Publish a DMARC record this week or lose mail to Outlook, and turn off Meta Advantage offers before November twenty

Ziff Davis puts a number on the AI Overviews traffic hit

On its November 6 earnings call, Ziff Davis told investors that organic Google referrals to its properties fell roughly 37 percent year over year in Q3 2026, accelerating from a 23 percent drop the prior year. Management said it is not planning on a search recovery and is operating on the view that referrals keep coming down. Google's new AI impressions metric showed Ziff Davis content cited in AI Overviews and AI Mode responses about 2.7 billion times in the quarter, which is close to ten times the clicks those sites received from Search.

Who it hits: any founder or lean team whose pipeline depends on organic Google traffic to editorial, comparison, or how-to content. If a public company with Ziff Davis's SEO resources is down 37 percent, a small operator running the same playbook is exposed to the same curve and probably cannot see it clearly in GA4 alone.

The move this week, about 30 minutes: open Search Console, add the AI Overviews filter in the Performance report, and export the last 90 days of impressions, clicks, and queries where your pages appear inside AI features. Compare that to the same window last year. If the gap is directional, stop commissioning the next batch of top-of-funnel posts until you have decided which of those pages are worth rebuilding as reference pages the AI cites and which should be retired.

Ziff Davis says organic Google referrals fell about 37 percent (Search Engine Journal)Ziff Davis loses 37 percent of its Google search traffic in a year (PPC Land)Ziff Davis Q3 2026 earnings call transcript (Benzinga)

Microsoft is rejecting mail from domains without DMARC

Since around November 5, Outlook.com, Hotmail, Live, and MSN have started rejecting mail from sending domains that publish no DMARC record, including low-volume senders with valid SPF and DKIM. Bounced messages return error 550 5.7.1 with code AS9031519 stating the message lacks SPF, DKIM, or DMARC auth records. This is wider than Microsoft's existing published rule for senders over 5,000 messages a day, and as of November 9 Microsoft has not posted a service health entry or official cause. The rejections come from consumer MXes only; mail to corporate Microsoft 365 tenants is still accepted.

Who it hits: any founder, agency, or fractional CMO whose domain sends transactional mail, newsletters, invoices, password resets, or outbound sales to anyone on an outlook.com, hotmail.com, live.com, or msn.com address and has never set up DMARC. You will not see these in your ESP as opens going down. They are hard rejects, often silent to the recipient.

The move this week, about 20 minutes: pull your domain in a DMARC checker and confirm whether a record exists. If none, publish a single TXT record at _dmarc.yourdomain.com with the value v=DMARC1; p=none and a rua address you actually read. That one line is what Microsoft is currently checking for. Then send a test from your main sending domain to a personal outlook.com inbox and confirm delivery.

Microsoft newly rejecting mail lacking DMARC (SpamResource)Outlook rejecting email without DMARC, AS9031519 (MailRoute)Outlook.com is quietly rejecting email from domains without DMARC (TechBytes)

Meta's new ad terms shift AI mistakes to you on November 20

Meta pushed the start date of its revised Commercial Terms and Self-Serve Ad Terms from October 30 to November 20, 2026. A new AI Features section says the business is solely responsible for and assumes all risks from AI features and the content they produce. Separately, advisors have documented cases where Meta's AI automatically pulled discount offers from merchant websites and displayed them in Facebook and Instagram ads even when the option was turned off on the original ad, because Commerce Manager had offer detection enabled at the account level.

Who it hits: any advertiser running Advantage+ creative, especially ecommerce operators with Commerce Manager connected to a Shopify or similar storefront. After November 20, an AI-generated discount that cannibalizes margin or misstates a price is your liability, not Meta's.

The move this week, about 45 minutes: in Ads Manager, open each active Advantage+ campaign and turn off the creative enhancements you did not explicitly approve, particularly any that reference promotions or offers. In Commerce Manager, review whether automatic offer detection from your website is on and switch it off if you do not want Meta pulling prices or discounts from product pages into ads. Document the settings so you can audit them again after November 20.

Meta's AI ads included unapproved discounts (Social Media Today)Meta commercial and self-serve ad terms, AI advertiser liability November 20 2026 (ClickyClicks)Advertisers pull Meta ads that had unwanted AI glow-ups (Adweek)

FTC unseals Amazon Ads surcharge numbers

The FTC and state partners unsealed previously redacted portions of their August complaint against Amazon in the Western District of Washington. The new filing alleges Amazon secretly raised ad prices by as much as 50 percent above auction results on ordinary days and up to 250 percent on Prime Day and Black Friday, via undisclosed reserve prices in auctions Amazon described as second-price. The complaint cites a 20 percent average cost-per-click increase in the 2021 holiday season, with some advertisers over 200 percent, and alleges the practice generated more than 20 billion dollars across roughly 1.2 million advertising customers. It covers Sponsored Products, Sponsored Brands, and Sponsored Display.

Who it hits: any brand or agency that has run Sponsored Products, Brands, or Display on Amazon during Prime Day or Q4 sale events from 2018 forward. Amazon denies the allegations, but the unsealed numbers now give you a factual basis to quantify your own exposure before any potential remediation or opt-in window is announced.

The move this week, about 60 minutes: pull your Amazon Ads bulk reports for Prime Day weeks and Black Friday through Cyber Monday across the last three years. Calculate average CPC during the event versus the four weeks prior for the same campaigns. Save that file. If a class period or claims process emerges, you will want the pull already done, and the delta itself is useful input to how you budget 2027 peak events.

FTC unseals details in Amazon Ads auction surcharge suit (Search Engine Journal)New details emerge in Amazon Ads auction rigging case (FTC press release)FTC unredacted complaint says Amazon marked up ad prices as much as 250 percent (Shopifreaks)

Gmail is ending Send As for third-party addresses in January

Starting January 2027, Gmail will stop supporting Send As for third-party accounts, the feature that lets a free Gmail account send email from an @hotmail.com, @yahoo.com, or custom-domain address via external SMTP. Gmailify and the Check mail from other accounts POP fetch are also going away. Send As for Gmail addresses and Google Workspace aliases is unaffected. Google has said it will restrict new configurations before the January cutoff, so adding new Send As addresses may stop working sooner.

Who it hits: founders and freelancers who run a one-person operation out of a free Gmail inbox but send client-facing mail from a custom domain through SMTP. Also anyone whose contact form or support alias quietly routes through someone's personal Gmail. When this breaks, replies will either go out from a @gmail.com address the recipient does not recognize, or they will not go out at all.

The move this week, about 30 minutes: in Gmail settings, open Accounts and Import and list every Send As address not ending in @gmail.com or a Workspace domain. For each, decide whether to migrate the custom domain to Google Workspace (so the alias keeps working), move the inbox to a proper mail host, or route sending through a dedicated transactional provider. Put the chosen path on your December calendar; do not wait until January.

Gmail is shutting down Send As (SpamResource)Gmail killing third-party Send As feature (Android Authority)Gmail ends Send As for third-party addresses (Proton)

Shopify POS adds five local payment methods

On November 6, Shopify added support in POS for Alipay, WeChat Pay, Satispay, Scalapay, and GrabPay for in-person sales through Shopify Payments on eligible stores. Customers scan a QR code to pay. There is no additional integration; it toggles on in Payments settings in admin.

Who it hits: physical retail, pop-ups, market stalls, and event booths running on Shopify POS whose customers include tourists, international students, or diaspora shoppers used to paying with Alipay, WeChat Pay, or GrabPay at home. If someone walks up with a phone wallet you do not accept, the sale does not happen.

The move this week, about 15 minutes: in Shopify admin, open Settings, Payments, and check whether your store is eligible. Enable the methods that match your actual foot traffic rather than all five. Print or print-at-till a small sign noting which QR wallets you now accept, in the languages your customers read. Review takings after four weeks to see whether the methods are being used before expanding.

Accept five new local payment methods in store with Shopify Payments (Shopify Changelog)Shopify POS adds five local payment methods, what merchants should do next (PowerCommerce)Fall 26 edition for merchants (Shopify)

Brave sued over 30-billion-page index resold to AI

On November 2, the New York Times and three Tribune papers (the Daily News, Chicago Tribune, Orlando Sentinel) sued Brave Software in the Southern District of New York. The complaint alleges Brave built an index of more than 30 billion web pages using an undetectable crawler and resold access to AI developers through the Brave Search API. Brave's own About page lists Cohere, Mistral, Perplexity, and You.com as customers of that API. The AI companies are not named as defendants. Whether or not the suit succeeds, the practical fact is that your content is probably in the index.

Who it hits: any publisher, ecommerce brand, or services business whose site content represents competitive IP or whose licensing position with AI companies matters. Also any operator who has only blocked the well-known AI crawlers in robots.txt and assumed that was enough.

The move this week, about 20 minutes: in Google, run site:yourdomain.com on search.brave.com to confirm you are indexed. Then open Brave Search's help docs and submit the removal or exclusion form for the paths you do not want in the index. Note in your records that this is a separate workstream from robots.txt directives aimed at OpenAI, Anthropic, or Google-Extended; blocking those bots does not affect Brave.

Brave sells its search index to AI, and your website is probably in it (Search Engine Journal)NYT and Tribune papers sue Brave over 30B page AI scraping index (AI Weekly)What the Brave lawsuit says about AI (Plagiarism Today)

One housekeeping note: November GSC click spikes are bots

Between October 31 and November 2, multiple sites saw Search Console clicks jump 2x to 6.5x with impressions and rankings flat, desktop CTR going from about 0.20 percent to 2.89 percent while mobile stayed normal. Google has not posted an entry on its Data Anomalies page. The practical read is that these are automated fetches, not humans. Any operator using the last two weeks of GSC clicks to justify a content bet, a redesign, or a budget shift this week should annotate those dates, exclude them from period-on-period comparisons, and cross-check against GA4 organic landing-page sessions for the same hours before drawing a conclusion. Ten minutes, and it prevents a bad call made on a chart that looks like a win.

November click spikes in Google Search Console are bot traffic (Search Engine Journal)Google Search Console showing big spikes in clicks (Search Engine Roundtable)

Checked, and quiet

TikTok's end-of-year gaming and app promo guides, YouTube's custom feeds expansion, Meta's Muse updates, and Reddit's financial services pitch all landed this week but did not change anything an operator must act on in the next seven days. We will pick them up if a measurable consequence appears.