Yes, you need one. As of November 2026, every marketing email should carry a clear opt-out method, your valid postal address and honest sender details. Bulk senders to Gmail and Yahoo also need a one-click unsubscribe header, and a preference link and a short preview text line are smart additions. The domain it comes from also needs SPF, DKIM and DMARC. The biggest change since this checklist first appeared came in February 2024, when Gmail and Yahoo turned authentication, one-click unsubscribe and spam-rate limits into rules for bulk senders. Microsoft followed for Outlook.com in May 2025, and Apple Mail Privacy Protection has made open rates unreliable since 2021.
Why every send needs a checklist
A checklist stops the small, costly misses: the missing footer address, the broken unsubscribe link, the preview text that still says “Lorem ipsum.” The original version of this list opened with “It’s 2010, people,” and the habit it pushed still holds. Build the same set of items into every email you manage, so nothing depends on memory on a busy send day.
The items below follow the original list in order. Each one notes what still works and what is now history.
Social media links
Social icons still belong in most marketing emails, but they matter less than they once did. Put them in the footer, where they help without pulling clicks away from your main call to action.
In 2010, Twitter and Facebook were the standard pair. Twitter is now X (renamed in July 2023), and depending on your audience the useful set might be Instagram, LinkedIn, TikTok, YouTube or Facebook. Only link the accounts you actually keep active. A dead profile does more harm than no icon at all.
If you run a small business and are new to email marketing, the old advice to pick an email service provider (ESP) that tracks social links still applies. Every mainstream ESP reports clicks per link. To see what those clicks do after they leave the inbox, add UTM parameters to your links and check the results in Google Analytics 4 or your own analytics tool. Reporting is still what separates campaigns you can improve from campaigns you can only guess about.
Forward to a friend
A forward-to-a-friend (FTF) link is now optional. In 2010 it was treated as essential. Most people forward emails with their mail app’s own Forward button, and your ESP cannot see those forwards. So FTF reports only show the small share of readers who used your link.
The original advice said any decent ESP should track forwards, find your key influencers and count the new subscribers a forward brings in. Some ESPs still offer FTF links or merge tags. If yours does, the link costs nothing to add and can show you a few of your most engaged fans.
Two cautions apply today:
- The FTC’s CAN-SPAM guidance says that if you offer something of value to get people to forward your message, you can be treated as the sender of the forwarded email and become responsible for its compliance.
- A “share” or “refer a friend” landing page usually works better than an FTF link. It sends new people to a signup form, so they opt in themselves instead of getting mail they never asked for.
Navigation
A short navigation bar that matches your site still works well in newsletters and retail emails. Someone who signed up probably likes your brand and visits your site now and then, so familiar links help them get where they want to go.
Keep it short. Most email is now read on phones, so a row of eight links at desktop width turns into a cramped strip on mobile. Three or four links in a clean, tappable row, or a stacked menu on small screens, beats copying your full site menu. The old idea that the email layout should mirror the site’s design still fits. Just check that your logo, nav text and buttons stay readable in dark mode in Apple Mail, Gmail and Outlook.
Preheader
The word “preheader” now means two things, and you need both.
- Preview text. This is the line inbox apps show next to or under the subject line. It is now the most valuable part of the preheader. Write it on purpose. Add to your subject line instead of repeating it, and keep the key words in the first 40 to 90 characters, because mobile apps cut it short.
- The utility bar. This is the small strip at the very top of the email. In 2010 it held two must-haves: a whitelist request and a “view online” link.
A whitelist request (today usually worded “add us to your contacts” or “add us to your safe senders list”) asks readers to save your From address so your mail keeps landing in the inbox. It still helps a little. It no longer replaces authentication, which mailbox providers now weigh far more heavily (see the new section below).
The view-online link is still worth keeping, because some readers’ email clients break your layout. The old advice to link to a separate mobile or text version is history. Responsive design makes one email fit any screen, and a plain-text MIME part goes out alongside the HTML automatically in most ESPs.
The original argument for the preheader was images. If a reader blocked all images, the preheader might be the only thing they saw. That mattered more in 2010. Since December 2013, Gmail has loaded images by default through its image proxy, and Apple Mail shows images by default. Some Outlook desktop setups still block external images until the reader allows them. So the top of the email still has to make sense without pictures: live text, real alt text and a call to action that is not just an image.
Physical address
Every commercial email must include a valid physical postal address. That has been the law since CAN-SPAM took effect on January 1, 2004.
The original post said the address rule was added in 2008. In fact, the requirement was part of the 2003 Act from the start. What the FTC’s 2008 rule did was clarify that, besides a street address, a post office box registered with the U.S. Postal Service or a private mailbox registered with a commercial mail receiving agency established under Postal Service regulations counts. The same rule made clear that opting out cannot require anything beyond sending a reply email or visiting a single web page. You also cannot charge a fee or ask for personal details beyond an email address.
The original advice also linked fines to getting blacklisted after spam complaints. That is not how it works. A blocklist listing is a deliverability problem, and CAN-SPAM liability is a separate, legal one. The FTC can bring a case whether or not you were ever listed. Each email that breaks the law can cost up to $53,088. That ceiling took effect in January 2025, and the FTC confirmed in the Federal Register in September 2026 that it is making no inflation adjustment in 2026, so the 2025 amount still applies. Put the address in the footer of every template once, and stop worrying about it.
Preference update
A preference center link is still one of the best ways to keep subscribers who are about to leave. If people get too many emails from you and see they can drop to once a week, many will pick that over leaving entirely. Older guidance put it bluntly: “I reported on this a few months ago and I’m a big believer in this tactic.” The tactic has aged well.
What has changed is the legal and technical ground under it:
- The unsubscribe must stay easy. A preference center can sit next to your unsubscribe link, but it cannot replace it. Under CAN-SPAM you must honor opt-outs within 10 business days.
- One-click unsubscribe is required for bulk marketing mail. Since June 1, 2024, Gmail and Yahoo have expected promotional mail from bulk senders to carry a one-click unsubscribe header (RFC 8058) and to process requests within two days.
- Hiding the exit backfires. If the unsubscribe link is buried, frustrated readers hit “Report spam” instead. That pushes up the spam rate mailbox providers watch most closely.
Good preference centers offer frequency choices (weekly, monthly), topic choices and a pause option, and they still give people one clear way to unsubscribe from everything.
New for the checklist: authentication and sender rules
A send can tick every design box and still land in spam if the domain behind it is not authenticated. These items did not appear on the original list. Since 2024 they have been the ones that most often decide whether your mail reaches the inbox.
| Mailbox provider | Applies to | Key requirements | In force since |
|---|---|---|---|
| Gmail | All senders; stricter for bulk senders of about 5,000+ messages a day to personal Gmail accounts | SPF and DKIM, DMARC for bulk senders, one-click unsubscribe on marketing mail, spam rate under 0.3% (aim for under 0.1%) | February 1, 2024 (one-click by June 1, 2024); enforcement stepped up in November 2025 |
| Yahoo Mail | All senders; stricter for bulk senders | SPF, DKIM, DMARC, one-click unsubscribe on marketing mail, complaint rate under 0.3% | February 2024 (one-click by June 2024) |
| Outlook.com, Hotmail.com, Live.com | Senders of more than 5,000 messages a day | SPF, DKIM and DMARC (at least p=none) aligned with the From domain | May 5, 2025; non-compliant mail can be rejected with error 550 5.7.515 |
Typical DNS records look like this. Your ESP gives you the exact SPF include and DKIM values.
example.com. TXT "v=spf1 include:_spf.your-esp.example ~all"
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
The one-click unsubscribe headers your ESP should add to marketing mail look like this:
List-Unsubscribe: <https://example.com/unsubscribe?id=abc123>, <mailto:[email protected]?subject=unsubscribe>
List-Unsubscribe-Post: List-Unsubscribe=One-Click
Start DMARC at p=none, read the reports for a few weeks, then move to p=quarantine once all your legitimate senders pass. Watch your spam rate in Google Postmaster Tools. Gmail counts against the 0.3% limit daily.
The full checklist at a glance
| Item | Why it matters in 2026 | Status |
|---|---|---|
| SPF, DKIM, DMARC | Required by Gmail, Yahoo and Outlook.com for bulk senders | New, essential |
| One-click unsubscribe header | Required for bulk marketing mail at Gmail and Yahoo | New, essential |
| Visible unsubscribe link | CAN-SPAM requires it; honor opt-outs within 10 business days | Essential |
| Physical postal address | CAN-SPAM requires it; a registered P.O. box is fine | Essential |
| Honest From name and subject line | CAN-SPAM bans misleading headers and subjects | Essential |
| Preview text | Shown in the inbox next to the subject line | Essential |
| Preference center link | Keeps people who would otherwise unsubscribe | Strongly recommended |
| View-online link | A fallback when a client breaks your layout | Recommended |
| Short, mobile-friendly navigation | Familiar paths back to your site | Recommended for newsletters |
| Social links | Extends reach without competing with the main CTA | Optional |
| “Add us to contacts” request | A small help, no substitute for authentication | Optional |
| Forward-to-a-friend link | Tracks only a fraction of forwards | Optional, mostly legacy |
| Separate mobile or text version link | Replaced by responsive design | History |
Test the checklist before each send, not after it. Send yourself a proof, check it on a phone in dark mode, click the unsubscribe link, and look at the headers once to confirm DKIM passes. Five minutes of checking costs far less than a week stuck in spam.
FAQ
What should every marketing email include by law in the US?
CAN-SPAM requires accurate header and From information, a subject line that is not misleading, a statement that the message is an ad (unless the recipient opted in), a valid physical postal address and a clear way to opt out. You must honor opt-outs within 10 business days. Each violating email can cost up to $53,088, the 2025 ceiling that the FTC left unchanged for 2026.
Do the Gmail and Yahoo sender rules apply to small senders?
Some parts apply to everyone. All senders to Gmail need SPF or DKIM, valid DNS, TLS and a low spam rate. DMARC, alignment and one-click unsubscribe are firm requirements for bulk senders, which Gmail defines as about 5,000 or more messages a day to personal Gmail accounts. Meeting the bulk-sender rules even at a lower volume is the safer choice, because providers can defer or reject badly authenticated mail at any volume.
Is open rate still a useful metric?
Only as a rough trend. Apple Mail Privacy Protection, launched with iOS 15 in 2021, preloads email content for users who turn it on, so those emails register as opened whether or not anyone read them. Use clicks, conversions, revenue per email and unsubscribe and complaint rates to judge campaigns. Don’t use opens alone to pick A/B test winners.
Is a preference center enough instead of an unsubscribe link?
No. A preference center is a good extra, but people must still be able to opt out of everything easily. CAN-SPAM limits opt-out to a reply email or a single web page visit, and bulk senders also need the one-click unsubscribe header that Gmail and Yahoo check for.
Can a P.O. box serve as the physical address in my footer?
Yes. Since the FTC’s 2008 CAN-SPAM rule, a post office box registered with the U.S. Postal Service or a private mailbox registered with a commercial mail receiving agency established under Postal Service regulations counts. A current street address works too.
What spam complaint rate is too high?
Gmail and Yahoo both draw the line at 0.3%. Gmail advises staying below 0.1%. At 0.3% or above, inbox placement drops quickly. Gmail’s sender guidelines FAQ says bulk senders become eligible for mitigation again only once their spam rate has stayed below 0.3% for seven days in a row.
Sources
The checklist is only as good as the rules behind it, and those keep changing. Check them against the official pages before each big template update:
- Google Workspace Admin Help: Email sender guidelines
- Google Workspace Admin Help: Email sender guidelines FAQ
- Yahoo Sender Hub: FAQs
- Microsoft Tech Community: Outlook’s new requirements for high-volume senders
- FTC: CAN-SPAM Act, A Compliance Guide for Business
- Federal Register: FTC 2008 CAN-SPAM Rule (73 FR 29654)
- Federal Register: FTC Civil Penalty Inflation Adjustments, September 2026