Email Marketing for Small Businesses: Deliverability, CAN-SPAM and a Simple Plan That Works

Is email marketing still worth it for a small business?

Yes, for most small businesses. Email reaches people who already know you, costs little per message and is a channel you control. Social media reach can change overnight with an algorithm update, and advertising stops when the budget does. Your email list stays yours.

It suits businesses with repeat or considered purchases: a dental practice reminding patients about cleanings, an HVAC company offering seasonal tune-ups, a boutique announcing new arrivals, a B2B consultancy sharing useful insights with prospects over a long sales cycle, an online store bringing back past buyers.

But email has changed. Gmail and Yahoo introduced stricter sender requirements in 2024, and many small businesses now find their messages going to spam without knowing why. This guide covers the technical setup that keeps you in the inbox, the legal rules in the United States, and a simple plan for what to send.

What are SPF, DKIM and DMARC, in plain English?

They are three records you add to your domain's DNS settings so that mailbox providers can tell your real emails from fakes.

SPF (Sender Policy Framework) lists which servers are allowed to send email for your domain, such as Google Workspace, Microsoft 365 and your email marketing platform. DKIM (DomainKeys Identified Mail) adds a digital signature to each email, proving it was not altered and really came from your domain. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when an email fails those checks, and sends you reports about who is sending in your name.

Together they protect your reputation and your customers. Without them, anyone can send email pretending to be your business, and your genuine emails are more likely to be filtered. Your email platform and your domain host each provide instructions; Google's help page on setting up DMARC walks through the steps for Google Workspace users.

• SPF: which servers may send for your domain.
• DKIM: a signature proving the email is genuine.
• DMARC: what to do with failures, plus reports.

What do Gmail and Yahoo require from senders now?

Since February 1, 2024, Google's email sender guidelines require all senders to personal Gmail accounts to set up SPF or DKIM, use valid forward and reverse DNS, send over a secure TLS connection and keep spam rates reported in Postmaster Tools below 0.3%. Google recommends keeping it below 0.1%.

Bulk senders, which Google defines as those sending more than 5,000 messages a day to Gmail accounts, must also set up SPF, DKIM and DMARC, align the From domain with the SPF or DKIM domain, and support one-click unsubscribe in marketing messages using the standard List-Unsubscribe headers.

Yahoo's sender best practices are very similar: SPF or DKIM for all senders, a spam rate below 0.3%, and for bulk senders SPF, DKIM, a DMARC policy of at least p=none, a working one-click unsubscribe, a visible unsubscribe link in the body, and honoring unsubscribe requests within 2 days.

Most small businesses are not bulk senders, but following the bulk rules anyway is the simplest way to stay in the inbox as you grow. Reputable email marketing platforms handle one-click unsubscribe automatically; the domain records are your job.

A real example: what we found on our own domain

While writing this guide, we checked our own domain, quaventotechnologies.com, with a simple DNS lookup. It has an SPF record that authorizes Google Workspace to send our email, and its mail is handled by Google. But it had no DMARC record. That means mailbox providers had no published instruction for emails that fail authentication, and we were not receiving reports about anyone sending in our name.

It is a common gap. Many businesses set up email years ago, before DMARC mattered to everyday senders, and never revisited it. Adding a DMARC record starting with a policy of p=none, which collects reports without blocking anything, is a low-risk first step; once the reports show that all legitimate mail passes, the policy can be tightened.

You can check your own domain the same way. Many free DNS lookup tools show your SPF and DMARC records, and your email platform's setup page usually shows whether DKIM is active. If any are missing, fix them before your next campaign.

What does CAN-SPAM require?

The CAN-SPAM Act sets the rules for commercial email in the United States. The FTC's compliance guide summarizes the main requirements: do not use false or misleading header information; do not use deceptive subject lines; identify the message as an ad; tell recipients where you are located with a valid physical postal address; tell recipients how to opt out of future marketing email and make it easy; honor opt-out requests within 10 business days; and monitor what others are doing on your behalf, because you remain responsible if an agency or platform sends for you.

Penalties are significant. The FTC states that each separate email in violation of the law can be subject to penalties of up to $53,088.

CAN-SPAM does not require prior consent for commercial email, but mailbox providers effectively do, because unwanted email gets marked as spam and drags down your deliverability. Text messages are a different matter: the Telephone Consumer Protection Act requires prior consent for many automated marketing texts. Your legal adviser confirms how the rules apply to you.

• Truthful From, To and Reply-To information.
• Subject lines that match the content.
• A valid physical postal address in every email.
• A clear, easy opt-out, honored within 10 business days.
• Responsibility for anyone sending on your behalf.

How do you build an email list the right way?

Ask people who already like you. Customers at checkout or after a service visit, visitors to your website who want a useful guide, attendees at an event, and people who enquire are all candidates, as long as they agree to receive your emails.

Give a clear reason to sign up: a monthly tip, early access to new products, a seasonal maintenance reminder, a useful checklist. Say what they will get and how often. A sign-up form on your website, a checkbox on your booking or checkout form, and a QR code at your counter are simple starting points.

Never buy or rent lists. Purchased addresses have not agreed to hear from you, many are outdated, and some are spam traps that mailbox providers use to identify bad senders. One campaign to a bought list can damage your domain reputation for months.

What should a small business actually send?

Fewer, better emails. A small business can get most of the value from a handful of email types.

A welcome email when someone joins, thanking them, saying what to expect and offering one useful thing. A follow-up after an enquiry or purchase, answering likely questions and making the next step easy. A monthly newsletter with one or two genuinely useful items, such as a seasonal tip, a short case story, a new service or a reminder. Reminders tied to the customer's situation, such as an annual service, a renewal or a reorder. Occasional offers, used sparingly, so they mean something.

Write like a person, not a brochure. Use a real name in the From line, a clear subject line that tells the reader what is inside, a short body with one main message and one clear call to action. Make sure it reads well on a phone, where most email is opened.

• Welcome email for new subscribers.
• Follow-up after enquiries and purchases.
• A short monthly newsletter.
• Reminders for service, renewal or reorder.
• Occasional, meaningful offers.

A worked example: a simple plan for a local service business

Here is how a typical local business might put this together. The business and figures are illustrative, not a client case.

Imagine a heating and cooling company with 2,000 past customers who agreed at booking to receive emails. In month one it authenticates its domain, sets up its email platform and sends a welcome-style email to past customers explaining what they will receive. Each month it sends one short newsletter with a seasonal tip and a reminder to book maintenance. Customers whose last service was about a year ago get an automatic reminder email with a booking link.

If the monthly newsletter is clicked by a few percent of recipients and the service reminders bring in a steady stream of maintenance bookings, email becomes one of the cheapest sources of repeat work the business has. The figures here are invented to show the approach; your results depend on your customers, timing and content. Our marketing automation workflows page explains how reminders like these are set up.

How do you measure email marketing?

By what people do after opening. Open rates have become unreliable as a single measure, because some email apps load images automatically and record opens that did not happen. Clicks, replies, bookings, purchases and unsubscribes tell you more.

Track links with campaign tags so that visits and conversions from email appear in Google Analytics. For a service business, count bookings and calls that came from email. For an online store, count revenue by campaign. Watch spam complaints and unsubscribes after each send: a spike tells you the content, frequency or audience was wrong.

Check Postmaster Tools monthly for your spam rate and domain reputation. If deliverability drops, review authentication, list quality and how often you send before blaming the content.

Getting started this month

Check your domain for SPF, DKIM and DMARC and fix what is missing. Choose an email platform that handles one-click unsubscribe and includes your postal address in the footer. Import only contacts who agreed to hear from you. Write a welcome email and one newsletter. Set up one automatic reminder that fits your business. Then send, measure and improve.

If you would like help setting up email marketing properly, from domain authentication to automated reminders, our email marketing services for US businesses page explains how we work. We work remotely from Pune, India, with calls in US business hours, and we never send to bought lists. Tell us about your business through the contact page. For the website side of turning email clicks into enquiries, see our guide to Core Web Vitals for small business websites.