This free email campaign QA checklist runs once for every send, whether it is the weekly newsletter or a product announcement to the whole list. It covers the segment and suppressions, the consent basis, copy and footer proof, rendering and links, sender authentication, a sign-off that stops the send when it is refused, and the first two days afterwards. It is the check that sits inside a campaign, not the campaign plan itself: the brief, budget and channel mix belong in the Campaign Launch Checklist.
Mistakes ship as copies. A typo on a web page takes a minute to fix. An email arrives as a separate copy in every inbox, so the checking has to happen before the button is pressed. The errors that get through are rarely exotic: a merge tag that prints “Hi {first_name}”, a discount code that expired yesterday, a link tagged with a different campaign name from the rest, or a segment rebuilt from last month’s filter.
Your reputation is shared across sends. Mailbox providers judge a sending domain on its history, not on one message. Gmail asks every sender to keep the spam rate shown in Postmaster Tools below 0.3% and advises staying under 0.1%, so one badly targeted send can undo months of good ones. Gmail has required sender authentication since February 2024 and began ramping up enforcement in November 2025, including temporary and permanent rejections of mail that falls short. Yahoo and Microsoft’s Outlook.com apply similar rules to high-volume senders.
The law follows the reader, not the sender. A US list and a UK list need different checks, and many lists hold both. The comparison below summarises the main rules the checklist turns into tasks. It is a QA aid, not legal advice: the consent phase ends by referring anything uncertain to your own data protection officer or counsel before the send is approved.
Split the roles. The person who builds the email runs most of the checks, a second person proofs the copy, and a named approver signs off. Agencies usually make the client the approver. The split matters because the builder has read the copy so often they no longer see it.
Basis: no prior consent is needed for commercial email, but every recipient must be able to opt out.
In every message: accurate header and From details, a subject that does not mislead, identification as an advertisement, and a valid physical postal address.
Opt-outs: the mechanism must work for at least 30 days after the send, and requests must be honoured within 10 business days. You stay liable if a vendor sends for you.
Penalty: up to $53,088 for each email in breach.
Basis: consent for marketing email to individuals and sole traders, unless the soft opt-in applies: existing customers, similar products, an opt-out offered at collection and in every message.
Companies: corporate addresses can be emailed without consent, but the ICO recommends keeping a do-not-email list.
Changed in 2026: the Data (Use and Access) Act 2025 changes took effect on 5 February 2026 and added a soft opt-in for charitable purposes.
Penalty: raised from £500,000 to up to £17.5 million or 4% of global turnover.
Seven phases for every send. Two of them appear only when the scope answers in Phase 1 say they apply.
Shown when the send includes recipients in the UK or the EU.
Shown when you send around 5,000 or more messages a day to personal Gmail, Yahoo or Outlook.com addresses.
Phase 5 exists because the three largest consumer mailbox providers now publish rules for high-volume senders. Gmail counts close to 5,000 messages a day to personal Gmail accounts, and a sender that reaches it once is treated as a bulk sender from then on. Microsoft uses 5,000 a day for Outlook.com. Yahoo publishes its bulk requirements without a number, so if you are near the line for one provider, meet the rules for all three.
| Check | Who asks for it | How to verify |
|---|---|---|
| SPF and DKIM both pass | Gmail, Yahoo and Outlook.com for bulk senders. Gmail asks every other sender for at least one of the two | Open a seed message’s headers and read the Authentication-Results line |
| DMARC published and passing | All three; p=none is enough. Gmail also requires the From domain to align with SPF or DKIM | Look up the _dmarc record for the From domain, then check dmarc=pass in the seed headers |
| One-click unsubscribe | Gmail requires it for marketing and subscribed mail. Yahoo strongly recommends it and accepts a mailto link | Find List-Unsubscribe (with an HTTPS address) and List-Unsubscribe-Post: List-Unsubscribe=One-Click in the headers |
| Visible unsubscribe link | Gmail and Yahoo for bulk mail; CAN-SPAM requires a clear opt-out in every commercial email | Find it in the footer of the rendered proof, on mobile as well as desktop |
| Spam rate | Gmail and Yahoo: below 0.3%. Gmail advises staying under 0.1% | Gmail Postmaster Tools for the sending domain, checked before each large send |
| Unsubscribes processed | Gmail recommends 48 hours, Yahoo asks for two days, CAN-SPAM allows 10 business days | Unsubscribe a test address after the send and time how long until it is suppressed everywhere |
| What happens if you miss | Gmail: temporary and permanent rejections since November 2025. Outlook.com: Junk folder from 5 May 2025, rejection possible later | Watch bounce codes and deferrals in your sending platform after each send |
Email platforms often manage these records and headers on your behalf, which is why the checklist asks you to confirm them in a real seed message rather than on the platform’s settings screen. A platform can sign messages with its own domain instead of yours: DKIM passes, but the signature does not align with your From domain, so DMARC fails. The headers of one seed message show the difference in seconds, and the screenshot goes on the approval task as evidence.
Answer two questions when the checklist starts. A US-only newsletter skips the UK and EU consent phase, and a small send skips the bulk-sender phase, so nobody ticks boxes that do not apply and nobody forgets the ones that do.
The approver is chosen in Phase 1 and assigned the approval task. If they pick Not approved, the checklist halts and the scheduling task cannot be reached. The proof and seed screenshots sit on the task above, so the approver signs off what was tested.
Each send gets its own checklist with names, dates and comments. When a complaint spike or a wrong price needs explaining, the history shows who checked the segment, who approved and what the seed test looked like.
Most emails point somewhere. Before a send drives clicks to a new page, run the Landing Page QA Checklist on it, so the form, tracking and offer on the page match what the email promised.
Regular newsletters can start their QA checklist automatically with recurring checklists, and agencies can run one per client with the client as approver. See how CheckFlow approvals route sign-off to the right person and halt the work when it is refused.
At minimum: the segment and suppressions, a proof of the subject line, preheader, body and footer, a rendering test in the clients your list actually uses, a click test of every link, a seed send to check inbox placement, and a named person who approves the send. Add consent checks for UK and EU recipients and the authentication and unsubscribe header checks if you send in bulk. Finish with a review of bounces, complaints and unsubscribes after the send.
Gmail’s bulk rules apply if you send close to 5,000 or more messages in a day to personal Gmail accounts, and once you have reached that level you are treated as a bulk sender permanently. Microsoft uses 5,000 a day for Outlook.com, and Yahoo does not publish a number. Some rules apply to every sender regardless of volume: Gmail asks all senders for SPF or DKIM and a spam rate below 0.3%. If your list is growing, set up the bulk requirements before you need them.
It is a standard, defined in RFC 8058, that lets the mail app show its own unsubscribe button and remove the reader without opening a web page. The message carries a List-Unsubscribe header with an HTTPS address and a List-Unsubscribe-Post header, both covered by the DKIM signature. Gmail requires it for bulk marketing mail, alongside a visible unsubscribe link in the body. If your email platform adds the headers for you, still open a real seed message and confirm they are there.
For individuals and sole traders, PECR generally requires consent, unless the soft opt-in applies to existing customers who bought or discussed buying a similar product and were offered an opt-out. Companies can be emailed without consent. The Data (Use and Access) Act 2025 kept these rules, added a soft opt-in for charitable purposes and raised the maximum fine. EU countries apply a similar rule under the ePrivacy Directive, implemented nationally. Confirm how the rules apply to your lists with your own DPO or counsel; this template records the check, it does not replace advice.
Test where your readers are, not every client that exists. Your email platform’s reports show which clients opened recent sends, though Apple Mail Privacy Protection loads images in the background when a message arrives, so Apple figures are inflated. A sensible set is Outlook on Windows, Gmail on the web and on Android, Apple Mail on iPhone, and dark mode in at least one of them. A preview tool such as Litmus or Email on Acid speeds this up, but still send one real seed to a phone.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
