The practices that matter most are the unglamorous ones: a list you are allowed to mail, a domain that proves the mail is yours, an unsubscribe that works in one click, flows triggered by what people do, and a measure tied to revenue. Everything else, subject lines, send times, design, sits on top of those.
This guide is part of our digital marketing guides. The store-specific flows are in ecommerce email marketing; the CRM the flows run from is covered in CRM implementation steps.
Consent and the law: CAN-SPAM in the United States
The FTC's compliance guide (August 2023, updated January 2024) sets out what the CAN-SPAM Act requires of commercial email: header information (From, To, Reply-To and routing) that is accurate and identifies who sent the message; subject lines that are not deceptive; a clear disclosure that the message is an advertisement; a valid physical postal address; a clear way to opt out of future marketing email, honoured within 10 business days, with the mechanism working for at least 30 days after sending; and no selling or transferring of opted-out addresses. Hiring another company to send does not shift responsibility: both the company whose product is promoted and the sender can be held liable.
Two points the guide makes are often missed. The Act has no exception for business-to-business email; a commercial message to a work address is covered. And each separate email in violation can carry a penalty of up to $53,088 at the figure set in January 2025 (16 CFR 1.98(d)). Transactional and relationship messages, such as order confirmations, are mostly exempt, but a message that mixes them with promotion is judged by its primary purpose.
Consent and the law: CASL in Canada
Canada's anti-spam legislation is stricter, because it requires consent before the first message. Section 6 of the Act (text current to 19 October 2026) prohibits sending a commercial electronic message unless the recipient has given express or implied consent, and requires the message to identify the sender and anyone on whose behalf it is sent, give a way to contact them, include an unsubscribe mechanism, and keep that contact information valid for at least 60 days.
Implied consent comes from an existing business relationship: section 10(10) counts a purchase or lease within the two-year period before the message, and an inquiry or application within the six-month period. Section 11 requires the unsubscribe to work at no cost, by the same or another practicable electronic means, and to be honoured no later than 10 business days after the request. The penalties, in section 20(4), run up to $1,000,000 per violation for an individual and $10,000,000 for any other person. For a company mailing both countries, the practical rule is to meet CASL everywhere: express consent recorded with its date and source, and implied consent tracked and expired.
Deliverability: what Gmail now requires
Being allowed to send is not the same as being delivered. Google's email sender guidelines (in force from 1 February 2024) set requirements for anyone sending to personal Gmail accounts, and most other mailbox providers now expect the same:
- All senders: SPF or DKIM authentication on the sending domain; valid forward and reverse DNS; TLS for transmission; a spam rate in Google Postmaster Tools below 0.3%; messages formatted to the RFC 5322 standard; no impersonation of Gmail in From headers.
- Bulk senders (more than 5,000 messages a day to Gmail accounts): SPF and DKIM plus a DMARC policy (which may be set to none), a From domain aligned with SPF or DKIM, a DKIM key of at least 1024 bits with 2048 recommended, and one-click unsubscribe in marketing messages using the List-Unsubscribe headers, with a clearly visible unsubscribe link in the body.
- The real target: Google recommends keeping the spam rate below 0.10% and never reaching 0.30%.
The list: build it, clean it, segment it
Four practices for the list itself:
- Build it from consent. Forms that say what people will receive and how often, with the consent, its date and its source stored in the CRM. No purchased or scraped lists, which fail both laws and Gmail's complaint threshold.
- Confirm where it matters. A confirmation email (double opt-in) costs a few sign-ups and saves the list from typos, bots and complaints; it is near-mandatory for Canadian lists.
- Clean it quarterly. Remove hard bounces at once, expire implied consent on the CASL clock, and stop mailing people who have not opened or clicked in a defined period after one re-engagement attempt.
- Segment by behavior and stage, not only by job title: new subscribers, buyers, lapsed buyers, people who downloaded a guide, people in a sales conversation. Each gets different mail.
Flows: the sequences that do the work
Flows are sequences triggered by what a person does, running without anyone pressing send. They carry most of email's results; the monthly newsletter is the smallest part. The six most companies need:
- Welcome: sent at once, says what to expect, delivers the thing promised, asks one question.
- Onboarding or education: three to five emails over a few weeks that teach the buyer's job and show the product doing it.
- Behavior follow-up: the abandoned cart for a store, the visited-pricing-page or downloaded-guide follow-up for B2B, sent within hours.
- Post-purchase or post-inquiry: confirmation, what happens next, the one thing to do, and a request for a review or a reply.
- Re-engagement: one honest email to people who have gone quiet, then removal if they stay quiet.
- Renewal or reorder: timed to the contract or the product's life, before the date, not after.
Content: one email, one job
Six practices for what goes in the email:
- One job per email. One message, one action, one link that matters. Three offers in one email get none clicked.
- Written for the segment and the moment. A new subscriber and a lapsed buyer should not receive the same words.
- A subject line that says what is inside, as CAN-SPAM requires and as people reward. No tricks, no fake replies, no fake forwards.
- A real sender. A named person's address that accepts replies, because replies are the most useful response an email gets.
- Plain and fast. Short, readable on a phone, light on images, with text that stands alone when images are blocked.
- Useful more often than promotional. The content a buyer thanks you for, drawn from the same work as your content marketing, earns the right to the occasional offer.
Testing and sending
Send a test to several mailbox providers before every campaign and check the rendering, the links, the unsubscribe and the plain-text version. Test one variable at a time, subject line or sender or call to action, with a sample planned in advance, and keep a log of results. Send when the segment reads, which your own data will show within a few campaigns, rather than at a time a blog recommended. Warm up a new domain or a new sending service gradually; a sudden jump in volume is what filters look for.
Measurement: what to watch
Open rates have been unreliable since mail clients began pre-loading images, and the law does not care how many opened. Measure instead: delivery and complaint rates in Postmaster Tools against Gmail's thresholds; unsubscribes per campaign; clicks and replies by segment; and, in the CRM, the inquiries, orders and revenue each flow and campaign produced, which is the number the business will ask for. Our guide to marketing KPIs for B2B companies puts email's numbers alongside the other channels. The table below gathers the rules and thresholds in one place.
Common email marketing mistakes
The faults we see most:
- Mailing a list of unclear origin. Fails CASL, risks CAN-SPAM penalties and drives complaints past Gmail's threshold.
- No authentication. Without SPF, DKIM and DMARC, bulk mail to Gmail is filtered whatever the content.
- One newsletter for everyone. No flows, no segments, no behavior; the channel's results stay small.
- Hidden or slow unsubscribe. Both laws require it to work; Gmail requires one click. A hard unsubscribe produces a spam complaint instead.
- No postal address or sender identity. Required by both laws and trusted by readers.
- Judging by open rate. Measure replies, clicks, inquiries and revenue.
Conclusion
Email marketing best practices start with permission and authentication: a list built from recorded consent and kept within the CAN-SPAM and CASL rules, a domain that proves the mail is yours and an unsubscribe that works in one click, as Gmail requires. On those foundations, flows triggered by behavior, one job per email written for a segment, and measurement in inquiries and revenue turn the channel most companies already own into the one that pays best.
PromotEdge International is an international strategy, technology, marketing and design company, and our delivery team is in India. Our email marketing service audits the list and the sending setup, fixes the foundations, builds the flows and plans the campaigns for B2B companies and online stores, and reports in inquiries and orders. This guide explains the rules as published; it is not legal advice, and a company unsure of its position should ask a lawyer in its market.
Facts we rely on: see our company facts for what we state about ourselves and where each fact comes from.