Why a separate thank-you email stands out
Most thank-you messages are folded into the order confirmation, receipt, shipping notice or download email. A thank-you that arrives on its own, after the purchase, gets noticed because the customer isn’t expecting it.
Crate and Barrel showed this well in the 2008 holiday season. The order confirmation landed in the shopper’s inbox minutes after checkout, as it should. Then a separate thank-you email arrived a few days later, with no prompt. The design showed some care: Crate and Barrel had made a custom version of the message tied to the holidays rather than sending a generic template.
That unexpected message did three things. It made the customer feel more confident about the purchase, it strengthened the brand, and it made a repeat order more likely, because the whole shopping experience felt easy and pleasant.
Thank-you and welcome emails as easy touch points
A thank-you email is a simple way to show subscribers you noticed them. It can thank people for a purchase, a review, feedback or ongoing support.
Welcome emails do a similar job. A welcome message tells new subscribers what to expect, such as how often you’ll email, what kind of content you’ll send and what’s in it for them. That sets expectations from the start.
The original post was written with about a week left in 2008, and its closing wish was for more brands to send welcome messages, thank-you messages and personal touches based on what they knew about each customer’s preferences. Most retailers now run welcome series and post-purchase flows automatically. The thank-you that feels personal, and not like a template, is still less common than it should be.
What’s different about sending transactional emails today
The approach from 2008 still works, but it now runs under stricter mailbox and legal rules. Three changes matter most.
The law looks at the email’s main purpose
Under the CAN-SPAM Act, a message that only contains transactional or relationship content, meaning it completes a transaction the customer already agreed to or updates them on one, is exempt from most of the Act’s rules. It still can’t contain false or misleading routing information. The FTC’s compliance guide says a mixed email counts as commercial if the subject line would make the reader think it’s an ad, or if the transactional part doesn’t come first in the message.
A thank-you note that opens with “Thanks for your order” and the order details stays transactional. One that opens with a holiday sale banner is commercial. That means it needs a working opt-out, a valid physical postal address and an honest subject line. The FTC’s maximum civil penalty is $53,088 per violating email at the 2025 level, and the agency has said it will not adjust its penalty amounts for 2026.
Mailbox providers expect authenticated mail
Google and Yahoo began enforcing their bulk sender rules in February 2024 for anyone sending close to 5,000 or more messages a day to personal accounts. For these bulk senders, the rules require SPF, DKIM and a DMARC policy, one-click unsubscribe on marketing messages (honored within 48 hours), and a reported spam rate in Google Postmaster Tools kept below 0.1% and never reaching 0.3%. Gmail tightened enforcement in November 2025, moving from warnings to delaying and rejecting mail that doesn’t comply. Microsoft began enforcing its updated requirements for high-volume senders to Outlook.com, Hotmail.com and Live.com recipients on May 5, 2025.
Google’s one-click unsubscribe rule applies to marketing and subscribed messages, not purely transactional ones like receipts or password resets. Authentication still applies to every message. A minimal DMARC record for a domain that sends both kinds of email looks like this:
_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Start with p=none to collect reports, then move to p=quarantine or p=reject once every legitimate sending service passes SPF or DKIM in alignment with your domain.
Open rates no longer tell the story
Apple Mail Privacy Protection, launched with iOS 15 in September 2021, preloads images whether or not the person reads the email. That inflates open rates. Gmail has also loaded images through its own proxy since 2013 and has sorted mail into Primary and Promotions tabs since the same year. To judge a thank-you email, look at repeat purchases, clicks to reviews or account pages, and replies, not opens. Since most people read these messages on their phones, often in dark mode, keep the design to one column with a logo and text that stay readable on a dark background.
A practical way to use the idea now
Keep order confirmations and shipping notices strictly transactional and send them right away. Send the thank-you as a separate message two to five days later. Put the gratitude and order details first, and keep any offer small and below them. If the thank-you starts to work more like a promotion, send it from your marketing stream with an unsubscribe link and a List-Unsubscribe header. Many teams send transactional mail from a separate subdomain, such as orders.example.com, so a marketing campaign that draws complaints can’t drag down the delivery of receipts.
FAQ
Is a thank-you email a transactional email under CAN-SPAM?
It is if its main purpose is to confirm or follow up on a purchase the customer already made. If the subject line or opening content promotes products, the FTC treats it as commercial and all of CAN-SPAM’s rules apply. When in doubt, add an unsubscribe link and a postal address anyway.
Do transactional emails need a one-click unsubscribe link?
Google’s sender guidelines require one-click unsubscribe for marketing and subscribed messages, and purely transactional messages like receipts and password resets are excluded. They still need SPF, DKIM and DMARC if you’re a bulk sender. Once you add promotional content, include the unsubscribe headers.
When should a post-purchase thank-you email go out?
The order confirmation should go out within minutes. A separate thank-you works best a few days later, around delivery, when the customer has the product in hand. Sending it the same day as the receipt removes the surprise that makes it work.
Should transactional and marketing emails come from the same domain?
They can share a root domain, but separate subdomains or IP pools are a common way to protect important mail. If a promotional campaign raises your spam rate, receipts and password resets on their own subdomain are less affected. Each subdomain still needs aligned SPF or DKIM to pass DMARC.
How do you measure whether a thank-you email works?
Measure what happens after it arrives, not opens, since Apple Mail Privacy Protection inflates them. Useful metrics are repeat purchase rate compared with a holdout group, clicks to leave a review, replies and unsubscribes. Keep an eye on the spam rate in Google Postmaster Tools as well.
Sources
- Google Gmail Help: Email sender guidelines and sender guidelines FAQ
- Yahoo Sender Hub: Sender best practices and bulk sender requirements
- Microsoft Tech Community: Outlook’s new requirements for high-volume senders (April 2025)
- Federal Trade Commission: CAN-SPAM Act, A Compliance Guide for Business
- Federal Register: FTC notice on 2026 civil penalty amounts