Marketing email

Every marketing email must offer a way out. CAN-SPAM requires a working opt-out honoured within 10 business days (15 U.S.C. §7704(a)(3)), CASL requires the mechanism stay live for 60 days, and Gmail, Yahoo and Microsoft all require one from bulk senders. This confirms an opt-out exists — either a List-Unsubscribe header or an unsubscribe link in the body. It found one in 99.1% of a 57,000-email marketing corpus, so a failure here is rare and serious: it means the send has no exit at all. What it does not check is RFC 8058 one-click compliance. A mailto:-only header passes this check, and since May 2026 Google and Microsoft issue permanent 550 rejections for bulk marketing mail that lacks an HTTPS List-Unsubscribe together with List-Unsubscribe-Post. Read a pass here as "you have an opt-out", not as "Gmail will accept this".

A valid physical postal address is mandatory in every commercial email — CAN-SPAM 15 U.S.C. §7704(a)(5)(A)(iii), implemented at 16 CFR §316.2(p). Each non-compliant email is a separate violation, currently up to $53,088, so a single blast to a 50,000-person list is not one mistake. The check anchors on a postcode that agrees with its region rather than on a street-address pattern, and recognises US, UK, Canadian, military and European formats. A street address, a PO box, or a registered private mailbox all satisfy the law. Measured against 1,000 real marketing emails it finds an address in about 90%, with the remainder hand-audited as genuine absences. It fails an incomplete address on purpose: telling you that you comply when you might not is the one error here that carries legal consequences. Optionally, configure your own sending address and a store locator or event venue in the body will no longer be mistaken for it.

Your footer is where the legally required content lives, and this is the check that confirms a reader can actually see it. The address and unsubscribe checks read your source; this one reads the rendered email, so an address hidden in a collapsed block, or pushed off the end of a broken table, is caught here and nowhere else. It failed 18.4% of the emails we have run it against, and every one of those failures a human reviewed was confirmed correct. **What this standard asks the check to look for: a visible postal address and an unsubscribe link.** Both are the CAN-SPAM floor for commercial bulk email, which is what this category is — they are not a general assumption about mail, and the operational and transactional standards deliberately ask for something different. You can ask for more — a logo, social links, a phone number, legal text — at which point it stops checking our standard and starts checking yours.

Confirms the domain in your From: header is one you own, using DMARC relaxed alignment — mail.yourbrand.com matches yourbrand.com, because only whoever controls your DNS can create that subdomain. That distinction matters: 52.3% of real senders mail from a subdomain of their brand domain, so exact matching would fail most legitimate campaigns. The failure it catches is an ESP misconfiguration sending your campaign from the wrong domain. At bulk volume that breaks DMARC alignment, which Gmail, Yahoo and Microsoft all require and, since May 2026, enforce with permanent 550 rejections. It also catches a staging domain leaking into production, and the wrong brand's domain in a multi-brand account. Needs one piece of configuration: the domains you send from. Until you provide them the check is skipped rather than failed. Note it does not verify that SPF, DKIM or DMARC actually pass — it confirms the From domain is one you claim.

Send both an HTML and a plain-text part. SpamAssassin has a named rule for missing one — MIME_HTML_ONLY — scoring between 0.723 and 1.2 against a spam threshold of 5.0. You are spending 15–24% of your spam budget before you write a word, and 24.1% of real marketing email is paying it right now. Nothing here is illegal, and no mailbox provider mandates it: Gmail's bulk sender rules cover authentication, one-click unsubscribe and complaint rate, not multipart. The exposure is concentrated where SpamAssassin actually runs — corporate gateways, self-hosted mail and B2B filters. If you mail businesses this matters considerably more than if you mail consumers. It blocks because the fix is one toggle in every major ESP, and there is no reason to carry a permanent penalty you can remove in a second. The check reads your MIME structure rather than counting characters. That distinction is load-bearing: email parsers synthesise plain text from the HTML, so a message shipping no plain-text part still appears to have tens of thousands of characters of it.

"Hi {{first_name}}" reaching your whole list is the most recognisable failure in email marketing, and it cannot be undone once sent. This scans your subject line, preview text and body for unfilled merge tags and placeholder copy — {{tokens}}, [COMPANY NAME], lorem ipsum filler — with no configuration required, and you can supply your own patterns. One limit worth knowing: it catches a token that did not render. It does not catch a token that resolved to nothing — "Hi ," — which is the more common modern failure, because most platforms now substitute an empty string rather than leaving the raw tag behind.

Clicks every link by machine before your readers do. A marketing email is link-dense — hero, calls to action, product tiles, footer — and every one is a conversion path, so a dead link does not cost you a click, it costs you the campaign, across your whole list at once. Beyond dead destinations it catches what proofreading cannot see: a personalisation token that never resolved inside an href, a bare # placeholder, a scheme-less URL that Outlook.com silently strips, and malformed tel: or javascript: hrefs. It failed 10.3% of real marketing email, and every sampled failure was a genuine defect. Failures are trustworthy by design. Bot-protection responses (401/403/429) are reported as unverifiable rather than failed, because Cloudflare-class protection serves those to automated checkers and never to a person with a browser. A failure means the link is provably broken for everyone. Some links are actions rather than addresses, and those are never fetched. Your unsubscribe and preference links, because following a one-click opt-out would genuinely opt someone out. And links whose path names an account action — verify, confirm, activate, reset, revoke and the like — because those endpoints complete on GET, so requesting one can consume a single-use token. Everything skipped is listed in the result with the reason it was skipped, so you can see what was not checked instead of reading it as a clean pass. **Validate a test send, not a live campaign.** Two reasons that survive the skip rule. It works on the shape of a URL, so it cannot be complete — an action endpoint behind a neutral path will still be fetched. And every ESP click-redirector in your email is still followed, which registers a click in your own reporting; note that Salesforce Marketing Cloud has no native bot-click filtering. Links are inspected with HEAD only, and a destination that refuses HEAD is reported unverifiable rather than re-requested with GET, because getting that verdict would mean running the endpoint's GET handler.

A marketing email exists to be acted on, which makes this the one check that asks whether your campaign can do the job it was sent to do. It confirms there is a call to action and that it is fully visible at every viewport and email client you selected — not clipped at the edge, not cut off, not pushed out of frame. A campaign whose CTA is unreachable on a 320px screen still delivers, still complies, and converts nobody. Footer unsubscribe and preference links are never counted as calls to action.

Judged from the rendered capture at every viewport and client you selected, reporting what specifically broke. This is the classic email failure and the reason email testing exists: Outlook renders through the Word engine, which breaks table structures that are flawless in a browser, and mobile reflow collapses multi-column layouts. An email that arrives visibly broken is not a weakened campaign, it is a wasted one — multiplied across your entire list. It is deliberately strict: any layout issue it identifies fails the check, even when its overall read of the email is favourable. It is not exhaustive, though, and subtle text overflow can still pass. Read a pass as "nothing obviously broken" rather than "renders perfectly everywhere".

Resolves every image your email references — attached, embedded or remote — and checks the dimensions you declared against the file's real ones. It fails when an image cannot be fetched at all, when declared width and height contradict its natural aspect ratio (the squashed or stretched logo), or when an image is scaled up far enough that it will render soft and blurry. Deterministic, read from the source, with no model involved. Retina exports and ratio-preserving downscales are never flagged. An email with no images passes at no cost.

The delivery-path half of image checking: every image source must resolve to real, decodable image bytes over a sound path. It fails on dead references, dangling embedded-image ids, redirect chains beyond five hops, and http:// sources whose secure equivalent does not work — that last one is a common cause of images that look fine in testing and break in the recipient's client, because many clients refuse insecure images outright. Optionally restrict images to hosts you approve, checked at both the original source and the final redirect destination, so a brand CDN URL that bounces to an off-list tracker fails. It overlaps the rendering check on unresolvable images, so a broken URL is reported by both. Their unique halves differ: this one owns the delivery path, that one owns dimensions.

Marketing email bakes the offer into the image — the headline, the price, the discount code. Outlook blocks images by default until you are on the reader's Safe Senders list, so without alt text your campaign renders as blank boxes and communicates nothing at all. Not degraded: nothing. It is also now a legal requirement. The European Accessibility Act has applied since 28 June 2025 and is being enforced through 2026, bringing WCAG 2.1 AA to marketing email for any company serving EU customers, and alt text is its most-named requirement. Expect this to fail. 61.9% of real marketing email has missing or unusable alt text, and where humans reviewed our verdicts they agreed 90% of the time — the industry genuinely has not caught up yet. Spacers and open-tracking pixels are excluded, since a 1×1 shim carries no message a reader can lose, and placeholder values like "image" or "banner" are rejected as no better than nothing at all.

The text beside your subject line is the third thing a reader sees, after who it is from and what it says, and it is the most commonly wasted asset in marketing email. This computes what your preview will actually say and checks it is not working against you: no "view this email in your browser" boilerplate leading the preview, no merge token that failed to resolve, no bare URL or undecoded entity garbage, nothing cut off mid-thought. It has no opinion on whether your preheader is any good. It fails only on defects, and it passes every legitimate choice — including having no hidden preheader at all, since leading with a visible headline is a sanctioned pattern rather than a mistake.

Mobile is now 68% of email opens, and mobile inboxes cut the subject line between roughly 28 and 50 characters — Gmail's app at about 30, an iPhone at about 41. Subject lines in the 21–40 character band see open rates near 49%, against about 39% above 60 characters. This flags subjects past 60 characters: a loose outer bound, deliberately well above the range the data actually favours. 18% of real marketing email exceeds it. Read a pass as "not obviously too long" rather than "good". It cannot tell you a subject is vague, weak or spammy — that judgement stays yours, which is why it reports rather than blocks.

Confirms your brand logo is present and in the upper part of the email, judged from the rendered capture at each viewport and client. It catches a logo image that fails to load at the top of a campaign, a logo pushed below the fold by a broken header, and a template that shipped without one — each of which costs you the recognition that gets your next send opened, and the trust that separates you from a phishing attempt. It reports rather than blocks, because a logo in the header is a strong convention rather than a rule. Text-forward campaigns and live-text wordmarks are legitimate choices. Where your brand has its own header or footer standard, the footer check is the one you can configure to enforce it.

For senders using imagery, judged visually per viewport and client. The question is not whether an image is cropped but whether the crop destroys its meaning: text cut off inside an image, a truncated face or product, framing broken badly enough to change what the image communicates. Deliberate art direction — full-bleed crops, edge bleeds, tight but clear framing — passes. This matters more in marketing than in any other kind of email, because marketing images carry the words. A hero whose "40% OFF" is cut off at 320px renders with perfectly intact layout and sells nothing. Unlike the source-level image checks, this one costs a model call whether or not your email turns out to contain images.

If you track your campaigns, this makes sure you will actually get the data. It grades the tracking already on your links and never asks you to add any: unresolved merge tokens such as utm_campaign={{campaign.name}}, empty or duplicated parameters, misspelled UTM keys that analytics silently ignores, a raw email address sitting in a query string, and stray gclid or fbclid parameters that reveal a URL was pasted from a browser after an ad click. A misspelled utm_medium does not raise an error — it disappears, and you find out at the monthly review when the campaign shows no sessions. One finding is heavier than the rest: a recipient's email address in a query string is a Google Analytics terms violation, and under GDPR it is personal data leaked into a third-party system and into every downstream referrer header. No links are fetched, so nothing here registers a click and it is safe against a live campaign. It reports rather than blocks, because broken tracking costs you data rather than revenue.

Gmail stops rendering a message at roughly 102KB of HTML and hides the rest behind a "View entire message" link. What falls below that cut is the end of your email — the footer, the unsubscribe link, the tracking pixel. The campaign looks fine in your own inbox, and quietly stops being measured. 10.7% of the 57,396 real marketing emails we measured are over the limit today. The number that matters more is which part goes missing: your opt-out link is at the bottom, and an unsubscribe mechanism a recipient cannot see is not the clear and conspicuous one CAN-SPAM asks for. It blocks because the fix is almost always deleting something — a base64 image pasted into the HTML, a duplicated template, an analytics block copied twice — and because the alternative is sending mail whose legally required part is invisible to the largest mailbox provider there is.