Email 101: the open channel people keep

Email is the oldest digital channel a business still uses every day, and the only one that no single company owns. Any organisation can send from its own domain, and any person can hold an address with any provider. It is where people expect receipts, invoices, statements, account notices and newsletters: the messages they may want to keep, search and forward.

• What it is: messages between addresses (name@domain) carried over open internet standards.
• Who runs it: nobody in particular. You own your domain; the recipient's mailbox provider (Gmail, Yahoo, Outlook.com, a company's own server) decides what reaches the inbox.
• Reach: the Radicati Group counted more than 4.4 billion email users in 2024.¹
• Who may start the conversation: the business may write first, but marketing needs permission in most countries (see the rules below).
• How it is priced: by volume or by number of contacts, paid to the service that sends for you. The receiving side charges nothing.
• Best for: records, long content, attachments, newsletters, anything a person files.
• Avoid for: urgent alerts and one-time codes where seconds matter.
• As of: October 2026.

An email leaves your systems through a sending service, usually an email service provider (ESP), or through your own mail server. It is handed from server to server with the Simple Mail Transfer Protocol (SMTP), the standard every mail server speaks, today defined in RFC 5321.⁴ Most ESPs let your software send through an API and report back what happened through webhooks: delivered, bounced, clicked, unsubscribed or marked as spam.

The receiving mail server, run by the recipient's mailbox provider, then decides whether to accept the message and where to file it. It first checks that the mail really comes from the domain it claims, using three records you publish in your domain's DNS (the internet's address book):

• SPF (Sender Policy Framework) lists the servers allowed to send mail for your domain.⁵
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message, which the receiver checks against a public key you publish.⁶
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when a message fails those checks, requires the visible From address to match, and sends you reports.⁷⁸

Passing these checks proves identity, not good behaviour. The receiver then weighs your reputation: how many recipients mark your mail as spam, how many addresses bounce, and how people engage. Gmail, for example, measures the share of messages users report as spam and asks bulk senders to keep it below 0.1% and never reach 0.3%.¹¹

One common measure is weaker than it looks. An "open" is usually recorded when a tiny invisible image in the message loads. Since 2021 Apple's Mail Privacy Protection blocks such pixels from telling senders when mail is opened, and hides the reader's IP address,¹⁴ so open rates are now an estimate rather than a count. Clicks, replies and purchases are firmer signals.

Ray Tomlinson, an engineer at BBN, sent the first email between computers on the ARPANET in 1971 and chose the @ sign to separate the user from the machine.² In August 1982 RFC 821 defined SMTP, written by Jon Postel,³ and the protocol was consolidated in RFC 5321 in October 2008.⁴

Openness brought spam, and the industry answered with ways to prove who sent a message: DKIM was standardised in September 2011,⁶ the current SPF in April 2014,⁵ and DMARC in March 2015.⁷ In January 2017 RFC 8058 gave senders a standard way to offer one-click unsubscribe from the mail app itself.⁹

Then the mailbox providers turned good practice into rules. In October 2023 Google announced that from February 2024 anyone sending more than 5,000 messages a day to Gmail addresses must authenticate their mail, offer one-click unsubscribe and keep spam complaints low;¹⁰ Yahoo's sender rules ask for the same essentials.¹² Microsoft announced the same for Outlook.com from May 2025, for domains sending more than 5,000 emails a day.¹³ Gmail began a progressive enforcement, including rejecting non-compliant mail, in November 2025.¹¹ In May 2026 the IETF published RFC 9989, which replaces RFC 7489 and moves DMARC onto the Standards Track.⁸

Email is used in every region and by every kind of organisation, and it is the channel most online services ask for at sign-up. The Radicati Group, a technology market research firm, put the number of email users worldwide at 4,481 million in 2024 (about 4.48 billion, more than half the world's population) and forecasts 4,970 million (about 4.97 billion) by the end of 2028. It estimates that business and consumer emails sent and received exceeded 361 billion a day in 2024, and forecasts about 424 billion a day by 2028.¹

What changes between regions is less whether people have an address than how strictly marketing email is regulated:

• Americas: the United States lets businesses send commercial email without prior consent as long as they honour opt-outs,¹⁷ while Canada requires consent first.²⁰
• Europe: the EU and the UK require consent for marketing email to individuals, with a narrow exception for a business's own customers.¹⁸¹⁹
• Middle East and Africa: South Africa requires consent from anyone who is not already a customer,²² and the UAE's telecoms regulator set an opt-in rule for marketing electronic communications.²³
• Asia-Pacific: Australia requires consent, a clear sender identity and an unsubscribe option in every marketing message.²¹

Even where chat apps carry most everyday conversation, email remains the place for documents and account notices, which is why most organisations keep it alongside faster channels rather than replacing it.

• Notifications and records: order confirmations, receipts, invoices, shipping updates, statements, policy documents and contract copies. This is email's core job, because the customer can keep and search them.
• Marketing: newsletters, product news, offers and event invitations to people who agreed to receive them.
• Automation: sequences triggered by behaviour, such as a welcome series, a reminder about an unfinished checkout or a renewal notice.
• Booking: confirmations with a calendar invitation attached, and reminders that reduce no-shows.
• Support: ticket replies and follow-ups, where the thread itself becomes the case history.
• Sign-in codes and links: email can carry a one-time code or a sign-in link, but it is slower and less certain than other channels when the person is waiting at a screen.

There is no fee to the recipient's mailbox provider; you pay the service that sends for you, and you pay in effort for reputation. The common models are:

• Pay as you go per thousand emails, typical of sending infrastructure reached through an API or SMTP relay.
• Monthly tiers by volume, with a set number of emails included.
• Price by number of contacts stored, typical of marketing platforms that include a template editor, lists and automation.
• Add-ons: a dedicated IP address (so your reputation is not shared with other senders), longer log retention, and deliverability tools.

As one official example, Amazon Simple Email Service lists outbound email at US$0.10 per 1,000 emails on its pay-as-you-go basis, and also sells plans with extra features, starting at US$0.16 per 1,000 emails for the first 10 million a month, as of October 2026.¹⁶ Check each provider's own rate card for your volume and region.

The hidden costs are often larger: setting up authentication, keeping lists clean, building templates that work on phones, in dark mode and in right-to-left Arabic, and someone to watch bounce and complaint rates.

This section describes the rules in plain words; it is not legal advice. Two layers apply: the law where your recipients live, and the rules of the mailbox providers that decide what reaches the inbox.

The mailbox providers' rules

Google defines a bulk sender as one sending close to 5,000 messages or more to personal Gmail accounts in 24 hours. Bulk senders must pass SPF, DKIM and DMARC (a DMARC policy of "none" is enough), offer one-click unsubscribe on marketing mail using the method in RFC 8058, honour unsubscribes within 48 hours, and keep the spam rate below 0.3%. The one-click rule applies to marketing, not to transactional messages such as password resets.¹¹⁹ Yahoo asks for the same authentication, one-click unsubscribe honoured within two days, and low complaint rates.¹² Outlook.com requires SPF, DKIM and DMARC from domains sending more than 5,000 emails a day, and warned that failing mail would be junked or rejected.¹³ M3AAWG, the industry's anti-abuse working group, goes further in its best practice: explicit consent before mailing an address, and an unsubscribe header in every message.²⁴

The law, by region

• United States: the CAN-SPAM Act does not require prior consent, but every commercial email needs accurate headers, an honest subject line, a valid postal address and a working opt-out. Each violating email can draw a penalty of up to US$53,088.¹⁷
• European Union: the ePrivacy Directive (Article 13) requires prior consent for email marketing to individuals, with an exception for a business's own customers about similar products, provided they can object easily and free of charge.¹⁸ The GDPR governs the personal data itself.
• United Kingdom: the Privacy and Electronic Communications Regulations (PECR) require consent or the "soft opt-in" for existing customers; the regulator, the ICO, says no bought-in list can meet the soft opt-in, and a separate soft opt-in for charities started on 5 February 2026.¹⁹
• Canada: Canada's Anti-Spam Legislation (CASL) requires consent, sender identification and an unsubscribe mechanism, and the sender must be able to prove consent.²⁰
• Australia: the Spam Act requires consent, accurate sender details and an unsubscribe that is actioned within five working days.²¹
• South Africa: under POPIA section 69, a business may approach a non-customer only once to ask for consent, and must identify itself and offer an opt-out in every message.²²
• United Arab Emirates: the TDRA's policy on unsolicited electronic communications sets an opt-in process for marketing messages.²³

• "Delivered" is not "seen". A message accepted by the receiving server can still land in the spam folder or a promotions tab. See delivery rate is not a result.
• Open rates are estimates. Privacy features load or block tracking images,¹⁴ so judge campaigns on clicks, replies and outcomes.
• One stream for everything. If newsletters and password resets share a sending address, a spike in marketing complaints can delay account email. Separate them.
• Old or bought lists. They raise bounces and complaints and, in the UK, cannot meet the soft opt-in at all.¹⁹
• Forwarding and mailing lists can break SPF checks on the way; DKIM signatures usually survive, which is one reason to sign everything.⁶¹³
• Slow attention. Email suits records, not alerts that need action within minutes, and it is a weak carrier for one-time codes.
• Lookalike senders. Anyone can register a domain that resembles yours. A brand logo next to your messages through BIMI (Brand Indicators for Message Identification) requires DMARC at enforcement and, at Gmail, a verified certificate for the logo.¹⁵
• Rendering. The same message looks different across mail apps, in dark mode and in right-to-left scripts; test Arabic templates on real devices.

• A standard DMARC. RFC 9989, published in May 2026, is the new core DMARC specification on the Standards Track, published together with separate documents for reports; it obsoletes RFC 7489.⁸
• Stricter enforcement at Gmail. Google describes its enforcement since November 2025 as gradual and progressive, with an accelerated timetable for new sending domains.¹¹
• Industry best practice. M3AAWG's sender best common practices were updated in August 2026 and ask for explicit consent before an address is mailed.²⁴
• Steady growth. The Radicati Group forecasts more than 4.9 billion users and about 424 billion emails a day by 2028.¹

Choose email when the message is a record, when it is long, or when you need to reach people who have no app of yours and no particular chat app. Pair it with a faster channel when timing matters: a push notification or a message on a chat app for the alert, email for the receipt. The email channel page lists providers, choosing a channel per message covers the trade-offs in depth, and which channel for which need compares email with every other channel. Whatever you choose, record consent per channel and purpose: consent is a data model.