Email: deliverability, consent, unsubscribe

Deliverability is an email’s ability to reach the inbox, not spam. SPF, DKIM and DMARC records vouch for it. A mailing needs consent and an unsubscribe.

The email nobody saw

In the last lesson you described a flow of three messages. It works only if the emails reach people and stay within the rules. Deliverability first: an email travels from your service through the recipient’s server into the inbox, and at every step the mail system decides whether to trust it. There are a great many spammers, so the checks are strict. Emails that fail them land in spam, and if a domain misbehaves badly enough, its emails stop arriving at all.

Email was invented before the web, and for a long time anyone could sign an email with someone else’s address. So the checks were added later, as records in DNS (you met them in the part on the internet: a TXT record holds free text about a domain). Three records for email became the standard.

Three signatures of a domain

Picture an email as a parcel. The recipient wants to know three things: is it really from this sender, was it opened on the way, and what to do if something is wrong.

• SPF (Sender Policy Framework) answers “who may send email on behalf of this domain”. The domain publishes a list of servers and mailing services. If an email comes from a server not on the list, it isn’t trusted.
• DKIM (DomainKeys Identified Mail) answers “was the email forged”. The service signs the email with a secret key, and the public key sits in DNS. The recipient checks the signature: if it matches, the email wasn’t changed and was really sent from the domain.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) answers “what to do if the check fails”. The domain asks the recipient to do nothing (none, just send reports), to put the email in spam (quarantine) or to reject it (reject).

This is how they look in a domain’s DNS (the addresses are invented):

riverbend.example.                  TXT  "v=spf1 include:_spf.sender.example ~all"
mail._domainkey.riverbend.example.  TXT  "v=DKIM1; k=rsa; p=MIGfMA0GCSq..."
_dmarc.riverbend.example.           TXT  "v=DMARC1; p=none; rua=mailto:reports@riverbend.example"

You don’t need to write these lines by hand: the mailing service shows the values to add at your registrar or host (you made DNS records in the lesson on them). Start with p=none, read the reports, and tighten later.

Where it comes from. SPF, DKIM and DMARC are described as internet standards (RFC 7208, RFC 6376 and RFC 7489). For a long time they were a recommendation. Since February 2024 Google requires all senders to Gmail to set up SPF or DKIM, and a sender of more than 5,000 messages a day to have SPF, DKIM and DMARC and to offer a one-click unsubscribe, which RFC 8058 describes. Yahoo announced similar rules for bulk senders. Google also asks senders to keep the share of messages reported as spam below 0.10% and never let it reach 0.30%.

Open the diagram. It is a teaching model: it shows how each step adds to or takes away from the trust in an email. Switch everything on and see where the email lands, then spoil one item at a time on purpose.

What you set up

SPF DKIM DMARC The address was confirmed by a link in an email One-click unsubscribe

What you did not do

You bought a list of addresses The subject promises what the email lacks

Trust: 20 out of 100. The email will land in: Rejected: the domain has neither SPF nor DKIM, so the email failed the check.

• no: SPF: the domain listed who may send email on its behalf
• no: DKIM: the email is signed and the signature checks out
• no: DMARC: the domain said what to do if the check fails
• no: The address was confirmed by the person (double opt-in)
• no: Unsubscribing takes one click
• yes: The addresses were collected with consent, not bought
• yes: The subject honestly describes the email

This is a teaching model. Real mail services weigh hundreds of signals, including readers’ complaints, and don’t publish exactly how. But the direction is the same: the domain’s signatures, consent and honesty.

Check yourself: what do SPF and DKIM each vouch for, and how do they differ?

SPF checks that the email came from an allowed server. DKIM checks that the email is signed and wasn’t changed. The first looks at the sender, the second at the email itself.

The list of addresses: where it comes from

Even with perfect records you can ruin your reputation with a list.

• Double opt-in. The person enters an address in the form, gets an email with a “confirm” link, and joins the list only after clicking it. That keeps out strangers’ addresses, mistyped ones and sign-ups “for a friend”. Many services offer it as a setting, and in some countries, Germany among them, it has become the usual way to prove consent.
• No bought lists. Those people don’t know you and never agreed. Spam complaints are inevitable.
• Cleaning. If a person hasn’t opened or clicked anything for six months, ask them one last time (“do you still want these emails?”) and remove them if they don’t answer.
• Complaints. If more than one person in a thousand complains, that is already a warning sign. Large mail services today give an acceptable complaint rate in tenths of a percent.

Consent and unsubscribe: a guideline, not legal advice

What follows is how lawyers commonly read the rules. We don’t know the details of your project, so before launch show the form and the privacy notice to a lawyer.

• The US. The CAN-SPAM Act doesn’t make you collect consent before marketing email, but it does ask for an accurate sender and subject line, a real postal address of the sender, and a clear way to opt out, honored within ten business days. Selling or transferring the addresses of people who opted out is not allowed. Some states add privacy-law duties: California’s law, for example, asks you to say at the point of collection what you collect and why, and to honor a person’s opt-out of the sale or sharing of their data.
• The UK and the EU. Marketing email to individuals needs prior consent, apart from the narrow soft opt-in for existing customers (PECR regulation 22 in the UK, Article 13 of the ePrivacy Directive in the EU). Under the GDPR the consent must be freely given, specific, informed and unambiguous, shown by a clear affirmative act. A pre-checked box doesn’t count (GDPR Article 4(11) and Recital 32), and a person may object to direct marketing at any time (Article 21).
• Two consents. One: “process my email address so you can send me this email”. The other: “send me news”. Don’t glue them into one phrase and don’t checkboxes for the person: it is weak ground, and it is also a dark pattern (the lesson on the limits of persuasion).
• Service emails. A booking confirmation or a reminder of a consultation to a person who booked is, as a general rule, not marketing. But adding “and also, a new service” to the same email turns it into marketing. Better to keep them apart.
• Other countries. Canada’s anti-spam law (CASL) asks for express or implied consent and a working unsubscribe, and many other countries have their own rules. If your subscribers live somewhere, read that place’s rules.

This is general information, not legal advice. For a real mailing ask a lawyer or the regulator: the FTC in the US, the ICO in the UK, your national data protection authority in the EU. For comparison, Russia’s advertising law (Article 18 of 38-FZ) also requires the recipient’s prior consent to advertising by email, and the sender has to be able to prove it.

What a good welcome email looks like

The first email is read better than any later one, so give it time. It should have four things (you put them in the form “who, why, what next, how to unsubscribe”):

1. Who it is from. A name of a person or project the subscriber will recognize. Not “noreply”.
2. Why it arrived. One sentence: “You subscribed to emails from… on our site”.
3. What happens next. How often you’ll write, and about what. That is a promise, and it has to be kept.
4. How to unsubscribe. A visible link. An unsubscribe hidden in small print doesn’t add subscribers, only complaints.

The subject is honest: it describes the email and uses no pressure techniques (in the lessons on influence you saw how they end). Good: “You’ve subscribed: what happens next and how to unsubscribe”. Bad: “URGENT!!! Today only”.

Take the tone from the brief (the “tone” field) and the language from the “languages” field. A bilingual project writes the email in the subscriber’s language, and the form remembers which language the person chose. Don’t trust machine translation of legal texts (policies, consents) without a person checking it.

Length. For a first email 80 to 120 words is enough. Longer ones are read less.

Practice

You’re working on the page with the subscription.

1. Fix the form. Replace the one box “I agree to everything” with two. The first: consent to processing the email address, with a link to the privacy notice, required. The second: consent to receiving news, optional. Neither is checked in advance, and every field has a label.
2. Write the welcome email in the note: who it is from, a subject, and a text of 80 to 120 words with a link to the main action and an “Unsubscribe” link. If the brief includes Russian, add a Russian version.

The check looks at the form: two empty boxes, only one required, a link to the policy, labels; and at the email: subject, length, links. Whether your email is honest is for you to decide. Reread it through the eyes of a person from “for whom”: is it clear to them why the email arrived?