Rules
Part of Startup email marketing: permission before automation
9 startup email marketing checks before signing off
Startup email marketing checklist for 2027 covers list provenance, authentication, accessible content, automation controls, withdrawal, and business measurement.
What to take away
- Nine checks cover audience authority, legal basis, authentication, content, accessibility, unsubscribe behavior, automation, evidence, and monitoring.
- Two are hard gates. Google's published rules require SPF or DKIM on all mail, DMARC and one-click unsubscribe at 5,000 messages a day, and a spam rate under 0.3 percent.
- United States rules are opt-out, Canadian rules are opt-in, and state privacy laws plus GDPR add further duties.
- Nothing ships until one named approver can explain why every address on the list is there.
Run these nine checks in order and a weak campaign stays off the wire. Each leaves a record a reviewer can read without asking you anything. Permission records that precede automation come first, because no template fixes a list you cannot defend.
The nine checks in order
- Audience authority.Classify message type, recipient relationship, collection source, displayed wording, timestamp, and business purpose. Exclude withdrawals, complaints, invalid addresses, and unsupported imports.
- Legal basis by market.Name the governing rule: CAN-SPAM in the United States, CASL in Canada, PIPEDA for personal data, plus state laws and GDPR where those residents are on the list.
- Sender authentication.Inventory every sending domain and subdomain. Confirm SPF, DKIM, DMARC alignment, TLS, and return-path before you schedule.
- Content accuracy.Check sender name, reply route, subject, preview text, prices, dates, inventory, codes, links, and dynamic fallbacks.
- Accessibility.Run the Section508 email checklist over structure, contrast, link labels, image alternatives, plain text, and keyboard use.
- Unsubscribe and suppression.Test the body link, the one-click header, the preference center, and propagation into the CRM and ad audiences.
- Automation behavior.Confirm entry rules, delays, frequency caps, exits, re-entry, duplicate handling, and who can pause the journey.
- Evidence and approval.Archive the audience rule, template version, test output, sender configuration, schedule, and approver name.
- Post-send monitoring.Watch bounces, complaints, replies, and withdrawals for the first 24 hours. Pause on anything unexpected.
Gmail thresholds and sender authentication
Google's sender guidelines apply to mail sent to personal Gmail accounts. Since February 2024 every sender needs SPF or DKIM. Bulk senders, defined as 5,000 or more messages a day to Gmail addresses, also need DMARC and one-click unsubscribe in the message header. The DNS records that satisfy those checks are set out in authenticated sending that replaces guesswork.
Spam rates are measured in Postmaster Tools. Google's published limit is 0.3 percent. The recommended target is 0.1 percent. A spike needs investigation before the next send, not after it.
Tooling helps. MXToolbox checks SPF and DMARC lookups. Mail Tester and GlockApps check inbox placement. Litmus and Email on Acid check rendering.
Consent rules and their citations
The FTC's CAN-SPAM compliance guide sets the United States baseline. Headers must be accurate and subject lines must not deceive. The message needs a valid postal address, and opt-outs must be honored within 10 business days.
Canada runs the other way. CASL requires consent before the message, express or implied, plus sender identification and a working unsubscribe honored within 10 business days. Record the date, method, and exact wording.
State privacy laws such as the CCPA and CPRA add access and deletion duties. GDPR consent must be freely given, specific, informed, and unambiguous. PIPEDA governs personal information held in Canada. New markets raise the same questions every time, and the recurring email marketing questions save a reviewer briefing.
Exclude withdrawn, complained, and invalid addresses before the send rather than during it.
Audience and authority checks
- Classify message, recipient, purpose, outcome
- Confirm address source and collection wording
- Review consent, identification, unsubscribe by market
- Exclude withdrawals, complaints, invalid records
- Exclude unsupported imports and out-of-scope recipients
Accessibility and unsubscribe behavior
The Section508 email checklist covers reading order, descriptive link labels, subject lines, contrast, tables, attachments, and saved formats. Test with images blocked, in dark mode, at 200 percent zoom, and on a narrow screen.
Unsubscribe needs its own test pass. Send to live Gmail, Yahoo, and Outlook mailboxes, then click the link. Confirm the address leaves every connected system within minutes, including retargeting audiences.
Example gate record for a launch send
Example gate record
| Check | Evidence kept | Send stops when |
|---|---|---|
| Audience | Source, consent wording, export date | A sample record cannot be explained |
| Legal basis | Market-to-rule mapping | No lawful basis for a segment |
| Authentication | SPF, DKIM, and DMARC test output | Alignment fails on any sender |
| Content | Rendered proofs, link check | A price or date is wrong |
| Accessibility | Completed access checklist | Core content fails a screen reader |
| Exit | Suppression test log | Any system keeps sending |
| Automation | Journey map, pause owner | Duplicate or late events appear |
| Evidence | Template version, approver name | No named approver |
| Monitoring | First 24 hours of metrics | Spam rate passes 0.3 percent |
A 12,000-address product launch. Audience: trial users who opted in on the pricing page between 1 March and 30 April, exported 14 May, with the checkbox wording attached. Legal basis: CAN-SPAM opt-out, plus 41 Canadian addresses split into a separate CASL campaign.
Authentication: SPF and DKIM pass, DMARC at p=quarantine, alignment pass. Exit: unsubscribe tested in three clients, then removed from the CRM and the ad audience in four minutes. Approved 15 May for a 16 May 09:00 ET send.
At 24 hours the complaint rate was 0.04 percent with two bounces, so no pause. Open rates matter least here, since they count opens as if they were people.
