How to set up email marketing for a small business

On May 5, 2025, Microsoft's consumer mail servers began answering some senders with one line: 550 5.7.15 Access denied. The message was not filed under spam and not held for review. It was refused at the door, and the person who sent it saw nothing at all.

That line is the sharp end of rules Google, Yahoo and Microsoft rolled out between 2023 and 2025. A from-zero email setup now starts with DNS records at your domain registrar, before you pick a template. Four things have to be true before your first campaign earns anything: a platform priced for the way you send, an authenticated sending domain, one offer worth an email address, and a welcome email that goes out within minutes of signup. If you are still weighing whether to build a list at all, our piece on owned audiences versus rented reach makes that argument. This guide covers the build.

One number should go before any of it, because you will meet it in every guide on this subject. Email returns $36 for every $1 spent, the line goes. The Litmus page carrying that figure states it flat, with no study, sample size or year attached anywhere on it. Litmus sources its return data to a 2020 State of Email Survey of more than 2,000 marketing professionals and a 2025 survey of about 500. Both asked marketers to estimate their own return, so the number reports opinion rather than revenue. The 2025 survey gives a spread instead of a single figure: 35% of respondents put their return between $10 and $36, 30% between $36 and $50, and 5% above $50. A third of the people surveyed landed under the number that gets quoted.

Owners rate the channel highly without needing the inflated number. Constant Contact surveyed more than 1,500 small business owners across five countries in early 2026 and found 41% expecting email to be among their most valuable channels this year, behind social media at 68%. The per-send revenue data points the other way.

Start with the platform, because the pricing model you pick is the decision that gets expensive to undo.

The comparison articles rank on features. The bill arrives on a different axis. Every platform in this category charges on one of two models, and the model you land on decides what you pay far more than any feature does. Mailchimp, Klaviyo, Kit and Constant Contact bill by contacts stored. Brevo bills by emails sent. A roofing company with 8,000 past customers who hear from it twice a year pays for all 8,000 addresses every month on the first model, and pays for 16,000 sends a year on the second.

The table below is a snapshot taken on 3 August 2026. Pricing in this category decays fast, and three of these six vendors changed their free tier in the previous eighteen months, so open the vendor's own page before you commit to one.

Three of those free tiers shrank while the ranking articles kept quoting the old ones. Mailchimp went from 500 free contacts to 250 in February 2026. MailerLite went from 1,000 subscribers to 500 in September 2025. Kit's free plan covers 1,000 subscribers, and a search result published this year will still tell you it covers 10,000. A plan built on last year's limits hits a paywall in month two.

Three others are worth naming. Omnisend is ecommerce email and SMS with a generous free tier, and its published benchmarks are the source for most of the performance numbers in this guide. EmailOctopus runs on Amazon SES and is cheap on purpose. ActiveCampaign is where you go when your automation logic outgrows a starter tool, and it is more than a first setup needs. We mapped the rest of the small business tech stack separately.

Three DNS records at your domain registrar do the work, and you add them once. SPF is a published list of the servers allowed to send mail as your domain. DKIM is a cryptographic signature that proves a message came from you and was not altered on the way. DMARC tells receiving servers what to do when a message fails those checks, and asks them to send you a report about it.

Google's sender guidelines have required SPF and DKIM, plus a DMARC record, from anyone sending more than 5,000 messages a day to Gmail since February 1, 2024. Yahoo announced the same three in October 2023 and added a rule of its own: unsubscribe requests honored within two days. Microsoft joined on May 5, 2025 for outlook.com, live.com and hotmail.com at the same daily threshold, and Microsoft is the one that rejects rather than junks.

1. 1

   Find your DNS panel

   It lives with whoever sold you the domain. GoDaddy, Namecheap, Cloudflare and Squarespace all call the screen DNS or Domain settings. Every record below is a new entry on that screen.
2. 2

   Publish one SPF record

   Add a TXT record on the root domain holding a single line that names your senders, in the form v=spf1 include:_spf.google.com include:spf.brevo.com ~all. Your platform publishes its own include value in its setup screen. A domain gets one SPF record and only one, so add each new sender to the existing line rather than publishing a second record.
3. 3

   Add the DKIM records your platform generates

   Every platform in the table above produces these for you, usually as two CNAME records named along the lines of s1._domainkey and s2._domainkey. Paste them exactly as given. This is the step owners skip once SPF alone makes mail deliver.
4. 4

   Publish DMARC at monitoring

   Add a TXT record at _dmarc.yourdomain.com holding v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com. The p=none tells receiving servers to watch and block nothing, which is where a new sender starts. The rua address is where the daily reports arrive.
5. 5

   Confirm the records resolve

   MXToolbox, dmarcian and EasyDMARC each run free lookups. DNS changes take hours to spread, so check the next morning rather than the next minute.
6. 6

   Read the reports for 30 days, then tighten

   Once the reports show your legitimate senders passing, change p=none to p=quarantine. Skip this and you join the majority: of the 937,931 domains EasyDMARC found carrying DMARC, only 411,935 had moved to an enforcement policy.
7. 7

   Turn on Google Postmaster Tools

   It is free, it comes from Google, and it is the only place to see your real Gmail spam-complaint rate against the thresholds Google enforces. Verification uses one more TXT record on the domain you already have open.

The gap between big companies and small ones here is wide. EasyDMARC's 2026 report puts Fortune 500 adoption at 95%, with over 80% at enforcement, while more than half of the Inc. 5000 sit at monitoring only. The largest companies finished this work and most smaller ones did not, so an afternoon of DNS edits puts a small business ahead of much of its competition.

Omnisend measured 1.24 billion popup displays in 2025 and 26.4 million email addresses collected from them. That works out to 2.1%. Competing articles quote 4.82%, 4.2%, even 11.09%, and those figures come from popup vendors reporting their own best customers. Judge your form against 2.1%, and treat anything above 3% as a good result.

Three settings move that rate, and the same dataset measures all three. Popups offering an incentive converted at 2.4% against 1.7% without one. A spin-the-wheel format reached 3.5% against 2.0% for a plain form. A 6 to 10 second delay beat firing on arrival, and scroll triggers at about 2.1% beat exit-intent at about 1.8%. For a retail or ecommerce site the incentive is a discount code. For a service business it is something worth keeping, like a pricing guide or a seasonal maintenance checklist.

The website is not where most local businesses collect addresses. A line on the invoice and a technician asking at the end of the job will out-collect the popup for most trades and home-service companies, and each of those asks reaches someone who already paid you.

Double opt-in sends a confirmation email and adds only the people who click it. It costs you subscribers, and the trade is a real one: a confirmation step filters out typos, fake addresses and spam traps, so the list you keep produces fewer complaints. The study most often cited in its favor is more than a decade old and predates the 2024 sender rules. The reason to use it in 2026 is plainer: complaint rate is the number Google enforces on, and confirmed lists complain less.

Omnisend's 2025 dataset covers more than 20 billion campaign emails and 470 million automated sends across over 27,000 brands, and it reports the two separately. Campaigns earned $0.155 per email sent. Automated emails earned $3.41, about 22 times as much, on a click-through rate of 4.66% against 0.74%. That data is weighted toward ecommerce, so the dollar figures will not transfer to a plumbing company. The ratio will.

The welcome email is the first build, and it out-earns every other automation per send. In the same dataset it opened at 35.53%, was clicked at 3.94%, converted at 2.11% and returned $6.16 per email, ahead of the abandoned-cart email at $3.59. It arrives when attention is highest, which is the same reason a welcome email that fires three weeks late reads like a stranger's.

The second build is the follow-up after the transaction. For a store that is the abandoned-cart sequence. For a service business it is the estimate that got sent and never answered, and the review request a week after the job. The third is a broadcast on a cadence you can hold. Twice a month is the honest floor. Send less often than that and subscribers forget who you are, which is how a quiet list turns into a complaint generator the first time you arrive with an offer.

We build those three in that order for clients on an email marketing engagement, because the fourth month depends on the first one being right. An apparel client's program is published in full: $541,000 in six months, a 67% open rate on its best campaign, and 14,000 VIP members.

One more step belongs in month one, and every platform in the table supports it on an entry plan. Tag the people who have bought and the people who have not, then send the same email twice with two different opening lines. Two versions beat one generic version.

Google publishes two numbers and most articles quote only one. Keep the spam rate reported in Postmaster Tools below 0.10%, and treat 0.30% as a hard ceiling. At 5,000 messages, 0.30% is fifteen complaints. That is the whole margin.

Four more requirements come with it, and your platform handles most of them. Marketing mail has to support one-click unsubscribe, which means two specific headers, and a visible unsubscribe link still has to appear in the body. Mail has to move over a TLS connection. Your sending domain or IP needs valid forward and reverse DNS records, the PTR records your host controls. Yahoo adds that unsubscribe requests get honored within two days.

Clean the list quarterly, before it becomes urgent. Send one email asking whether people still want to hear from you, then suppress the ones who have opened nothing in six months. A meaningful share of any list goes stale within a year through job changes and abandoned addresses. The precise rate gets quoted as 22.5% a year across dozens of blogs with no study behind it, so treat list decay as a habit to manage rather than a formula.

Two things break a sending domain fast. A purchased list is the first, and it violates the terms of every platform in the table above while guaranteeing complaint rates past the 0.30% ceiling. The second is quieter: a rebrand, a migration, or a new tool that sends on your behalf, each of which needs its own SPF include and DKIM key. Authentication that worked for four years can break in an afternoon, and nobody notices until the invoices stop arriving.

Set a reminder for the morning after you publish the DNS records and check them again, because the version of this that goes wrong is silent. The mail leaves, the platform reports it as sent, and 550 5.7.15 Access denied is the only receipt anyone gets.