How to run an email campaign, step by step

You have a list of addresses, something new to announce and your sending tool open: running an email campaign seems to take three clicks. The trouble comes afterwards. The message lands in spam, or a recipient asks where you got their address. And the open rate, which the tool displays in big numbers, no longer tells you much about what happened.

This guide goes through the steps in the order in which they play out, with the rules of the CNIL (France’s data protection authority) and the requirements that Gmail imposes on senders. It extends our guide to marketing automation for SMEs, which places email among the other marketing tasks that can be handed over to tools.

What are the steps of an email campaign?

An email campaign is prepared in six steps, and the first three are settled before you write a single line:

1. 01Check who you are allowed to write to.

   Keep a record of each contact’s consent.

2. 02Authenticate the sending domain.

   This is what lets mailbox providers recognise your messages.

3. 03Choose the tool that sends.

   Connect it to your CRM or your store.

4. 04Write a message that carries a single action.

   It says who you are and gives a simple way to unsubscribe.

5. 05Send it to yourself first.

   Read it on a phone and on a computer, then send it to the list.

6. 06Measure clicks, replies and unsubscribes.

   Compare them with your previous sends, and adjust the next one.

Who are you allowed to write to?

The basic rule fits in one sentence on the CNIL’s page on prospecting by email: people must first be informed, then “consent to it beforehand if they are private individuals, or be able to object to it if they are professionals”. Four situations come up often, and the same page answers each of them precisely.

• The tick box. For a private individual, consent requires “a positive and specific action”, for example a dedicated box that is not ticked in advance. “Acceptance of general terms of use cannot be sufficient.” For a professional, the CNIL also recommends collecting their right to object through a box, “unticked by default to allow people to object”.
• The account created without a purchase. The CNIL allows an exception for existing customers, when the message concerns similar products or services from the same company. It specifies that this exception “cannot be relied on when no sale or provision of services has taken place, including when the customer has created an online account”.
• Business addresses already in your database or bought. The message must be relevant to the person’s profession. And when the addresses come from your own files or from a third party, you must make sure that the person “has been informed of the possible use of their email address […] for prospecting and is able to object to it”.
• Generic addresses. An address such as contact@ or info@ belongs to a company, not a person: according to the CNIL, it falls outside the principles set out for professionals. The message must still say who sends it and allow people to refuse further messages, like any prospecting email.

For each contact, keep the source of the address, and the date and form of consent: that is what you will show if someone asks where you got their address. The CNIL also reminds us that requests to exercise data rights call for a reply “within a maximum of one month, barring exceptions”.

A clean list starts in the CRM, with a single record per person: the method is in Cleaning your CRM data: duplicates, fields and rules. When two records are merged, the record of consent must follow the record that is kept.

That record must exist even when a send fails.

The same rule applies to a sign-up: the ticked box and its date are saved before the confirmation email.

How do you stop your emails landing in spam?

Since 1 February 2024, Gmail has imposed rules on everyone who sends it emails, set out in Google’s guidelines for senders. The requirements that matter here depend on your volume:

Whatever your volume, Google recommends that you “always set up SPF, DKIM, and DMARC”, and warns that unauthenticated messages “might be marked as spam or rejected”.

• SPF lists the servers authorised to send on behalf of your domain. It “should include all email senders for your domain”: your mailbox, your sending tool, your CRM, your store. Messages from a forgotten sender “are more likely to be marked as spam”.
• DKIM signs each message, and the server that receives it uses the signature to “verify that the domain owner actually sent the message”.
• DMARC “tells receiving servers what to do with your messages that don’t pass SPF or DKIM”, and can have reports sent to you.

Order matters, and this is a lesson from Palmora Property: without domain authentication, a strict DMARC policy destroys any campaign. So work in this order:

The rest depends on the reputation of your domain. Google asks you to write only to “people who want to get messages from you”, and warns: “If messages from your domain are frequently reported as spam, future messages from you are more likely to be marked as spam.” It also advises verifying each recipient’s address before subscribing them, and automatically unsubscribing addresses that have rejected your messages several times.

Which tool should you choose to send your emails?

Two families of tools share the work. The CRM keeps the contacts, their history and the record of their consent. We have been using Twenty, an open-source CRM, in production since early 2025, and we contribute to the project: it is not a campaign tool, and we say so in Twenty CRM in production: our view, limits included. Bulk sends then go out from a dedicated sending service, connected to the CRM. If you use such a provider, Google asks you to “verify that they authenticate your domain’s email with SPF and DKIM”.

A store often has its own mailings. On an online store that we are getting back on track, we chose the store’s native foundation rather than a paid suite for post-purchase messages: the thank-you, the advice, the reminder for a second order and the review request.

Whatever the tool, five points need checking before you commit:

• it sends from your domain, authenticated with SPF and DKIM;
• it offers one-click unsubscribe;
• it exports your contacts with their record of consent;
• it connects to your CRM or your store, with no re-entering of data;
• you know where your contacts’ data is hosted.

What should the message contain?

One email, one action. If you want people to book a call, do not add the announcement of something new: two requests in the same message compete with each other. Keep a subject line that says what the message contains, a sender name the recipient recognises, an address on your domain and a clearly visible main link.

Two mentions are non-negotiable. According to the CNIL, each solicitation must make it possible to know “the identity of the organisation that sends it” and to express “by simple means” a refusal to receive further ones. Above 5,000 messages a day to Gmail, Google also requires one-click unsubscribe and “a clearly visible unsubscribe link in the message body”. Plan for both from the first send, whatever your volume: it is simpler than adding them the day you cross the threshold.

How do you test an email campaign before sending it?

Send the message to yourself first, on a phone and on a computer. Check every link, how it reads when images do not load, the sender name and the unsubscribe link. Finally, reread every promise and every price: an email that has gone out cannot be called back.

How do you measure the results of an email campaign?

The open rate is the figure tools display first, and the one that tells you the least.

The same Apple feature “does not extend to links”: a click remains more telling than an open. Track these instead:

• clicks on the main link;
• replies and requests that follow the send;
• sales or appointments you can link to the send;
• unsubscribes and spam reports.

Compare these figures with your own previous sends rather than with industry averages, which mix lists that have nothing to do with yours. For the spam rate measured in Postmaster Tools, Google’s requirement is to stay under 0.30%; its stricter recommendation is to stay “below 0.10%” and to avoid reaching 0.30%.

For the day and time of sending, there is no universal right answer: our marketing automation guide explains how to test two time slots on two comparable halves of your list.

What can AI do in an email campaign?

None of the above needs AI: choosing who receives, authenticating a domain, sending a test and counting clicks all follow rules.

AI becomes useful after the send, to sort the replies: a question about a product, a request for a meeting, an out-of-office message, a request to receive nothing more. It suggests a classification, a person handles each reply, and an unsubscribe request written out in plain words must never get lost in the sorting.

Where to start

Before your next send, do two checks. In your sending tool, look at whether your domain is authenticated with SPF and DKIM, as Google requires. In your list, check that each address has a source and a record of consent, and set aside those that do not.

To prepare this send with an outside perspective, describe your next send and the tool that will carry it. When email nurtures the contacts your ads bring in before they are ready to buy, it fits into our digital marketing in one block offer, with Google Ads, SEO and the CRM.

Frequently asked questions

Sources

1. The CNIL’s page on prospecting by email (new tab)cnil.fr
2. Google’s guidelines for senders (new tab)support.google.com
3. Mail Privacy Protection (new tab)support.apple.com