Half-Year Review: Email in the AI Inbox Era

Six months that rearranged the reading layer: Gemini in Gmail, Microsoft rejecting outright, DMARC finally a standard. What the first half of 2026 means for senders.

Last December we closed the year by observing that identity had become solved plumbing and trust had not. Six months later that framing looks almost quaint, because 2026 promptly renegotiated what trust even means: the reading layer itself changed hands. Here is the half-year in review, what it did to the numbers, and the posture we would take into the second half.

January: the model moved in

Gmail's Gemini rollout, AI Overviews summarizing messages, an AI Inbox ranking attention, reply drafting throughout, on by default, was the half-year's structural event. The engagement data through spring confirmed what January predicted: open-adjacent metrics drifted up while click-through slid, as summaries absorbed the intermediate step between delivery and action. Our June piece covered the writing response; the July summary of the summary is that AI mediation taxes padding and pays clarity, and the senders hurt worst were the ones whose messages never had an extractable point to begin with.

The enforcement era finished becoming boring

Microsoft's rejection phase, live since late last year, spent the winter filling bounce logs with 550 5.7.515 for the senders who ignored two years of warnings, and our February field guide remains the most-read piece of the half. The pattern that started with Gmail and Yahoo in February 2024 is now simply how email works: authenticate or be refused, at every major consumer inbox, checked before any allowlist. The operational consequence shows up in what incidents look like now: authentication failures are sharp, legible, and quickly fixed, while the slow, ambiguous incidents have migrated up the stack to engagement and list quality, where no bounce code names the problem for you.

May: the paperwork caught up

DMARCbis published as RFC 9989, 9990, and 9991, obsoleting RFC 7489 and making DMARC a Proposed Standard eleven years after the industry started treating it as one. Nothing operational changed, which was the design, and the citation layer is already updating: the first security questionnaires referencing 9989 arrived within weeks. Combined with NIS2 implementations maturing across the EU, the compliance surface of email keeps hardening into checklist form, which favours exactly the senders who did the work before it was a checklist.

Second-half posture

Three bets for the remaining months. First, authentication is maintenance now: the annual audit, the rotation schedule, the monitoring stack, run as routine, with np= adoption and document updates to RFC 9989 as the only novel items. Second, the AI reading layer spreads: Apple and Microsoft summarization features are following Gmail's path, so the structural writing discipline from June stops being a Gmail specialty and becomes the house style. Third, measurement keeps migrating downstream: conversions and revenue per send are the program metrics, filtered clicks are diagnostics, opens are weather. Q4 planning starts in September as ever, and this year's October checklist inherits an extra line: verify your peak-season creative survives summarization, because Black Friday's competition includes every other summary in the AI Inbox.

The through-line of eighteen months of this archive holds one more time: every layer that gets automated, authentication, filtering, now reading itself, transfers value to the same place, mail that people demonstrably want. The models are new; the winning strategy is the oldest one in the publication. Send less, mean more, and be the sender whose summary is worth expanding.