M8.L4 · Email & Lifecycle
Pick your ESP and get delivered (SPF, DKIM, DMARC)
What you'll be able to doConfigure a free-tier ESP with a compliant double opt-in signup form and authenticated sending, and explain in plain words what SPF, DKIM and DMARC each do.
Learn
The best email ever written earns nothing from a spam folder
Today you build the machine. By the end of this lesson's exercise you will have a real email system — list, compliant signup form, authenticated sending — live, for €0. It is the most technical hour in this Program, and it has been done by every non-technical cast member and thousands of real people with no sysadmin in sight. Two honest notes first: free tiers change, and the prices and limits below were correct at the time of writing; and nothing here needs you to understand DNS — only to copy three records carefully from one screen to another, or to send one well-written email to whoever manages your website.
Why an ESP, and never your own inbox
An ESP — email service provider — is the tool that stores your list, sends at volume, runs the automations from Lesson 8.5, and keeps the records Lesson 8.2 demands: consent logs, unsubscribes, suppression lists. Sending marketing from your ordinary Gmail or Outlook account fails on every one of those counts — no automation, no proof of consent, no working unsubscribe mechanism — and mail providers throttle accounts that try it. The ESP is not optional. Happily, at your scale it's free.
Choosing: criteria before brands
Tools change; criteria don't. At this Program's scale you need: double opt-in supported on the free tier (your 8.2 policy requires it), automations on the free tier (Lesson 8.5 is an automation), EU data hosting available (simpler GDPR posture), and export freedom — you can take your list and leave any time, because owned means owned.
The taught paths, with their honest limits at the time of writing:
- MailerLite Free — the default. Up to 1,000 subscribers and 12,000 emails a month; automations and double opt-in included; an EU company. The limit that bites: at 1,000 subscribers you pay or prune — which Lesson 8.6's sunset policy makes a feature, not a crisis. Lena's post-audit 720-address list fits with room to grow.
- Brevo Free — the alternative. Unlimited contacts but 300 emails a day; a French company. Suits a small local business sending modestly; the daily cap makes big one-off broadcasts awkward.
- Kit Free — creator-shaped. Generous subscriber allowance, built around creators selling audiences and digital products; some automation features sit behind paid tiers, so check the current limits against your 8.5 plans before committing.
Pick one, in under ten minutes, using the criteria. Switching later is a mild chore, not a divorce — that's what export freedom is for.
Three records, three plain analogies
When your ESP sends "from you", receiving mail servers ask a fair question: says who? Three DNS records answer it. DNS is just your domain's public noticeboard — anyone can read it, and only you (or your registrar login) can pin things to it.
SPF is the guest list. A record on your domain's noticeboard listing the servers allowed to send email claiming to come from your domain. Your ESP asks to be added; receiving servers check arrivals against the list. Not on the list — treated as a gatecrasher.
DKIM is the wax seal. Your ESP stamps each message with a cryptographic signature that receiving servers verify against a public key pinned to your noticeboard. An intact seal proves the message really was authorised by your domain and wasn't altered in transit. A forger can copy your name; they can't fake the seal.
DMARC is your standing instructions. A record telling every receiving server what to do with mail that claims to be you but fails the other checks — deliver anyway (p=none), quarantine it, or reject it — and where to send you reports about who's sending as you. Start at p=none and monitor: you get the reports and the reputation benefit without risking your own mail while you learn.
This stopped being optional in 2024: the biggest mailbox providers now require SPF and DKIM from senders, DMARC from bulk senders, working one-click unsubscribe, and spam-complaint rates kept below 0.3% — below 0.1% to be safe. Authentication is no longer a nice-to-have; it's the price of admission to the inbox.
Your own domain, not @gmail.com
You cannot authenticate a domain you don't control. Sending your newsletter "from" herzogphysio@gmail.com fails at the door: gmail.com's own DMARC policy will fail your ESP's sends, because you can't add your ESP to Google's guest list. You need to send from your own domain — hello@herzog-physio.at — which any business with a website already owns, and which otherwise costs about €10 a year (the Module 4 advice, now upgraded from should-have to must-have). A dedicated subdomain (mail.yourdomain.com) protects your root domain's reputation; sensible later, not required at this scale.
If DNS scares you, delegate it with one email
The whole technical task is: copy two or three host/value pairs from your ESP's "domain authentication" screen into your registrar's DNS panel. If you'd rather not touch it, send your web person this and you're done:
"Could you add the DNS records our email tool needs? I've attached/pasted the exact records from [ESP]'s authentication page — they're TXT/CNAME records for SPF, DKIM and DMARC. Nothing existing should be deleted; note that if an SPF record already exists, the new entry must be merged into it, not added as a second record. Should take a few minutes — can you confirm when they're live?"
That last clause matters: two SPF records make SPF fail. It's the most common way this goes wrong, along with pasting a DKIM value with a trailing space. Verification typically completes within the hour, occasionally a day.
Tomas does the whole thing in 70 minutes
The cast's least technical member, on purpose. Sunday evening: MailerLite Free account; signup form built with the exact consent wording from his 8.2 policy, double opt-in switched on; the form linked from his Carrd page and the clinic site. Then the noticeboard: he pays the invoice for herzog-physio.at, so he has the registrar login — he copies the three records across, gets one DKIM failure (the trailing space), fixes it, waits out propagation over a coffee. Test send to a seed Gmail account, open "show original": SPF: PASS, DKIM: PASS, DMARC: PASS. Seventy minutes, €0, and everything he writes from now on starts from the inbox rather than the junk folder.
Reputation is habits, not settings
The records get you to the door; behaviour keeps you inside. Four habits: permission only (your 8.2 policy — bought lists destroy sender reputation faster than any setting can save it); steady volume (mailbox providers distrust silence followed by a blast — Lesson 8.6's rhythm); prune the unengaged (the sunset policy protects everyone who's left); and make unsubscribing effortless — an unsubscribe costs you one uninterested reader, while a spam complaint from someone who couldn't find the link poisons delivery to everyone else. Never make a leaver hunt.
Do
Exercise 8.4.1 — Set it up for real
Set up your email system: ESP account created, compliant double opt-in signup form live, domain authenticated. Keep the evidence with your plan. Budget an hour; DNS propagation sometimes adds a coffee break. If any step blocks you for more than 15 minutes, record it as "pending" with a note on the blocker, and move on — come back before Lesson 8.5.
Write these down — in your plan document, or on the worksheet at the end of this lesson.
| What to record | Guidance |
|---|---|
| ESP chosen | MailerLite · Brevo · Kit · or another you name |
| Why that one | 20–60 words, argued against the lesson's four criteria, not the tool's homepage |
| Signup form URL | The live, publicly reachable address — embedded on (or linked from) your Module 4 page |
| Double opt-in evidence | A screenshot of the DOI setting enabled |
| Authentication status | SPF / DKIM / DMARC, each: pass · pending · blocked — no domain. If blocked, get a domain first — Module 4 covers it, and it costs about €10 a year |
| Authentication evidence | For each pass: a screenshot of the ESP verification panel or Gmail "show original" headers |
| The plain-words test | Explain SPF, DKIM and DMARC to your boss in 80 words or fewer, total. Jargon that isn't explained doesn't count as explaining |
Sandbox students: the form must still be live and genuinely fire — build it in your own ESP account, carrying the case-business label. Never collect real strangers' data: test it yourself, then close responses if the tool allows.
Where this goes: section 8.4 — Infrastructure — of your Marketing Plan. This live system is the machine Lesson 8.5 loads and the Module 8 Project runs on.
Check
Rubric (for the plain-words test)
Mark your own work against these criteria.
| Criterion | 8–10 | 5–7 | 1–4 |
|---|---|---|---|
| All three mechanisms right | Guest list / seal / standing instructions each correct in function | Two right, one muddled | Mechanisms swapped or merged |
| Genuinely plain | A non-technical boss would nod along; no unexplained jargon | Mostly plain, one term left dangling | Reads like documentation |
| Fit for purpose | ≤80 words, and says why it matters to the business | Within limits, missing the "so what" | Over limit or off the point |
Pass: 5+ on every criterion. The exercise is only complete when the form is live at a public URL with double opt-in switched on.
Quiz — 4 questions
1. Which is the correct plain-English pairing?
- a) SPF = signature, DKIM = guest list, DMARC = spam filter
- b) SPF = list of allowed senders, DKIM = tamper-proof signature, DMARC = your published instructions for failures, plus reporting back to you ✔
- c) SPF = spam filter, DKIM = design kit, DMARC = marketing consent
- d) They are three names for one record
Why: three records, three jobs — who may send, proof it wasn't forged or altered, and what to do when checks fail. Get the jobs straight and every ESP's setup screen becomes legible.
2. Tomas wants to send the clinic newsletter from herzogphysio@gmail.com. Why will this fail?
- a) Gmail forbids physiotherapy content
- b) He can't authenticate a domain he doesn't control — gmail.com's own policies will fail his ESP's sends; he must send from his own domain ✔
- c) Newsletters legally require a national domain
- d) It won't — from-addresses are cosmetic
Why: authentication is domain-based, and only the domain's owner can add the DNS records. A ~€10/year domain is the cheapest deliverability purchase that exists — and Herzog already owns one.
3. Your web person reports an SPF record already exists on the domain. The correct instruction is…
- a) Add the ESP's SPF record as a second record
- b) Merge the ESP's entry into the existing SPF record — a domain with two SPF records fails SPF checks entirely ✔
- c) Delete the old record; the newest one wins
- d) Skip SPF; DKIM covers it
Why: one list per door. Two SPF records is the single most common self-inflicted authentication failure — and deleting the old record would break whatever legitimate sender (like the company's own mail) it was covering.
4. An unsubscribe and a spam complaint both lose you a reader. Why does this lesson treat them so differently?
- a) It doesn't — both are equally harmful
- b) Unsubscribes incur ESP fees
- c) An unsubscribe is a free, clean exit; a spam complaint tells mailbox providers your mail is unwanted, and complaint rates above roughly 0.3% damage delivery to everyone remaining on your list ✔
- d) Spam complaints are illegal under GDPR
Why: the person who can't find your unsubscribe link doesn't give up — they press "report spam", the one button that punishes your whole list. Making leaving effortless is self-defence.
Advance
You now have what most small businesses never build: a lawful list, a live form, and sending that arrives authenticated. The machine is idling. Time to load it.
Next: M8.L5 — The welcome sequence. Four emails, written once, that greet every future subscriber at their moment of maximum interest — while you sleep.
Mark your own work
| Good | Not yet | |
|---|---|---|
| ESP chosen on criteria | DOI, free-tier automation, EU hosting, export freedom all checked | Chosen because an ad or a friend said so |
| Form is live and lawful | Public URL, your 8.2 wording, DOI on | Draft form, or consent wording improvised |
| Authentication attempted | Three records added (by you or your web person), status known | "I'll do the DNS bit later" |
| Tested from the outside | Test send passed, headers checked in a real inbox | Trusted the ESP's green tick alone |
| You can explain it | 80 plain words your boss would follow | "It's technical, it just works" |
Worksheet
THE SCHOOL OF NET MARKETING
Lesson 8.4 — Pick your ESP and get delivered
CHOOSING — tick what your shortlisted tool offers FREE
Tool A ______ Tool B ______
Double opt-in ☐ ☐
Automations ☐ ☐
EU data hosting ☐ ☐
Full list export ☐ ☐
Chosen ESP: ________________________________________
SETUP ORDER (≈ one hour)
1. ☐ Create the free account
2. ☐ Build signup form — paste your 8.2 wording,
switch DOUBLE OPT-IN ON
3. ☐ Put the form on / link it from your live page
4. ☐ Open the ESP's "authenticate domain" screen
5. ☐ Copy each record into your registrar's DNS
— or send the delegation email (lesson text)
⚠ existing SPF record? MERGE, never add a 2nd
⚠ watch for trailing spaces when pasting
6. ☐ Wait for verification (minutes–hours)
7. ☐ Test send to a Gmail you control →
"show original" → SPF PASS DKIM PASS DMARC PASS
MY THREE RECORDS, IN PLAIN WORDS (≤80 words, for the boss)
SPF: ______________________________________________
DKIM: ______________________________________________
DMARC: ______________________________________________
REPUTATION HABITS — the settings can't save you from you
☐ Permission only — no bought or found addresses, ever
☐ Steady volume, no silence-then-blast
☐ Prune the unengaged (Lesson 8.6 sunset)
☐ Unsubscribe: one click, no login, no hunting
Next: Lesson 8.5 — The welcome sequence.
theschoolofnetmarketing.com/learn/the-welcome-sequence