The requirements, distilled
For senders above modest daily volumes to consumer domains (thresholds around the few-thousand mark at Gmail/Yahoo, and the direction of travel is stricter everywhere):
- Full authentication: SPF AND DKIM pass with DMARC alignment on the sending domain (a DMARC policy present at all is table stakes) — the trio module is the prerequisite reading.
- One-click unsubscribe: RFC 8058 List-Unsubscribe-Post headers honoured promptly — link-in-footer alone no longer qualifies.
- Spam-complaint rate kept under ~0.3% (and ideally far lower) as measured by the receivers' feedback tooling — above it, bulk delivery collapses regardless of authentication.
What this means for an Exchange estate
EXO is not a bulk platform (limits concept: recipient-rate caps exist precisely to stop you trying) — so the compliance question is really an ARCHITECTURE question:
- Inventory who sends bulk as your domains: marketing SaaS, the billing system, HR platforms — the DMARC aggregate reports (trio module) are the census instrument.
- Route bulk off the primary domain: subdomains per stream (news.contoso.com, billing.contoso.com) isolate reputation — a campaign mistake shouldn't dent payroll delivery. Each subdomain gets its own DKIM + DMARC posture.
- Put app mail on app pipes: ACS for external application mail, HVE for internal bulk (retirements concept) — with their own authentication done properly, not piggybacking your user-mail reputation.
What to watch (proofs)
- Complaint-rate ground truth: Google Postmaster Tools (and Yahoo equivalents) per sending domain — enrolment is free and the charts are the compliance state; below-threshold is a screenshot, not an assertion.
- The unsubscribe headers: raw message inspection on each bulk stream — RFC 8058 headers present and the POST actually processing (test one).
- Alignment per stream: DMARC reports segmented by subdomain — each stream authenticating on ITS domain, no strays riding the apex.
- Estate leaks: bulk-shaped volume from user mailboxes (mail-flow reports) — someone mail-merging 5,000 customers from Outlook is both a limits incident and a compliance one; catch it as volume, redirect it to the right pipe.