Before you email a list of old leads, publish SPF, DKIM and DMARC records for the sending domain, confirm every tool that sends mail for you is covered, and make sure each message has a working unsubscribe link and your postal address. Google recommends the first three for every sender, and the FTC requires the last two.
By Avi Vatsa, CEO, Exchange Four Agency. Avi leads the team that installs and runs AI-leveraged revenue systems for owner-led companies. His background spans law, technology, and marketing; he also co-founded Dialora, an AI voice-agent platform for automated lead capture and booking. (Marketer of the Day #1411)
Why does an old lead list need this before the first send?
Because the first message in months is also the one that sets your reputation for the rest of the run. A database that has been quiet for a year is full of addresses that changed jobs, closed, or stopped caring. Mailbox providers watch what happens to a burst of mail from a domain, and what they see in that burst shapes how they treat the next message.
That makes a lead reactivation run the riskiest mail an owner-led company sends. The argument for it is sound, and we make it in why reactivating old leads beats buying new ones. The setup below is what keeps the argument from costing you the domain that carries your everyday email.
What do SPF, DKIM and DMARC each do?
Google describes the three records on its email sender guidelines page. In its words:
| Record | What it does | What to check |
|---|---|---|
| SPF | "SPF prevents spammers from sending unauthorized messages that appear to be from your domain." | The record must "include all email senders for your domain." |
| DKIM | "Receiving servers use DKIM to verify that the domain owner actually sent the message." | Turn it on for the domain that sends your email, at every tool that sends. |
| DMARC | "DMARC tells receiving servers what to do with your messages that don't pass SPF or DKIM." | Publish a record, and set up reports so you can see who sends as you. |
The sentence in the SPF row that catches most owners is the second one. If a tool sends mail for you and is missing from the record, Google says "messages from these senders are more likely to be marked as spam." A reactivation platform added last week is exactly that tool.
Google also notes that messages that fail these checks "might be marked as spam or rejected with a 5.7.26 error." A rejection is at least visible. Spam-foldering is not, and it looks like a list that simply does not reply.
Which of Google's rules apply to a small sender?
Google splits senders into two groups. All senders must set up SPF or DKIM. Bulk senders, defined as anyone sending more than 5,000 messages a day to Gmail accounts, must set up SPF, DKIM and DMARC, and the rules for them took effect on February 1, 2024.
Most owner-led companies send far fewer than 5,000 messages a day, so the strictest list does not formally apply to them. Google still says "we recommend that you always set up SPF, DKIM, and DMARC for your domains," and a reactivation run is the moment a quiet domain starts looking like a bulk sender.
For bulk senders the list also includes one-click unsubscribe and a spam rate below 0.30% in Postmaster Tools. Google separately advises senders to "keep spam rates reported in Postmaster Tools below 0.10% and avoid ever reaching a spam rate of 0.30% or higher." Treat those two numbers as your ceiling even if you are well under the volume line.
What does the FTC require in every commercial email?
The CAN-SPAM rules come from the FTC's compliance guide for business, and they apply to email to old leads in the same way as to any other recipient. Three points matter most for a reactivation send:
- There is no business-to-business carve-out. The guide says: "The law makes no exception for business-to-business email."
- Opt-outs have a deadline. "You must honor a recipient's opt-out request within 10 business days." Your tool should suppress the address the same day, and it must not email an unsubscribed address from the next import of the old list.
- Your address belongs in the message. "Your message must include your valid physical postal address."
The guide also says that each separate email in violation "is subject to penalties of up to $53,088." That was the figure on the page when we read it, and the amount is revised from time to time, so check the page for the current number before you quote it to anyone. It also states that you cannot hand the problem to a vendor: "you can't contract away your legal responsibility to comply with the law."
This is not legal advice. It is the regulator's own summary, and the right step for anything unusual in your list is a conversation with a lawyer.
How do you check the domain before you send?
Work through these in order, and send nothing until every line is done.
- List every tool that sends mail as your domain. Your mailbox provider, your CRM, your invoicing system, your reactivation platform, your website forms. Each one is a sender.
- Check that SPF covers all of them. One SPF record for the domain, with every sender included.
- Turn on DKIM at each sender. Google notes that sending to personal Gmail accounts "requires a DKIM key of 1024 bits or longer" and recommends 2048 bits where your provider supports it.
- Publish a DMARC record and read the reports. Google says the enforcement policy can be set to none, which means you can start by watching and tighten later.
- Send a test to a Gmail address and a second provider. Read the authentication results in the message source, and confirm they show a pass for the domain in the From line.
- Check the footer and the unsubscribe path. A visible unsubscribe link that works, and the postal address.
- Send to a small slice first. Pick the most recently active contacts, watch bounces and complaints, and widen the list only when they stay low.
If you use an email provider, Google's advice is to "verify that they authenticate your domain's email with SPF and DKIM." Ask the provider, then check the headers of a real message instead of taking the answer on trust.
Who should hold the keys to the domain?
The person who can edit your DNS can change every one of these records, so that login should belong to your company and not to a contractor or agency. We cover the same principle for ad accounts in what access to give a marketing agency, and for everything else in who owns your marketing assets when you leave an agency.
The test is simple. If your reactivation platform vanished tomorrow, could you remove its records from your domain without anyone's permission? If so, you hold the keys. If not, fix that before the first message goes out.