How do corporate vs consumer inbox signals differ?

Sending to a consumer Gmail address and sending to a corporate account at a Fortune 500 are two completely different games. The signals that matter, the people who decide, and the levers you can actually pull are all different. If you're a B2B sender treating corporate inboxes like they're just big consumer inboxes, you're fighting the wrong war.

Consumer inboxes: the algorithm decides

At Gmail, Outlook.com, Yahoo, and iCloud, the filter is a machine learning model that learns from every user's behavior. Did they open? Did they reply? Did they mark you as spam, or drag you out of spam? Engagement is the dominant signal. Authentication is table stakes (you won't get anywhere without it), but engagement is what separates primary tab from promotions tab from spam. You can influence this by sending less to cold subscribers, more to engaged ones, and by asking people to add you to their contacts.

Corporate inboxes: the gateway decides

At a mid-to-large company, your email hits a security gateway before it hits the user. Proofpoint, Mimecast, Barracuda, and Microsoft Defender for Office 365 are the big four. These gateways care about things consumer filters barely notice:

• Hard authentication (DMARC at p=reject, not p=none)
• Link reputation (any shortener domain is suspicious)
• Attachment behavior (even image inlining can trigger quarantine)
• Domain age and registrar patterns (brand-new sending domain to a cold contact is a big red flag)
• The admin's custom allow/block list for that specific tenant

User engagement barely moves the needle. A corporate user marking you "not spam" doesn't retrain the filter. The gateway admin does. Cold B2B outreach at scale hits gateways, not humans, and needs to be tuned accordingly.

What actually changes for senders

If you're B2C: obsess over engagement signals, run a sunset policy, and segment aggressively. If you're B2B: get DMARC to p=reject, warm your domain for 30 days before cold outreach, and test against seed accounts at real corporate domains (not just your Gmail) before any big send.

If you send to both, you need two different monitoring setups. Running a free domain check across both environments is a good starting point, or grab time on the SOS hotline if you've never tested the corporate side.