Reviews
Part of Email Marketing Runs on Permission Before It Runs on Automation
Small Business Email Marketing Checklist: Permission, Infrastructure and Continuity
A small business email marketing checklist for permission, infrastructure and access, message and destination, automation, suppression, measurement and continuity.
What to take away
- Complete the checklist for each program, jurisdiction, domain, and provider, then repeat it after material changes.
- Do not send with unresolved permission, identity, authentication, unsubscribe, security, claim, or destination failures.
- Record an accountable owner, due date, evidence location, and approval for every open issue or accepted lower-risk exception.
A small business email marketing checklist should protect recipient choice, sending identity, and business continuity before optimizing creative. Complete it for each program, jurisdiction, domain, and provider, then retest after material changes.
The sign-off record near the end shows the format to fill in.
Purpose and permission
Permission and signup evidence
- Name sender, audience, jurisdictions, message category
- Record signup source, notice version, permission basis
- Confirm interests, frequency promise, data sharing
- Document retention, withdrawal, evidence location
- Reject purchased, scraped, appended, unexplained addresses
- Quarantine imports until origin and status reconciled
Permission has three parts: consent basis, list source, and purpose limit.
Consent basis. Express opt-in with an unchecked box is the strongest basis. Implied consent, such as an existing customer relationship, expires in Canada. CAN-SPAM has no implied-consent category, and it still requires honest headers, a physical address, and a working unsubscribe.
List source. Record the form, page, date, and the promise made at collection. A list you cannot trace is a list you cannot defend.
Purpose limit. Send what the signup promised. A new purpose needs a fresh opt-in where the law requires it.
Rules that apply. CAN-SPAM sets the United States baseline. State privacy laws, such as California's CCPA and CPRA, add notice, access, and opt-out rights. Canada's CASL requires express or documented implied consent. GDPR applies to marketing aimed at people in the EU.
Infrastructure and access
NIST's Trustworthy Email guidance covers SPF, DKIM, DMARC, TLS, and related controls intended to improve trust in email. It is written for federal agencies but says the recommendations can inform small and medium organizations. Use qualified administrators to adapt the controls to the business's actual domains, services, risk, and recovery needs.
- Inventory domains, providers, ecommerce, support, reservations, invoices, forms, plugins, agencies, IPs, From addresses, return paths, selectors, credentials, and owners. Evidence: a dated export.
- Validate SPF, DKIM, DMARC, alignment, DNS, TLS, formatting, one-click unsubscribe, visible unsubscribe, sender identity, error monitoring, and gradual sending plans. Pass: all confirmed on the live domain.
- Use strong authentication, minimum roles, backup administrators, change approval, exports, audit logs, recovery tests, vendor review, and immediate offboarding. Fail if offboarded accounts stay open.
Message and destination
The U.S. government's email accessibility checklist tests structure, headings, lists, tables, and links. It tests images, color, reading order, language, and plain writing, so use it as a practical review aid.
Test the real message in relevant clients, with assistive technology, mobile layouts, forms, and attachments. Consider applicable audience needs, and copy accessible message patterns from small business email marketing examples.
- Verify From, Reply-To, subject, preview, identity, contact or postal details, claims, prices, dates, stock, eligibility, disclosures, links, and landing-page promise. Fail if a claim differs from the landing page.
- Check headings, type, contrast, alt text, logical reading order, descriptive links, plain text, images-off behavior, mobile layout, forms, checkout, and confirmation. Evidence: render tests in Litmus or Email on Acid, a keyboard pass, and a screen reader pass in NVDA or VoiceOver.
- Define reply ownership, customer-service escalation, complaint handling, privacy boundaries, and correction or withdrawal procedures before sending. Evidence: the named reply owner.
Automation and suppression
- Document entry, consent check, delay, time zone, content version, segment, exclusions, frequency cap, collisions, exit, reversal, failure alert, and owner. Evidence: a version-stamped map.
- Test global and list opt-outs, complaints, hard bounces, temporary failures, invalid addresses, preference changes, reimports, integrations, franchises, and provider migration. Fail if a suppression path is untested.
- Keep enough protected suppression data to prevent future marketing while applying approved privacy, access, security, and retention controls. Record who can read the list.
Measurement and continuity
- Track delivery, authentication, complaints, bounces, unsubscribes, clicks, replies, conversions, revenue, returns, retention, service load, list sources, and sending changes. Name each source.
- Compare like cohorts, treat opens as directional, document definitions and privacy effects, preserve the sent version, and link decisions to customer evidence. No evidence, no decision.
- Rehearse domain compromise, provider outage, broken unsubscribe, bad import, incorrect promotion, privacy incident, staff departure, and urgent suppression. Log the last rehearsal date.
Record the exception owner and approval when a lower-risk defect is accepted. Weak permission and bought lists are two of the most common small business email marketing mistakes that audits flag.
Checklist sign-off record
| Area | Required evidence | Recheck trigger |
|---|---|---|
| Permission | Promise, source, status, suppression | List or purpose change |
| Infrastructure | Senders, DNS, authentication, access | Domain or vendor change |
| Message | Claims, accessibility, destination, approval | Offer or template change |
| Continuity | Exports, recovery, incidents, backups | Staff or service change |
Worked example with illustrative values:
| Area | Evidence recorded | Owner | Result | Recheck trigger |
|---|---|---|---|---|
| Permission | Form export dated March 14, 2025, unchecked box, source URL | Marketing lead | Pass | New list source |
| Infrastructure | DNS export, DMARC report, admin list | IT lead | Pass, one exception due April 30 | Vendor change |
Sources and further reading
The W3C Privacy Principles statement and the CISA software acquisition fact sheet cover privacy principles, supply-chain exposure, deployment, and vulnerability management, and serve as background only for a small business email marketing checklist review.
Common questions
Who should own the email checklist?
One accountable business owner should coordinate marketing, technical, privacy, legal, security, accessibility, service, and financial specialists as the risk requires.
How often should the checklist be repeated?
Review it quarterly and after material changes to a domain, provider, form, list source, integration, offer, automation, staff member, agency, or rule.
What happens when an item fails?
Serious permission, identity, security, suppression, claim, and destination failures stop the send until they are fixed. Other defects need an owner, safeguard, evidence, deadline, and approval.
