Email marketing for small business still pays because the list belongs to you: no algorithm decides whether your customers see the message. But since 2024 the technical rules for reaching the inbox have tightened, and the law on who you may email differs from country to country. Get permission, authenticate your domain, and automate a few useful emails before you spend any time on newsletter templates.
Is email marketing for small business still worth it?
Yes, if you have something useful to say at least once a month. Email is the one channel where you own the audience, and the cost is low next to paid ads; our small business marketing budget plan shows how the channels fit together.
A social media page can lose reach overnight when a platform changes its feed. A list of customers who asked to hear from you moves with you when you change tools. Most email service providers (ESPs) such as Mailchimp, Brevo, MailerLite, Klaviyo and Kit have free or low-cost tiers for small lists, with prices rising as the list grows.
It is not worth much if nobody in the business will write the emails. A neglected list that suddenly gets a sale blast two years later mostly produces spam complaints.
How do you build an email list the right way?
Ask at the moments people already trust you, give a specific reason to subscribe, and record their consent. Good email list building is slower than buying a list and far more valuable.
- At checkout: an unticked "Email me new stock and offers" box. Pre-ticked boxes are not valid consent under UK and EU rules.
- On the website: a form with a concrete promise ("One email a month with new arrivals and restock dates"), not "Subscribe to our newsletter". The advice in our landing page conversion checklist applies: one offer, few fields.
- In store or at events: a QR code to the same web form, so consent is captured the same way every time.
- With a lead magnet: a price list, a sizing guide or a checklist people actually want.
Never buy or rent a list. Mainstream ESPs prohibit purchased lists in their terms, bought lists often contain spam-trap addresses, and in consent-based countries you have no lawful basis to email those people at all.
For every subscriber, keep a consent record: the email address, date and time, the source (form URL, checkout, store), the exact wording they agreed to, and the confirmation timestamp.
What is double opt-in, and do you need it?
Double opt-in means a new subscriber must click a confirmation link in an email before they join the list. It is not legally required in most countries, but it is the cleanest proof of consent and it keeps typos, bots and spam traps out.
Single opt-in grows faster, and some people never confirm. Reduce the drop-off with a thank-you page that says "Check your inbox, and your spam or Promotions folder, for a confirmation link", and a confirmation email with a plain subject line and one button.
A sensible default: double opt-in for website sign-ups, where bots and mistyped addresses are common; a clear welcome email for customers who opted in at checkout, where the address has already been used for a real order.
How do SPF, DKIM and DMARC improve email deliverability?
They prove to Gmail, Yahoo and Outlook that mail using your domain really comes from you. Without them, bulk mail is increasingly filtered to spam or rejected outright, and anyone can spoof your domain.
| Record | What it does | What to watch |
|---|---|---|
| SPF | A DNS TXT record listing the servers allowed to send for your domain | One SPF record per domain, and no more than 10 DNS lookups inside it |
| DKIM | Adds a cryptographic signature to each message; the public key sits in DNS | Set up your ESP's custom-domain DKIM, not its shared default; use 2048-bit keys where offered |
| DMARC | Tells receivers what to do when checks fail, and where to send reports | Start at p=none, read the reports, then move to quarantine and reject |
DMARC adds one subtle rule: the domain in the visible From address must match (align with) the domain that passed SPF or DKIM. That is why sending "from" your business domain through an ESP's default shared domain fails.
- List every service that sends as your domain: Google Workspace or Microsoft 365, your ESP, the shop platform, invoicing software, the website's contact form.
- Turn on custom-domain authentication in each; they give you the DNS records to add.
- Publish a DMARC record, for example
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. - Read the aggregate reports for a few weeks (a DMARC reporting service turns the XML into something readable) and fix legitimate senders that fail.
- Tighten to
p=quarantine, thenp=reject.
Many businesses send marketing from a subdomain such as news.yourdomain.com, so a badly received campaign does not drag down the reputation of everyday invoices and replies.
What did Gmail and Yahoo change for bulk senders in 2024?
From February 2024, Google and Yahoo began enforcing rules for bulk senders: authenticate with SPF, DKIM and DMARC, offer one-click unsubscribe, and keep spam complaint rates low. Google's email sender guidelines set out the details.
- Who counts: Google treats a sender as bulk once it sends close to 5,000 or more messages in a day to personal Gmail accounts, and that status is permanent.
- Authentication: SPF and DKIM, plus a DMARC record (at least
p=none) with the From domain aligned. - Unsubscribing: marketing messages need one-click unsubscribe through the
List-Unsubscribe-Postheader (RFC 8058) and a visible link, with requests honored within two days. - Complaints: keep the spam rate shown in Google Postmaster Tools below 0.3%; Google recommends staying under 0.1%.
- Everyone else: all senders need SPF or DKIM, valid forward and reverse DNS for sending servers, and TLS connections.
Microsoft announced comparable requirements in 2025 for high-volume senders to Outlook.com and Hotmail addresses. Treat all of this as the baseline even at small volumes; your ESP handles most of it once the domain is authenticated.
Which email marketing laws apply to your business?
The law where the recipient lives applies, not only the law where you are based. A business in Nepal or the UK emailing people in Canada must follow CASL.
| Market | Law | Consent model | Key obligations |
|---|---|---|---|
| USA | CAN-SPAM Act (2003) | Opt-out: prior consent not required | Honest headers and subject lines, a valid postal address, opt-outs honored within 10 business days |
| Canada | CASL (in force since 2014) | Opt-in: express or implied consent; implied consent from a purchase lasts two years | Sender identity and contact details, unsubscribes honored within 10 business days |
| UK | PECR (2003) alongside UK GDPR | Consent for individuals; a "soft opt-in" for existing customers buying similar products | Sender identity, a working opt-out in every message |
| Australia | Spam Act 2003 | Express or inferred consent | Sender identity, a functional unsubscribe honored within five working days |
| New Zealand | Unsolicited Electronic Messages Act 2007 | Consent (express, inferred or deemed) | Sender identity, a functional unsubscribe honored within five working days |
In the UK, PECR's consent rules apply to individuals and sole traders; emails to corporate addresses have lighter rules, but UK GDPR still covers a named person's work address. Every regulator above can fine businesses, so treat this table as orientation, not legal advice, and check the guidance from the FTC, CRTC, ICO or ACMA for your case. Our pages on selling into Canada and Australia cover these laws alongside privacy and accessibility.
What should your first email campaigns be?
Automations first, broadcasts second. A welcome series runs every day without anyone remembering to send it.
- Welcome series (two or three emails over a week): deliver what the form promised, explain briefly who you are, show your best-selling products or most-asked service, and give one clear next step.
- Post-purchase or post-enquiry: a thank-you, how to get the most from the product, and a review request once it has arrived.
- Abandoned cart for online stores: one reminder a few hours later and one the next day, sent only to people who agreed to marketing email where the law requires consent.
- Monthly newsletter: one useful thing (new stock, a seasonal tip, a price change) and at most one offer.
- Re-permission: subscribers who have not clicked anything in six to twelve months get one email asking whether they want to stay. Remove those who do not answer; it protects your sender reputation.
Which email numbers should you track?
Clicks, conversions, unsubscribes and spam complaints. Open rates have been unreliable since Apple's Mail Privacy Protection, introduced with iOS 15 in 2021, began preloading images and recording opens that never happened.
- Click rate, compared with your own earlier campaigns rather than published averages.
- Sales or enquiries per campaign, tracked with UTM tags in GA4.
- Unsubscribe spikes after particular emails.
- Spam rate in Google Postmaster Tools, once your volume is high enough for data to appear.
- Hard bounces, which your ESP should suppress automatically.
How Meritbyte Technologies sets up email marketing
Meritbyte Technologies is a Nepal-based web and software development company. Email and lifecycle campaigns are part of our digital marketing practice, and the technical side (DNS records, sign-up forms, checkout opt-ins) is handled by the same team that builds websites and web apps.
The ESP account, the sending domain and the list stay in the client's name, so nothing is lost if you move to another firm. We authenticate the domain before the first send and start DMARC at p=none, tightening once the reports are clean. We will not import a purchased list. You get one project manager, a written update every week, and a person replying to questions within one business day.
Frequently asked questions
Is double opt-in legally required?
In most countries, no. CAN-SPAM, CASL, PECR and Australia's Spam Act do not name double opt-in as a requirement. It is still the strongest proof that a real person agreed, and it keeps mistyped addresses and spam traps off your list. Use it for website sign-ups; for customers who opted in at checkout, a clear welcome email usually does the same job.
Do small senders need SPF, DKIM and DMARC?
Yes. Google's strictest rules apply to bulk senders, but every sender to Gmail needs at least SPF or DKIM, and an unauthenticated domain is easy for fraudsters to spoof. Setting up all three usually takes an hour or two with your email provider's instructions, costs nothing, and protects everyday business email as well as campaigns.
How often should a small business send marketing emails?
As often as you have something useful to say, on a predictable schedule. For most small businesses that means one planned email a month plus automated welcome and post-purchase messages. Watch unsubscribes and complaints: if they rise when you send more often, the list is telling you to slow down or make the content more relevant.
Which email marketing platform should a small business use?
Choose by what you sell. Klaviyo and Shopify Email integrate tightly with online stores; Mailchimp, Brevo and MailerLite suit newsletters and simple automations; Kit is built around creators. All support custom-domain authentication and double opt-in. Check the price at the list size you expect in two years, and confirm you can export contacts together with their consent data.