Consent rules tightened, mailbox providers started rejecting unauthenticated mail, and "send to everyone" stopped working. Here's what running email actually looks like now.
Most articles about email marketing still read like it's 2018 — build a list, write a subject line, watch the revenue arrive. That advice is now actively harmful, because three things happened in quick succession.
Gmail and Yahoo began enforcing bulk sender requirements in February 2024, and non-compliant mail is rejected at the gateway rather than filed in spam. India's Digital Personal Data Protection Act shifted consent from a checkbox to a record you may have to produce. And mailbox providers moved decisively toward engagement-based filtering, which means mailing a large unengaged list now damages your ability to reach the people who do want to hear from you.
Email still works. It works because you own the list — no algorithm sits between you and your subscriber, and nobody can change your reach overnight. But the operational bar is meaningfully higher than it was, and the platform you choose now determines whether you clear it.
Under the DPDP Act, consent needs to be free, specific, informed and unambiguous — and withdrawable as easily as it was given. In practice that means your platform should be storing, for every subscriber: when they subscribed, through which form, what they were told they were signing up for, and their IP or source at the time.
Double opt-in is worth reconsidering here even though it costs you list size. A confirmed subscriber is a documented one, and confirmation also filters out typo addresses and spam traps before they enter your list. Given how much reputation damage a single spam trap can do, the smaller list is usually the more valuable one.
The uncomfortable implication: purchased lists and scraped addresses are not a grey area any more. They fail the consent test, and they will fail your deliverability too. If you have inherited a list of unknown origin, the honest move is to re-permission it with a single campaign and delete whoever doesn't respond.
We cover the storage and residency side of this in more detail on our DPDP compliance page.
SPF and DKIM are mandatory for bulk senders. DMARC is required at minimum as p=none, and moving to quarantine or reject once you have monitoring in place is the direction of travel. Gmail also expects one-click unsubscribe headers under RFC 8058 on marketing mail, honoured within two days.
The complaint threshold is the one people underestimate. Gmail asks bulk senders to stay under 0.3 percent, and treats 0.1 percent as the warning zone. That is roughly one complaint in a thousand emails — a low bar to cross if your segmentation is careless.
None of this is optional configuration you can defer. If your platform doesn't generate these records for you and monitor the result, you are relying on someone remembering to check. Our authentication wizard produces all three records, and the Gmail and Yahoo requirements guide walks through the full checklist.
Segmenting by city, industry or company size is where most teams start, and it's fine as a baseline. But the segments that actually move numbers in 2026 are behavioural, because they correlate with the thing mailbox providers measure — engagement.
Three that consistently earn their keep:
Personalisation follows from segmentation rather than replacing it. Inserting a first name into a subject line is not personalisation if the content behind it is identical for everyone. Referencing what someone actually did is.
Batch-and-blast scheduling treats your list as one audience moving in lockstep. Triggered sequences treat each subscriber as an individual whose timeline started when they did something. The second approach consistently outperforms, and it costs less attention to run once built.
The sequences worth building first, in rough order of return:
Two cautions. Automation multiplies whatever you feed it, including mistakes — an error in a welcome series compounds silently across every new subscriber. And a sequence built once and never revisited will keep referencing features you've changed and offers you've ended. Put a quarterly review in the calendar.
This is the most common architectural mistake we see, and it's expensive when it bites.
If your marketing campaigns and your OTPs share a sending domain and IP pool, then a poorly targeted promotional blast that generates complaints will degrade the reputation that delivers your login codes. Users don't complain about OTPs — but they inherit the damage. The failure mode is customers unable to sign in, and it's rarely diagnosed quickly because nobody connects the login problem to last week's campaign.
The fix is straightforward: separate subdomains, separate IP pools, separate reputation. Something like news.yourdomain.com for campaigns and mail.yourdomain.com for system mail. You can run both from one platform — see transactional email and bulk email — but the reputation must stay isolated.
A campaign tool disconnected from your product can only send what someone types into it. Connected, it can send what your application knows.
The neuMails REST API covers the operations that matter for this: sending individual or templated messages, managing subscribers and segments, retrieving delivery and engagement events, and receiving webhooks for bounces, opens, clicks, complaints and unsubscribes.
Webhooks deserve particular attention because they close the loop. A hard bounce should suppress the address in your own database, not just in your email platform. An unsubscribe should propagate to your CRM. A complaint should trigger a review of whatever segment produced it. Teams that skip webhook handling end up with two systems holding different truths about the same subscriber, and that divergence is where compliance problems start.
If you'd rather not write integration code at all, SMTP relay works with any framework's existing mail configuration — usually a credential change rather than a code change.
Apple Mail Privacy Protection pre-fetches images, which means a meaningful share of your "opens" never happened. Open rate is now directionally useful at best and misleading at worst, particularly for consumer audiences.
The metrics that survived:
Email logs give you the per-message trail when something specific goes wrong, and analytics the aggregate view. Pair both with Google Postmaster Tools, which reports what Gmail thinks of you rather than what your platform thinks of you.
Feature grids rarely mention currency, and for Indian businesses it's often the deciding factor.
Billing in USD means your email cost moves with the exchange rate, so a budget set in April can be materially wrong by October through no decision of yours. International invoices frequently don't carry GST in a form your finance team can claim, which quietly adds to the real cost. And support hours aligned to US or European time zones mean a deliverability problem at 11pm IST waits until tomorrow.
There's a routing dimension too. Mail sent through infrastructure in Virginia or Dublin to a recipient in Mumbai makes a round trip of thousands of kilometres. For a newsletter, nobody notices. For a login OTP where the user is staring at a checkout screen, those seconds convert directly into abandonment.
Our pricing is in INR with GST invoicing, and the platform comparison sets out how the major options stack up for Indian senders specifically.
If you're reviewing your setup, the sequence that produces results fastest:
None of it is glamorous. All of it compounds — and unlike subject line testing, it keeps working.
Authentication, segmentation, automation and API access — on infrastructure in India, billed in INR with GST.
Start Free Trial