Guides
Newsletter production setup: five gates before the first send
Newsletter production setup in five gates before the first campaign: platform terms, consent records, domain tests, the CAN-SPAM template and the approval step.
What to take away
- Treat the first campaign as a gate with five checks, each leaving evidence you can show when a complaint or a privacy request arrives.
- Platform terms come firstthe fee structure, payout timing and export rights decide more than how the writing screen looks.
- Consent records, not subscriber counts, protect you. Keep the source, the date and the exact wording for every contact.
- Authenticate your domain with SPF, DKIM and DMARC, then test every template with a seed list before the first send.
- Vendor responsibility stays with youa contractor sending on your behalf does not absorb your compliance duty.
- Name an owner and an approval step before the send, never after, or the schedule slips in week two.
General business information, not legal advice: commercial-email, privacy and consent duties vary by jurisdiction, so confirm your obligations with a licensed attorney.
Gate one: the platform terms you can leave
Check three platform terms before you build anything: the fee structure, the payout timing and whether you can export your list. They matter more than how the writing screen looks, and they are the hardest terms to change once subscribers are inside.
Sending platform terms
Beehiiv
- Fee structure
- Monthly + rev share
- Payout timing
- Platform-set
- List export
- Check terms
- Best for
- Referral/ad tools
Substack
- Fee structure
- Rev share
- Payout timing
- Platform-set
- List export
- Rent audience
- Best for
- Discovery
Ghost
- Fee structure
- Hosting cost
- Payout timing
- You control
- List export
- Own database
- Best for
- Owning data
Kit
- Fee structure
- Subscriber tier
- Payout timing
- Platform-set
- List export
- Check terms
- Best for
- Own products
Read each platform's own published pricing page on the day you commit. Rates change, and a figure quoted in an article is stale the month it prints. The fee and payout rules show how to turn those terms into a monthly number.
Gate two: a consent record for every contact
Every contact needs a record you can produce: the source, the date and the exact wording they agreed to. A subscriber who opted in through a form with a timestamp is worth more than ten scraped addresses, because only one of them can be defended.
Consent record checklist
- Keep source, date and exact consent wording
- Never import purchased or rented lists
- Build data export and deletion path
- Put consent language by every signup field
- Record form URL, IP and timestamp
- Import only contacts with source and date
Purchased or rented lists generate complaints, and complaints reach your sending platform before they reach you. A platform that suspends your account takes your revenue with it. Import only contacts that have a source and a date.
California and Colorado privacy statutes give residents rights over personal data you hold, including the right to know what you collected and to have it deleted. As the California Attorney General's CCPA page explains, residents may ask businesses to disclose what personal information they hold and to delete it. The state privacy rules are the reason the export and deletion path should exist before the first request.
Put consent language next to every signup field. Record the form URL, the IP address and the timestamp when your platform allows it.
Gate three: domain records and the seed-list test
Publish SPF and DKIM records for your sending domain, then add a DMARC policy. Start with p=none or p=quarantine while you monitor the reports. The record setup guide walks through the values for each one.
Authenticate and test sends
- Publish SPF and DKIM DNS records
- Add DMARC policy, monitor reports
- Check reputation in Google Postmaster
- Test records with MXToolbox or mail-tester
- Preview rendering in Litmus or Email on Acid
- Warm domain with small engaged sends
- Seed-test from name, address, unsubscribe
SPF, DKIM and DMARC are the three records that authenticate a sending domain. Once they are live, a few tools do the checking. Use Google Postmaster Tools to watch domain reputation. Use MXToolbox or mail-tester.com to check records and spam score. Litmus and Email on Acid preview rendering in major inboxes.
Warm a new domain or IP with small sends to engaged subscribers. Mailchimp, Kit, Beehiiv and Substack provide shared IPs by default. Dedicated IPs usually require a monthly fee and a consistent volume.
Test every template with a seed list before the first send, and tick each item:
- From name shows your publication, not a personal mailbox
- Reply-to address is one you read
- Physical address is in the footer
- Unsubscribe link works
- Plain-text version reads cleanly
Gate four: the CAN-SPAM template pass
The Federal Trade Commission's CAN-SPAM compliance guide sets the baseline for commercial email in the United States. Work through it once, then put each item into your send template so no issue depends on memory.
CAN-SPAM send checklist
- Header information identifies you accurately
- Subject line describes the contents
- Message identified as advertisement unless consented
- Valid physical postal address in every send
- Opt-out works without fee or login
- Honor opt-outs within 10 business days
- Vendor under written instruction and monitored
- Header information is accuratethe "from", "to", "reply-to" and routing fields identify you, not a contractor or a spoofed domain.
- The subject line accurately reflects the content of the message.
- The message is identified as an advertisement.
- A valid physical postal address appears in every send. A registered mailbox or a PO box qualifies.
- The opt-out mechanism costs nothing and asks for nothing beyond an email address.
- Opt-out requests are honored within 10 business days, and the address goes on a suppression list that no future campaign overrides.
- A vendor sending on your behalf is under written instruction, and you monitor what it sends.
The CAN-SPAM checklist for publishers goes through the same duties in more depth. Treat this list as the version that lives inside the template.
Gate five: the approval step before the send
An issue that ships late twice loses readers who never come back. Set a schedule you can hold in a bad week, not a good one, and put the approval step before the send, never after.
Issue production workflow
- Writer drafts by draft deadline
- Editor reviews and revises
- Approver signs off before send
- Scheduler queues send time
- Backup approver covers vacation weeks
Assign four roles by name, even if one person holds two of them: writer, editor, scheduler and approver. Keep a shared calendar with the draft deadline, the approval deadline and the send time. A newsletter that depends on one person remembering is a newsletter that stops.
Use Notion, Airtable or Google Calendar for the calendar. Use Trello, Asana or Linear for issue tasks. Use your platform's native scheduling for the send, and name a backup approver for vacation weeks.
The evidence file to keep
Each gate should leave one piece of evidence in a single folder. When a complaint, a platform review or a privacy request arrives, you open the folder instead of reconstructing the past.
| Gate | What you verified | Evidence to keep |
|---|---|---|
| Platform terms | Fee structure, payout timing, export rights | A saved copy of the pricing page from the day you committed |
| Consent | Source, date and wording per contact | The contact export with form URL, IP address and timestamp where allowed |
| Domain | SPF, DKIM and DMARC records, seed-list test | The record values and the test results |
| CAN-SPAM | Header, subject, ad label, address, opt-out | The finished template and the suppression list |
| Approval | Named roles and an approver before the send | The calendar entry with draft, approval and send times |
When all five rows are filled, the rollout order of production tools covers what to add next.
Common questions
What should I check first before a first campaign?
The platform terms: fee structure, payout timing and export rights. Then import consent records, authenticate the domain and build a template before you write issue one.
Does CAN-SPAM apply to a newsletter I send to my own customers?
Yes, if the message is commercial. The FTC guide says the law covers all commercial email, including a message to former customers announcing a new product line. Transactional or relationship messages have lighter requirements.
Can I buy a list to launch faster?
You can, but the complaints will reach your sending platform, and a suspension ends the business faster than a slow launch would have. Build consent into the signup form instead.
Who is responsible if a contractor sends the email?
You are. The FTC guide says the company whose product is promoted and the company that sends the message may both be held legally responsible, so a contractor's mistake is still yours.
Do I need a privacy policy?
California and Colorado both give residents rights over personal data, and a policy is the plainest way to state what you collect and how to have it removed. Have an attorney review the wording.
