Email 101: permission, the inbox and the rules that guard it

Email marketing is sending messages to people who have given you their address, and their permission, to hear from you. The list is the company's own asset: no feed algorithm decides who sees a message. But the mailbox providers (Gmail, Yahoo, Outlook and others) decide whether it lands in the inbox, the spam folder or nowhere at all.

• What it is: newsletters, offers, onboarding and lifecycle messages sent to an opt-in list.
• Who runs it: the sender, usually through an email platform; the mailbox providers set the technical rules for reaching their users¹⁴⁵.
• Who may start the conversation: the business, within each country's consent rules⁸⁹¹².
• How it is priced: you pay for a platform, for sending and for people; Amazon SES, for example, lists outbound email at $0.10 per 1,000 messages à la carte¹⁶.
• Best for: retention and loyalty, conversion and nurturing leads.
• Weak for: reaching people who do not know you yet. Bought lists are not a shortcut: the UK regulator says no third-party list can meet its "soft opt-in" rule¹¹.
• As of: October 2026.

Three things decide whether an email works: permission, delivery and relevance.

Permission. A person gives an address and agrees to receive messages. With double opt-in, they then confirm by clicking a link in a first email, which shows that the address is real and theirs. Not every law demands it, but Canada's anti-spam law puts the burden of proving consent on the sender¹², and a confirmed, timestamped record is the simplest proof.

Delivery. Before a message reaches anyone, the receiving mailbox provider checks who sent it. Three standards published in the domain name system (DNS), known together as email authentication, carry that proof: SPF lists the servers allowed to send for a domain, DKIM adds a cryptographic signature, and DMARC uses both results, checks that the authenticated domain matches the visible "From" address and tells receivers what to do with mail that fails⁷. Google requires every sender to Gmail to use SPF or DKIM, and bulk senders to use all three¹. Reputation then decides the rest: Google asks senders to keep the spam rate reported by users below 0.1% and never to let it reach 0.3%². Together this is deliverability.

Relevance. Once delivered, a message works if it suits its reader. Segmentation splits the list by what people bought, read or asked for. Marketing automation sends a message when something happens: a welcome after sign-up, a reminder after an abandoned basket, a renewal notice before a contract ends. Both run on first-party data, what people have told you or done with you, often held in a CRM.

The way out. Every marketing email needs one. RFC 8058, an Internet standard published in January 2017, defines a one-click unsubscribe: the sender adds a "List-Unsubscribe-Post" header, the message carries a DKIM signature covering it, and the mail app removes the reader with a single secure web request, without opening a page⁶. Gmail and Yahoo now expect it from bulk senders¹⁴, and Google says a mailto link in the body of the message does not meet the requirement².

Two kinds of rule-makers shaped email marketing: lawmakers and mailbox providers. The EU's ePrivacy Directive of July 2002 made prior consent the rule for email marketing to individuals⁹. The US CAN-SPAM Act of 2003 chose an opt-out model instead⁸. Canada's anti-spam law, CASL, brought its consent rules into force on 1 July 2014¹³.

The technical rules came from the industry. DMARC was published as RFC 7489 in March 2015⁷ and one-click unsubscribe as RFC 8058 in January 2017⁶. In October 2023 Google announced that bulk senders to Gmail would have to authenticate their mail, make unsubscribing easy and stay under a spam threshold³; the rules took effect in February 2024². Microsoft set similar requirements for Outlook.com consumer addresses from May 2025⁵, and from November 2025 Google began ramping up enforcement, with temporary and permanent rejections of mail that does not comply².

Email works in every market, but the rules on who may receive marketing differ by country, and the mailbox providers' requirements sit on top of them for anyone who sends to their users. Google's guidelines, for example, govern mail sent to personal Gmail accounts².

• Americas. In the United States, CAN-SPAM lets a business send marketing email without prior consent but requires a working opt-out honoured within 10 business days and a valid postal address; it covers business-to-business email too, and each violating email can cost up to $53,088⁸. Canada's CASL requires consent, identification of the sender and a working unsubscribe mechanism; consent can be express, or implied only in the situations the law lists, such as an existing business relationship¹²¹³.
• Europe. The ePrivacy Directive requires prior consent for email marketing to individuals, with an exception for a company's own customers and its similar products, provided they can object free of charge in every message⁹. In France the CNIL recommends an unticked box, says that accepting general terms is not consent, and allows business addresses to be contacted with a simple right to object when the message relates to the person's job¹⁰. In the UK, the "soft opt-in" covers customers whose details were collected directly in a sale or negotiation, for similar products, with an opt-out at collection and in every message¹¹.
• Middle East, Africa and Asia-Pacific. Apply each country's own data-protection and anti-spam law; the Gmail, Yahoo and Outlook requirements apply to any sender who reaches their users¹⁴⁵. The Gulf's sender rules for text messages are covered in Messaging 101.

• Retention and loyalty: newsletters, member news, renewal and replenishment reminders, the core of CRM and loyalty programmes in retail and e-commerce and financial services.
• Conversion: launches, offers and abandoned-basket reminders, timed by automation.
• Lead generation: nurture sequences that turn a download or a webinar sign-up into a sales conversation, common in B2B software and professional services.
• Event promotion: invitations, reminders and follow-ups.
• Thought leadership: a newsletter that carries the brand's best content to people who asked for it.

Email has three costs: the platform, the sending and the people.

• The platform. Email platforms price by contacts held, by messages sent, by seats or by plan; compare them on the size of list you expect in a year, not today.
• The sending. Infrastructure is cheap per message. Amazon SES lists outbound email at $0.10 per 1,000 messages à la carte, plus $0.12 per gigabyte of attachments, and its Essentials plan charges $0.16 per 1,000 for the first 10 million messages a month¹⁶. From 21 July 2026 new SES accounts start on that plan, and its old free tier of 3,000 messages a month is closed to new customers¹⁷.
• The people. Writing, design, data, testing and deliverability work cost far more than the sending. Budget for them first.

The cost that does not appear on an invoice is reputation. A Gmail bulk sender whose user-reported spam rate goes above 0.3% loses eligibility for mitigation², so a careless campaign can cost the deliverability of every campaign after it.

This is a summary, not legal advice. Two layers apply at once: the law of the recipient's country and the rules of the mailbox provider.

The mailbox providers. Google treats anyone who sends about 5,000 messages or more a day to personal Gmail accounts as a bulk sender, counts all mail from the same primary domain, and keeps that status once it has been reached². Bulk senders need SPF, DKIM and DMARC, a "From" domain aligned with the authenticated one, and one-click unsubscribe for promotional mail¹. Yahoo asks for a one-click List-Unsubscribe header, a spam rate below 0.3%, valid forward and reverse DNS and a published DMARC policy⁴. Microsoft requires senders of 5,000 or more messages to its consumer services to pass SPF and DKIM and to publish DMARC, with p=none as the minimum policy⁵.

The law. In the United States, CAN-SPAM requires accurate header information, subject lines that match the content, a clear statement that the message is an advertisement, a valid postal address and an opt-out that keeps working for at least 30 days after sending; hiring an agency or platform does not transfer the responsibility⁸. Messages whose main purpose is transactional, such as an order confirmation, are largely exempt, and the FTC reads that category narrowly⁸. In the EU, marketing messages must never disguise the sender and must give a valid address for opting out⁹; the CNIL adds that each message must identify the advertiser and offer a simple way to unsubscribe¹⁰. In Canada, express consent does not expire but can be withdrawn at any time¹². The UK added a soft opt-in for charitable purposes on 5 February 2026, usable only for details collected from that date¹¹.

Treat the list as personal data under the GDPR or your local law: record when, where and for what each person said yes, and use a consent management tool if you collect consent in many places.

• Opens no longer mean reading. Apple's Mail Privacy Protection downloads remote content in the background by default, whether or not the person engages with the email¹⁴, which stops senders knowing whether a message was opened and hides the reader's IP address¹⁵. An open rate now flatters; use click-through rate, sales and holdout tests instead.
• Bought lists backfire. They fail the UK's soft opt-in by definition¹¹, and complaints from people who never signed up push the spam rate towards the 0.3% ceiling².
• A broken way out. A mailto link in the body does not count as one-click unsubscribe for Gmail², and RFC 8058 only works when the DKIM signature covers the unsubscribe headers⁶.
• Bulk status is permanent. Once a domain crosses Gmail's bulk threshold, it stays a bulk sender²; set up authentication before the big campaign, not after.
• Mailing everyone, every time. People who stopped reading still receive, and some of them complain. Prune inactive addresses and test frequency with A/B tests.

• Stricter enforcement. Gmail has been ramping up enforcement since November 2025, including temporary and permanent rejections², and Microsoft decided to reject non-compliant mail rather than send it to the junk folder⁵.
• A revised DMARC. The RFC Editor lists RFC 7489 as obsoleted by RFC 9989, a revised DMARC specification⁷; check your provider's support for it.
• Moving rules. The UK's charitable soft opt-in has applied since 5 February 2026¹¹.
• New price lists. Sending services are changing their plans, as Amazon SES did in July 2026¹⁷.

Choose email when you have, or can earn, permission, and the goal is to keep a relationship going: retention, repeat purchase, nurture. Pair it with the disciplines that bring new people to the sign-up, such as content and search, and with messaging for what is urgent. Measure it with the methods in measuring effectiveness. See the email discipline page and which mix for which objective.