Selecting email software by witnessed tests and exclusion criteria

Good email marketing software selection starts with one reproducible message workflow, not a list of fashionable features. Write down the purpose, recipient population, acquisition route, exclusions, owner, evidence and stop condition. Then ask each candidate to prove it can preserve those decisions.

This guide is written for an organisation operating in England. The UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) apply across the United Kingdom, while some accessibility, sector and public-sector duties differ in Scotland, Wales and Northern Ireland. Sources were checked on 5 September 2026, and no product, supplier or campaign was tested: the platforms named later are examples of candidates to test, not endorsements.

What to take away

Define what must never be mixed

Give genuine research, requested information, service notices and direct marketing separate workflows. The ICO's Guide to PECR and its Direct marketing guidance explain that the electronic-marketing rules turn on the content and purpose of the message, so adding promotion can change how a research or service message is treated. Reject a tool design that forces all contacts and templates through one indistinguishable stream.

For each population, preserve address source, subscriber category, notice version, lawful-basis decision, PECR route and later objection. The ICO's guidance on lawful basis for processing separates the data-protection basis from the rules for the communication channel, so record both. A vendor's consent checkbox should not replace that evidence, and an organisation processing personal data must also appear on the ICO's register of fee payers.

Turn requirements into witnessed tests

Use synthetic contacts with deliberately different states: eligible, objected, duplicated, changed address, missing source and corporate subscriber. Run the same scripted test in each candidate edition — for example Mailchimp, Klaviyo, Dotdigital, HubSpot or Campaign Monitor — on a trial or sandbox account, with one person configuring and another witnessing the result. A test passes only when the witness can repeat it from the saved configuration and reproduce the same outcome; anything that depends on a support agent acting manually fails.

The ICO's preference guidance supports maintaining limited suppression information to prevent renewed contact. Verify how that state behaves after imports and restores rather than trusting an unsubscribe demonstration.

Test deliverability as a first-class criterion

A tool can hold permissions perfectly and still fail to reach the inbox, so deliverability belongs in the same scripted test. In the edition you would buy, ask the supplier to show authenticated sending with SPF and DKIM, a DMARC record aligned with the From domain set to a policy you can enforce, and support for one-click unsubscribe under RFC 8058 alongside the visible unsubscribe link.

Google's and Yahoo's bulk-sender rules apply to high-volume senders into their users' inboxes: authenticate with SPF, DKIM and DMARC, keep spam complaint rates under the thresholds those providers publish, and honour unsubscribe requests within the timescales they set. Ask where complaint and delivery data is exposed — Google Postmaster Tools, Microsoft SNDS or an equivalent — and whether blocklist monitoring is included or an extra.

Run seed and inbox-placement tests to a panel covering the major UK consumer and business mailbox providers, and repeat them whenever you change sending domain or IP. A brand indicator such as BIMI with a Verified Mark Certificate is optional; a platform that cannot publish the DNS records you need is not.

Check evidence at plan level

Record product, edition, region, page or contract section, access date, owner and expiry for every material claim. Mark whether it is supplier-stated, contractually committed, buyer-tested, unknown or failed. Prices and usage rules belong to the offered order form, not a screenshot from another country or contact tier.

Security needs the same discipline. The NCSC's cloud security guidance sets out the customer's responsibilities for identity, configuration, logging and recovery in software as a service. Ask for scoped assurance evidence — ISO/IEC 27001 certification, a SOC 2 report or Cyber Essentials, with a scope statement showing which service and region it covers — plus incident support and sub-processor change handling, then test the controls available in the exact edition.

Accessibility is a selection criterion, not a later fix. Test the sign-up form, preference centre and unsubscribe page against WCAG 2.2 level AA: keyboard-only completion, visible focus, labelled fields and clear errors, contrast and text spacing. Ask for a current accessibility conformance report, such as a VPAT, for the edition you would buy. A critical task that cannot be completed with a keyboard or a screen reader is an exclusion rather than a scoring deduction.

Use exclusion criteria before scoring

Set non-negotiable stops before you score anything: no reproducible suppression; unresolved controller or processor role; unknown international access; inadequate export; a critical task that cannot be completed to WCAG 2.2 level AA; no DMARC alignment or one-click unsubscribe support; no workable incident route; or a contract that prevents a controlled exit. Do not award points elsewhere to cancel one of these failures.

For candidates that survive, compare only buyer priorities with defined weights and evidence quality. Keep unknown separate from poor performance. A tool with fewer features may be preferable if its necessary controls are observable and maintainable.

Finish with a conditional decision stating the chosen edition, alternative, unresolved evidence, required contract changes, test owner, implementation limit and review date. Qualified UK privacy, electronic-marketing, accessibility, security and commercial reviewers must clear their areas before purchase or live-data use.

Before you act

Common questions

What should be defined before comparing email software candidates?

Write down the purpose, recipient population, acquisition route, exclusions, owner, evidence and stop condition for one reproducible message workflow. Then ask each candidate to prove it can preserve those decisions. The article says selection starts there, not with a list of fashionable features.

How should suppression and permissions be tested?

Use synthetic contacts with deliberately different states: eligible, objected, duplicated, changed address, missing source and corporate subscriber. One person configures and another witnesses. An objection must block manual upload, automation and integration entry, and a preparer should not be able to approve.

When should exclusion criteria be applied?

Set non-negotiable stops before scoring. These include no reproducible suppression, unresolved controller or processor role, unknown international access and inadequate export. Others are an inaccessible critical task, no workable incident route, or a contract preventing controlled exit. Do not award points elsewhere to cancel one of these failures.

How should deliverability be tested during selection?

Ask each candidate to send authenticated mail with SPF, DKIM and a DMARC record aligned to your From domain, and require one-click unsubscribe support under RFC 8058. Check Google's and Yahoo's bulk-sender rules, watch complaint and delivery data in Google Postmaster Tools or Microsoft SNDS, run seed tests to the major UK mailbox providers, and treat a platform that cannot publish your DNS records as excluded.