To keep your Christmas email marketing out of the spam folder, you need three things, in this order: an authenticated domain (SPF, DKIM, DMARC and one-click unsubscribe), a clean, segmented list, and sending volume that ramps up gradually before the late-November peak. Miss any of them and even your best offer won't help, because Gmail or Outlook simply won't put the message in the inbox.
This year Black Friday falls on November 27 and Cyber Monday on November 30, which leaves roughly five weeks. That's enough for everything below, as long as you don't start on November 25. The stakes have also gone up: according to Google's sender guidelines FAQ, Gmail has been ramping up enforcement against non-compliant traffic since November 2025, temporarily or permanently rejecting some of it.
- Above roughly 5,000 messages a day, Gmail, Yahoo and Outlook all require SPF, DKIM and DMARC. Below that, they're still strongly advisable.
- Promotional emails need one-click unsubscribe (the RFC 8058 header), not just a link in the footer.
- Don't blast the whole list. Start with active customers and ramp up volume gradually before the peak days.
- Watch your spam complaint rate in Google Postmaster Tools: Google recommends staying below 0.1% and never reaching 0.3%.
- Open rates are skewed. Measure clicks, orders and revenue per recipient, from your own database.
Why do Christmas newsletters end up in spam?
Filters today aren't mainly scanning subject lines for words like "FREE!!!". They look at who is sending, whether that can be proven, and how recipients react. In our experience, four mistakes cause most of the trouble during the holiday season:
- Incomplete authentication: the email platform sends from its own domain, or DKIM isn't set up for your domain, so the sender can't be verified.
- Sudden volume spikes: one newsletter a month all year, then two a day to the entire list in late November. Mailbox providers read that as a suspicious pattern.
- Old, dormant addresses: people who haven't opened or bought anything in two years are largely either gone or ready to hit "Report spam".
- Painful unsubscribing: if leaving takes three clicks and a login, people mark the email as spam instead, and that hurts the reputation of your whole domain.
What do you need to set up for SPF, DKIM and DMARC?
Under Google's email sender guidelines, you're a bulk sender if you send close to 5,000 or more messages to personal Gmail accounts within a day. Bulk senders need both SPF and DKIM, a DMARC record, and a From domain that aligns with either the SPF or the DKIM domain. Yahoo's sender best practices ask for essentially the same, and Microsoft has, since May 5, 2025, required SPF, DKIM and at least a p=none DMARC policy from domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses.
| Requirement (above ~5,000 messages/day) | Gmail / Yahoo | Outlook.com |
|---|---|---|
| SPF and DKIM | Both required | Both required |
| DMARC | Required, p=none is enough | Required, at least p=none |
| One-click unsubscribe | Required for promotional mail | Strongly recommended |
| Spam complaint rate | Below 0.3%, ideally below 0.1% | Clean list, low complaints |
If you're below 5,000 a day right now, don't relax. A Christmas campaign can easily push you over the threshold, and according to Google's FAQ, once you've hit it you're treated as a bulk sender for good.
SPF
A single TXT record on your domain listing which servers may send on your behalf. The classic mistake: the store platform, the email tool, the invoicing app and company mail each "add their bit", and you end up with two SPF records, or you exceed the ten-DNS-lookup limit defined in RFC 7208. Either way, SPF fails.
DKIM
A digital signature on every message. The point is to configure it in your email platform for your own domain (the provider gives you one or more DNS records for this) rather than letting it sign with its default domain. We recommend a separate subdomain for marketing mail (say, news.yourdomain.com), so a campaign that goes badly doesn't drag your order confirmations down with it.
DMARC
This tells the receiving server what to do if SPF or DKIM doesn't check out, and where to send reports. To start, this is enough:
_dmarc.yourdomain.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"p=none blocks nothing yet; you're only asking for reports. After a few weeks of data, once you can see every legitimate sender passing, move towards quarantine and later reject. Just don't do it during Black Friday week.
One-click unsubscribe
RFC 8058 defines a List-Unsubscribe and a List-Unsubscribe-Post header, which lets Gmail and other clients show their own unsubscribe button at the top of the message. Google's guidelines say unsubscribe requests must be honored within two days. Most email platforms handle this already, but if you send from a custom-built system, check it. In Gmail, "Show original" shows you the headers and the SPF/DKIM/DMARC results in under a minute.
How should you segment so you're not mailing the whole list?
Here segmentation isn't fine-tuning; it's the foundation of deliverability. We work with four groups in a Christmas campaign:
- Active: people who clicked or bought in the last few months. They get the first emails, because their positive engagement builds your domain's reputation.
- Last year's Christmas buyers: they don't need a generic sale, they need a reminder of what they bought last year and what goes with it this year.
- Repeat, high-basket customers: early access, the sale starts sooner for them. Fewer emails, more value.
- Dormant: people who haven't responded to anything in a long time. They get at most one short "still want to hear from us?" email in early November, and anyone who doesn't respond is left out of seasonal sends.
Only send marketing email to people who have actually consented to it. In Hungary this is required by Section 6 of the Act on Commercial Advertising, and an email address given at checkout is not a subscription in itself. Build your segments on your store's order database, not on your email tool's open data. If those two systems don't talk to each other, that's the first of our automation workflows for small teams worth wiring up.
What schedule works through the end of November?
This is the timeline we'd suggest for a typical online store, using 2026 dates:
- October 26 – November 1: technical check. Verify SPF, DKIM and DMARC for every sending system, test one-click unsubscribe, and register your domain in Google Postmaster Tools.
- November 2–8: list and segments. Remove bouncing addresses, send the re-permission email to dormant contacts, build segments from order data.
- November 9–15: ramp-up. Useful, non-promotional content (gift ideas, shipping deadlines), first to active subscribers only, then to a gradually wider circle.
- November 16–22: early access. Repeat customers get the offer first. From here on, check the spam rate in Postmaster Tools daily.
- November 23–30: Black Friday and Cyber Monday. Different frequency per segment. Anyone who has already bought shouldn't keep getting the same sale email.
December is then about shipping cut-offs and last-minute shoppers (gift cards, in-store pickup). If your domain reputation is solid by then, those emails land in the inbox too.
What should you measure when open rates can't be trusted?
Apple's Mail Privacy Protection loads remote content, including tracking pixels, privately in the background. As a result, an email can register as opened even if the recipient never looked at it. A/B tests and "active" segments built on open rates can therefore be misleading.
Here's what we look at instead:
- Clicks and orders per campaign, with consistent UTM parameters so email separates cleanly from other channels in Analytics and in your own reports.
- Revenue per recipient by segment, from your store database rather than your email tool's estimate.
- Unsubscribe and spam complaint rates after every send. If one segment spikes, it skips the next email.
- Bounces by type. Permanently undeliverable addresses get removed immediately.
If you want to separate email's impact from your other channels, the principle from our article on attribution applies here too: your own order data is the baseline, and platform numbers are only directional.
Frequently asked questions
I run a small store and send fewer than 5,000 emails a day. Do I still need DMARC?
Google's guidelines expect at least SPF or DKIM from smaller senders, while DMARC is mandatory for bulk senders. We think you need all three, because a Christmas campaign can easily push you over the threshold, and setting them up takes an afternoon.
Is an unsubscribe link at the bottom of the newsletter enough?
Not for bulk senders. Promotional emails also need the RFC 8058 one-click unsubscribe header alongside the visible link. Most email platforms add it automatically, but check the headers of a test message to be sure.
How many emails can I send during Black Friday week?
There's no universal number. Your own spam complaint and unsubscribe rates set the limit. Your active, buying segment can handle more emails; dormant contacts can't handle any. If the spam rate in Postmaster Tools starts climbing, cut the frequency right away.
How long does it take to fix a bad domain reputation?
Not days, and nobody can guarantee a timeline. That's why we say to sort out the technical basics at the end of October, not the end of November. In peak week, you can only work with the reputation you already have.
If you're not sure your domain and store are technically in order, our free audit covers DNS settings too. And if you'd like help planning and measuring the campaign, our marketing team is happy to step in.