the bad experience that caused the spike. The two are not alternatives. Recovery requires both.

Q: Once I'm classified as a Gmail bulk sender, can I un-classify by sending fewer emails?

No. Google is explicit: "Senders who meet the above criteria at least once are permanently considered bulk senders." Once you've hit 5,000 emails in a 24-hour window to personal Gmail accounts, you are a bulk sender forever, even if you cut sending volume to zero the next day. The bulk sender requirements apply to you indefinitely.

Q: What's the relationship between unsubscribe rate and spam complaint rate?

Unsubscribes are the healthy version of complaints. Both are receipts for the same decision: "stop sending me this." A healthy lifecycle programme makes it easier to unsubscribe than to complain, so the unsubscribe rate is higher and the complaint rate is lower. If your unsubscribe rate is low and your complaint rate is high, your unsubscribe path is broken or hidden.

Sources

• Email sender guidelines FAQ, Google Workspace Admin Help, current 2026
• Gmail's enforcement ramps up: What bulk senders need to know, Red Sift, 14 November 2025
• How to run BFCM campaigns that convert and protect deliverability, Customer.io, 7 October 2025
• Carbon Monoxide Fact Sheet, US Consumer Product Safety Commission
• NIOSH Pocket Guide to Chemical Hazards: Carbon monoxide, Centers for Disease Control and Prevention