How email works
Every jargon word, in plain English
Not an A–Z. 41 words, each one placed at the moment it actually happens to an email.
Your building
Their building
What comes back
You get the address
Someone hands you an email address, and the terms of that handover decide everything after it.
The 9 words that live here →Before you read any of it
12
of these 41 words are not your problem
Already handled by the platform, or impossible to act on at all. Knowing which is which is most of the job, and it is the one thing nobody who sells deliverability software is able to tell you.
- 22
- Yours
- Nobody does this for you
- 7
- Part yours
- The platform does part; the rest is genuinely yours
- 5
- Your platform
- Klaviyo, Mailchimp and friends do this automatically
- 7
- Nobody's
- Nothing to action — it changes a number or a risk you report
If you are new
The words that explain the rest, in order
Each one makes the next one obvious. Ten minutes, and the rest of this page reads itself.
You get the address
Weeks or years earlierSomeone hands you an email address, and the terms of that handover decide everything after it.
Why this stop decides things
Every legal problem in email is created here and discovered later. Nothing further down the journey can repair a badly collected address: not authentication, not design, not a better subject line. The words at this stop are about one question — what exactly did this person agree to, and can you prove it a year from now.
- ConsentYours
We can prove this person asked for our email, what they were shown, and when.
- Opt-inYours
They asked us to email them. We did not decide for them.
- Double opt-inYours
We email them once to check the address is really theirs before we ever market to them.
- Soft opt-inYours
There is a narrow exception for our own customers, and it has four conditions we have to meet all of.
- CAN-SPAMYours
The US rule. We do not need permission first, but we do need honesty, an address and a working unsubscribe.
- CASLYours
Canada is the strict one. Consent has to be provable, and the kind we get from a purchase expires.
- PECRYours
The UK rule for marketing messages. It sits on top of GDPR, and the ICO enforces it separately.
- ePrivacyYours
The EU email rule. It is a Directive, so every country wrote its own version and they are not identical.
- GPCYours
A browser signal about selling and sharing data. It is not an unsubscribe, and treating it as one is its own mistake.
You build the message
The hour before sendYou choose a From address, write a subject line, and add the things the law requires to be in the message.
Why this stop decides things
Your platform does most of this, which is exactly why the parts it does not do get missed. Four things in a marketing email are regulated by name: who it is from, what the subject line promises, whether a postal address is present, and whether someone can get out. Everything else at this stop is design.
- ESPNobody's
The tool we send from. Klaviyo, in our case. It is not the same thing as our website or our inbox.
- From domainYours
The bit after the @ that customers actually read. Everything we prove has to match it.
- Transactional emailYours
Receipts and password resets. Calling a promotion transactional to skip the rules does not work.
- CEMAYours
A Washington state law about subject lines. False urgency in a subject line is a live legal risk in the US, not just a taste question.
- One-click unsubscribeYour platform
Gmail's own unsubscribe button. Our platform adds it, and it has to be two headers, not one.
- Tracking pixelPart yours
The invisible image that tells us an email was opened. In some countries it needs its own consent.
It leaves your building
MillisecondsYour platform hands the message to a mail server, which stamps it with proof of who sent it.
Why this stop decides things
This is the stop marketers are most afraid of and least responsible for. The proof is assembled automatically from records you published in DNS, usually once, usually years ago. You almost never touch this on a Tuesday. But when it is wrong it is silently, totally wrong, and nothing in your platform will tell you.
- DNSYours
The public record of who is allowed to send email as us. We control it, not our email platform.
- SPFPart yours
A public list of the servers allowed to send as us. Anything else looks like a forgery.
- DKIMPart yours
A tamper-proof seal on every message. The receiver checks it against a key we publish publicly.
- TLSYour platform
The email is encrypted while it travels between servers. Our platform handles it.
- PTR / reverse DNSYour platform
The sending server's address has to resolve back to a real name. On a shared platform this is theirs, not ours.
- Shared vs dedicated IPPart yours
Almost everyone sends from a shared address the platform manages. Our own only helps above real volume, and it has to be warmed first.
Their building — not in your platform
Identity gets checked
Under one secondThe receiver works out whether the message really comes from who it says it does.
Why this stop decides things
Three separate questions get asked here, and the third is the one everybody skips. Did an allowed server send this? Is the signature valid? And — the one that fails while the first two pass — does either of those actually belong to the brand name in the From line? Note what none of these ask: whether anyone wants the mail. Passing all three is a gate, not a verdict. It makes you eligible to be judged. The judging happens at the next stop.
Why a message sits in spam while every dashboard is green
What the human sees
From: Aurora Coffee <hello@aurora.com>
The only address a recipient will ever read. Everything below exists to decide whether to believe it.
What the receiver asks, in order
- 1SPFWas this server allowed to send?pass
Reads mail.esp-vendor.com — the invisible envelope, not the From line.
- 2DKIMIs the signature valid and untampered?pass
Reads esp-vendor.com — the domain that signed, which need not be yours.
- 3AlignmentDoes either of those belong to aurora.com?no
Reads neither — the step almost every explainer leaves out.
4 · DMARC decides what happens next
Nothing that passed belongs to aurora.com, so DMARC fails. What that costs you is whatever your own DNS record says it costs.
- p=none
- delivered anyway, and you are told nothing
- p=quarantine
- spam folder
- p=reject
- refused at the door
Both checks passed. The message still fails, because passing and belonging are different questions and only the second one is about you. Alignment, in full. And when all four rows are green, nothing here has yet decided the folder — that is the next stop.
- Bulk senderNobody's
Above five thousand a day to one provider, stricter rules apply. Most of us cross that line without noticing.
- AlignmentPart yours
The check that what we proved is actually about us. This is the one that fails while everything else looks fine.
- DMARCYours
Our written instruction to Gmail about what to do with mail that fails our checks: ignore it, bin it, or refuse it.
- BIMIYours
Our logo next to the message in some inboxes. It is a reward for strong authentication, not a fix for anything.
- Email headersNobody's
The hidden technical record at the top of a message. It is the only place that shows what actually happened.
Their building — not in your platform
Reputation decides
The same secondHaving proved who you are, you find out whether they want you — and that is mostly about your history, not this message.
Why this stop decides things
This is the stop that authentication checklists pretend does not exist, and it is where placement is actually decided. SPF, DKIM and DMARC answer “is this really you”. Nothing about passing them says a human wants your mail. The second question is settled by what your domain has done before: who opened, clicked, replied, dragged you out of spam, or reported you. A brand-new domain has no answer to that question at all, which is a different problem from having a bad one, and the two are fixed in opposite ways. No provider publishes the weights, and anybody who tells you they know them is selling something.
Identical authentication, identical message, different sender history
What the provider knows about you
NEWNothing. You did not exist last month.
2YRMonths of how real people reacted.
Volume it will accept
NEWSmall, and rising only while complaints stay flat.
2YRAbsorbs a spike without comment.
One bad send
NEWCan define you. There is nothing else to average against.
2YRDiluted by history, but it still costs you.
Perfect SPF, DKIM, DMARC
NEWRequired. Not enough.
2YRRequired. Not enough.
Getting it back
NEWDays, if you catch it in the first week.
2YRWeeks. There is more record to unwind.
Both pass every check at stop 4. Only one of them gets the benefit of the doubt at stop 5, and no DNS record you can publish will close that gap. Warm-up is how the left column becomes the right one.
- EngagementYours
Whether people actually want our email. It decides the folder more than anything technical does, and it is not the open rate.
- Sender reputationYours
Gmail's running opinion of us, built over months. One send does not create it, and one bad send can dent it.
- Warm-upPart yours
A new sending domain has no history at all. We start small with our best people and build up, because there is nothing yet to give us the benefit of the doubt.
- Inbox placementNobody's
Where it lands is decided person by person, not campaign by campaign. There is no one inbox rate for a send.
The verdict lands
Instant, and invisibleThe message goes to an inbox, a spam folder, a refusal, or an address that was never a person.
Why this stop decides things
Your platform reports "delivered", which means the receiving server accepted the message, not that a human will ever see it. The spam folder is a delivery. That gap between accepted and seen is where most of the anxiety in this job lives, and the words at this stop are the failures that are visible rather than inferred.
- Hard bounceYour platform
That address does not exist. We stop sending to it immediately and permanently.
- Soft bounceYour platform
A temporary failure. The platform retries, and after enough of them it gives up on the address.
- Spam trapYours
An address that exists only to catch people mailing lists they should not have. Hitting one is a data problem, not a sending problem.
A human reacts
Minutes to daysSomebody opens, clicks, ignores, unsubscribes, or presses the button that costs you the most.
Why this stop decides things
One of these reactions is worth more attention than all the others combined. Not the open, which is now largely a machine. Not the click. The complaint: a fraction of one percent of your recipients pressing Report spam is the difference between arriving and not, and it is measured against you at every provider separately.
- Complaint rate / spam rateYours
The share of people who press Report spam. Three in a thousand is the line, and crossing it is what puts us in the spam folder.
- Opt-outPart yours
The unsubscribe. It has to be easy, it has to be fast, and it has to apply everywhere we send from.
- Apple MPPNobody's
Since 2021 Apple loads the tracking image automatically. Our open rate counts machines, not people.
It comes back as numbers
The next morningThe reactions become a dashboard, and the dashboard is lying to you a little.
Why this stop decides things
The numbers you were trained on broke in September 2021 and nobody sent a memo. Opens are partly machines. Revenue is partly coincidence. The vocabulary here exists to tell you which figures still carry information and which ones you are quietly making decisions on for no reason.
- Open rateNobody's
The number everyone still reports and almost nobody should be deciding anything with.
- rua (DMARC reports)Yours
A daily report from every major provider telling us who is sending email as us. Without it we are publishing policy blind.
- Seed test / seed listNobody's
Sending to a panel of test inboxes to guess where mail lands. Two tools will give two different answers.
- Holdout groupYours
A group we deliberately do not email, so we can prove the revenue came from the email and not from the customer.
- Sunset / sunsettingYours
We stop emailing people who have ignored us for months. It sounds like losing a list; it is how the rest of it arrives.
Alphabetical
All 41, if you came for one word
The number is the stop it happens at.
- Alignment04
- Apple MPP07
- BIMI04
- Bulk sender04
- CAN-SPAM01
- CASL01
- CEMA02
- Complaint rate / spam rate07
- Consent01
- DKIM03
- DMARC04
- DNS03
- Double opt-in01
- Email headers04
- Engagement05
- ePrivacy01
- ESP02
- From domain02
- GPC01
- Hard bounce06
- Holdout group08
- Inbox placement05
- One-click unsubscribe02
- Open rate08
- Opt-in01
- Opt-out07
- PECR01
- PTR / reverse DNS03
- rua (DMARC reports)08
- Seed test / seed list08
- Sender reputation05
- Shared vs dedicated IP03
- Soft bounce06
- Soft opt-in01
- Spam trap06
- SPF03
- Sunset / sunsetting08
- TLS03
- Tracking pixel02
- Transactional email02
- Warm-up05
Whose job it is
- Yours
- Nobody does this for you
- Part yours
- The platform does part; the rest is genuinely yours
- Your platform
- Klaviyo, Mailchimp and friends do this automatically
- Nobody's
- Nothing to action — it changes a number or a risk you report
How deep
- Week one
- The words you cannot work without
- Working
- You will meet these within a quarter
- Deep
- Deliverability lead territory