Module 2: Foundations
None of the revenue work matters if the emails land in spam. This module covers the three foundations everything else stands on: deliverability (can you reach the inbox), list health (is the list worth reaching), and permission (are you allowed to be there at all). Plain words, no engineering degree required.
Deliverability in plain words: SPF, DKIM, DMARC, and warming
Deliverability answers one question: when you hit send, does the email land in the inbox or the spam folder? Inbox providers like Gmail decide per sender, per send, based on identity and reputation. Identity comes first, and it’s three DNS records your ESP walks you through adding to the domain. SPF is the guest list: it names which services are allowed to send mail for your domain. DKIM is the wax seal: every message gets signed, so the receiver can confirm it really came from you and wasn’t altered on the way. DMARC is the instruction card: it tells receivers what to do when a message fails those checks — watch it, quarantine it, or reject it.
Reputation is the second half, and it’s earned on every send. Providers watch whether people open, click, and reply — or delete without reading, mark spam, and unsubscribe in clusters. High engagement compounds into better placement; complaints and bounces compound into the spam folder. This is why a brand’s “email stopped working” problem is usually a reputation problem wearing a trench coat, and why the fix in the next two lessons — list health and permission — matters more than any subject line trick.
Finally, warming. A brand-new sending domain has no reputation at all, and inbox providers treat a sudden flood from a stranger as suspicious. So you ramp: authenticate first, then send to the most engaged slice of the list — people who opened recently — and widen the audience over two to four weeks as the replies, clicks, and opens teach the providers this sender is welcome. Skip the ramp and your launch sale lands in spam for the exact customers most likely to buy. Set authentication and warm properly once, and every module after this one gets easier.
A client just moved to a new sending domain. They want tomorrow’s big sale announcement to go to all 30,000 contacts at once. What’s your call?
List health: hygiene habits and the sunset policy
A list is not a pile of addresses; it’s a living asset that decays. People change jobs, abandon inboxes, lose interest. Roughly a slice of any list goes stale every year whether you touch it or not, so list health is a habit, not a project. The routine: hard bounces come off immediately (the address doesn’t exist — mailing it again only signals carelessness). Spam complaints get watched like a fuel gauge; a rising complaint rate is the earliest warning that your targeting or your promises are off. And the chronically unengaged get a defined path instead of endless sends.
That path is the sunset policy. Pick a window — no opens or clicks in 90 to 120 days is a common line for an active brand — and everyone past it enters a short sunset flow: two or three emails that say, plainly, “still want these?” Whoever engages stays. Whoever doesn’t gets suppressed: not deleted, just never mailed again unless they re-opt in. Module 3 builds that flow; this lesson is about why the policy exists and why you defend it when an owner pushes back.
Because they will push back. “We paid for those addresses” is the sentence every email marketer hears. The math answers it: engagement rates are the signals inbox providers use to place your mail, so the dead 40% of a list doesn’t just underperform — it actively drags the live 60% toward the spam folder. A smaller, engaged list produces more revenue per recipient, cleaner test results, and better placement on every send. You are not shrinking the asset. You are removing the part of it that was taxing the rest.
A brand’s list has 50,000 subscribers, but 40% haven’t opened or clicked in over a year, and inbox placement is slipping. The owner refuses to remove anyone: “We paid good money for those addresses.” What’s the professional move?
Permission and compliance basics
Everything in this course rests on one rule: you email people who opted in. They typed their address into a form, checked a box at checkout, or otherwise said yes on purpose. Purchased lists, rented lists, and addresses scraped off websites are out — not as a matter of taste, but because permission is the foundation deliverability is built on, and because the major anti-spam laws and every ESP’s terms are built around consent. If a client’s list can’t answer the question “where did these people sign up?”, that’s the first problem you fix, before any flow or campaign.
The working rules of a legitimate send are short enough to memorize. Every marketing email carries a working unsubscribe, and opting out actually stops the emails — promptly, without a login wall or a scavenger hunt. Subject lines tell the truth: no fake “Re:” threads you were never part of, no “your order has shipped” on a sale announcement, no fake security alerts. The sender is identifiable, and the business puts a real postal address in the footer. None of this is decoration; inbox providers and regulators read these signals as the difference between a business and a spammer.
Two honest caveats. First, this lesson is general information about how the trade works, not legal advice — laws like CAN-SPAM in the US and GDPR in Europe have specifics that vary by situation, and a client with real exposure needs their own counsel. Second, knowing the line makes you more valuable, not less. When a client pushes for a shortcut, the marketer who can say “here’s exactly what that risks, and here’s the version that works” keeps the account. The one who just says yes eventually loses it — along with the domain.
A client is frustrated with low opens and has an idea: “Put ‘Your order has shipped’ as the subject line on the sale email. Everyone opens those.” What do you do?
What you can now do
- Set up sending identity before anything else: SPF as the guest list of who may send for the domain, DKIM as the wax seal on every message, DMARC as the instruction card for receivers — then warm up properly.
- Run list health as a habit, not a project: hard bounces off immediately, the spam-complaint rate watched like a fuel gauge, and a defined sunset path for the chronically unengaged instead of endless sends.
- Enforce the permission rule with any client: every address opted in on purpose, no purchased, rented, or scraped lists — and if they can't say where people signed up, that's the first problem you fix.