Email deliverability for venues: a compliance checklist

Email deliverability for venues rests on three things. You need consent you can prove under GDPR and a sending domain authenticated with SPF, DKIM and DMARC. You also need a spam complaint rate below Google's 0.10% guideline. Build the list from opt-ins at guest WiFi login, honour unsubscribes within two days and suppress inactive guests.

What does an email deliverability checklist do for your venue?

Every email that lands in spam is a repeat visit you paid for and never got. Deliverability is the share of your sends that reach the inbox, not just the receiving server. A message can be "delivered" and still sit unread in a junk folder.

For a venue, the outcome is commercial. Inbox placement drives opens. Opens drive bookings and return visits, and return visits drive lifetime value. Revenue per send falls the moment Gmail or Outlook decides your domain looks risky.

Mailbox providers now enforce this. Since February 2024, Google and Yahoo have required bulk senders to authenticate their mail, offer one-click unsubscribe and keep complaints low. Microsoft introduced similar rules for Outlook.com in May 2025. A venue group sending a weekend promotion can cross Google's bulk threshold of 5,000 messages a day to Gmail addresses in a single send.

The checklist covers two jobs. Compliance keeps you lawful under GDPR and, in the UK, the Privacy and Electronic Communications Regulations (PECR). Deliverability keeps you in the inbox. The two overlap more than most marketers expect. Guests who never agreed to hear from you are the guests most likely to press "report spam".

Most email deliverability services focus on the sending side: authentication, IP reputation and inbox monitoring. Few address the point that decides most outcomes, which is how each address got onto your list. That is where guest WiFi changes the picture.

What do you need before you send your first venue campaign?

Authenticate your sending domain

Three DNS records prove your mail really comes from you. Your IT team or domain provider adds them, and your sending platform supplies the values.

• SPF (Sender Policy Framework) lists the servers allowed to send mail for your domain.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature, so providers can check that nobody altered the message in transit.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) tells providers what to do when SPF or DKIM fails. It also sends you reports on who is mailing as your domain.

Start DMARC at a policy of "none", the minimum Google, Yahoo and Microsoft accept. Read the reports for a few weeks. Move to "quarantine" once every legitimate sender, including your booking engine and till system, passes.

Send marketing from your own domain, such as news@yourvenue.co.uk. A free mailbox address fails DMARC alignment because you do not control that domain's records.

What the mailbox providers now require

Requirement	Google (Gmail)	Yahoo	Microsoft (Outlook.com)
Who it applies to	Senders of 5,000+ messages a day to personal Gmail accounts	Bulk senders (no fixed volume published)	Senders of 5,000+ messages a day to Outlook.com, Hotmail.com and Live.com
Authentication	SPF and DKIM	SPF and DKIM	SPF and DKIM
DMARC minimum	Policy of "none", aligned with SPF or DKIM	Policy of "none"	Policy of "none", aligned with SPF or DKIM
Unsubscribe	One-click (RFC 8058) plus visible link, honoured within 2 days	One-click, honoured within 2 days	Functional unsubscribe link
Spam rate ceiling	Below 0.10%, never reaching 0.30%	Below 0.30%	Not published
In force from	February 2024	February 2024	May 2025

Google also treats any sender that reaches 5,000 messages in a day as a bulk sender permanently. One large send is enough. Build to the bulk standard from day one.

Get your consent wording and privacy notice right

GDPR Article 4(11) defines consent as "freely given, specific, informed and unambiguous". Article 7(1) puts the burden of proof on you, the sender. Recital 32 rules out pre-ticked boxes, silence and inactivity. Article 7(3) says withdrawing consent must be as easy as giving it.

Before you capture a single address, have these four things in place:

• A consent statement naming your venue or group, the channels (email, SMS) and the type of content you will send.
• A privacy notice linked from the WiFi login page, covering purposes, retention and the guest's rights.
• A physical postal address in every email footer if you mail recipients in the US, as the CAN-SPAM Act requires.
• A named owner for unsubscribe and data subject requests, with a deadline your team can meet.

How do you set up compliant email capture with your guest WiFi data?

This is where the list builds itself. Guests log in to your Guest WiFi with an email address or phone number. The marketing opt-in sits on the same screen as a separate, conscious choice. Purple Engage captures verified guest email and phone data at login and automates campaigns from it.

The scale is already there. Across 80,000+ live venues, Purple recorded 440 million logins in 2024 (Purple data). Every one of those logins is a moment when a guest can choose to hear from you.

Mailchimp, Klaviyo and HubSpot send campaigns to the list you bring them. They do not build that list from the guests already in your venue.

Separate WiFi access from marketing consent

GDPR Article 7(4) says consent is unlikely to be freely given when a service depends on consent it does not need. In practice, the WiFi must work whether or not the guest opts in to marketing.

Set the login page up as follows:

• Leave the marketing box unticked by default.
• Offer email and SMS as separate choices if you send both.
• Name the brands covered if you share data across a group, so consent stays specific.
• Keep the wording short enough to read on a phone in five seconds.

In the UK, do not lean on the soft opt-in. PECR regulation 22(3) allows it only where you collected the details "in the course of the sale or negotiations for the sale" of a product or service. A free WiFi login is not a sale, so ask for consent.

Choose list sources that protect your reputation

List source	Consent evidence	Address accuracy	Deliverability risk	Who it suits
Opt-in at guest WiFi login	Digital opt-in captured at login, stored against the guest profile	Verified at login	Low	Any venue with guest WiFi and steady foot traffic
Paper sign-up card	Paper record, often lost or never filed	Handwriting errors and mistyped addresses	Medium	Single sites with no digital capture
Till or receipt email prompt	Depends on staff asking the question correctly	Typed by staff at speed	Medium	Retail and QSR with high transaction volume
Purchased or rented list	None you can prove for your own brand	Unknown, can contain spam traps	High	No venue: fails the GDPR consent test for your marketing

Connect capture to your sending platform

If you send through Purple Engage, campaigns trigger from login data directly. If you keep another platform, Purple integrates with CRM and marketing platforms, so consented records flow to the tools you already run. Pass the consent status with every record. Never sync guests who declined.

Purple's support documentation covers the configuration steps for your login page and integrations.

What should you send, and when, to protect your sender reputation?

Send a welcome while the visit is fresh

A guest who logged in today recognises your name today. In three weeks they may not, and an unrecognised sender is the one that gets reported. Trigger a welcome email automatically after the visit. Confirm what the guest signed up for and include the unsubscribe link in plain sight.

Ramp volume, don't spike it

Providers judge sudden jumps in volume as a risk signal. If you are moving to a new domain or platform, start with your most recently active guests. Increase volume week by week as your spam rate holds steady.

Segment by visit behaviour

WiFi logins tell you who visited, where and how recently. Use that, not a single list for everyone.

• Recent first-time visitors: a welcome and a reason to return.
• Regulars: recognition and early access, the basis of building a restaurant loyalty programme on email and WiFi.
• Lapsed guests: a single win-back message, then suppression if they do not respond.
• Site-specific audiences: local events only to guests who visited that site.

Set a sunset rule

Stop mailing guests who have not opened, clicked or visited for a fixed period, such as 180 days. Opens alone are unreliable. Apple Mail Privacy Protection preloads email content, which can register an open the guest never made. A returning WiFi login is a stronger signal, and one most sending platforms cannot see.

Worked scenario: a three-hotel group rebuilds its list

The figures below are illustrative planning assumptions, not a reported result.

Situation. A group of three 200-room hotels emails 24,000 contacts. The list mixes booking engine exports, old paper cards and a list bought five years ago. After a summer promotion crossed Google's bulk threshold, Gmail began routing its mail to spam.

What the group did. It suppressed every contact without a consent record, which left 8,500. It authenticated its domain with SPF, DKIM and DMARC and added one-click unsubscribe. It then moved new capture to an unticked opt-in at WiFi login, with a welcome email after every stay.

Measurable outcome. Assume 4,000 guest logins a month across the group and a 35% opt-in rate. That adds 1,400 consented contacts a month, or 16,800 a year. Within 12 months the list reaches 25,300, larger than before, and every record carries consent. The group measures success as a Postmaster Tools spam rate held below 0.10%.

How do you know your email deliverability is working?

Measure deliverability and commercial outcomes side by side. One without the other hides problems.

Deliverability signals

• Spam rate: Google Postmaster Tools reports it for Gmail. Keep it below 0.10%.
• DMARC pass rate: every legitimate source should pass. DMARC reports show the failures.
• Hard bounces: close to zero for addresses verified at login. A rise points to an imported or mistyped list.
• Microsoft reputation: Microsoft's Smart Network Data Services (SNDS) shows how Outlook.com sees your sending IPs, if you send from dedicated ones.
• Unsubscribe rate per send: a sudden jump means the content or frequency missed.

Commercial signals

• Opt-in rate at login: the share of WiFi guests who choose marketing. It tells you how well your consent wording works.
• Revenue per send: bookings or redemptions divided by messages sent.
• Repeat visit rate: return logins from emailed guests compared with guests who did not receive the campaign.
• Lifetime value: spend and visits per guest over 12 months.

Worked scenario: a 12-site pub group fixes its Friday sends

The figures below are illustrative planning assumptions, not a reported result.

Situation. A 12-site pub group holds 30,000 consented guests. Every Friday it emails all of them about every event at every site. Unsubscribes climb each week. At that volume, 30 spam reports in one send already put the group at Google's 0.10% line.

What the group did. It sent each event only to guests who had logged in to WiFi at that site in the past 90 days. It applied a 180-day sunset rule and capped each guest at one event email a week. It paired email with SMS for time-sensitive nights, following event marketing for pubs: an SMS and email campaign checklist.

Measurable outcome. Assume each site has 2,500 recent visitors. Weekly volume falls from 360,000 messages (12 events sent to 30,000) to 30,000 (12 events sent to 2,500). That is a 92% cut, and every guest still hears about the event at their local. The group now reports bookings per 1,000 sends by site, so it can see which events earn their place.

What goes wrong with venue email deliverability, and how do you avoid it?

• Importing an old list. Addresses gathered years ago, without recorded consent, generate bounces and complaints. Keep only contacts whose consent you can prove.
• Buying a list. A purchased list carries no consent for your brand and can contain spam traps. Do not send to it.
• Pre-ticked or bundled boxes. Recital 32 rules out pre-ticked consent. Bundling marketing with WiFi access undermines Article 7(4). Keep the box unticked and optional.
• Missing one-click unsubscribe. Gmail and Yahoo require the RFC 8058 header for bulk marketing mail. Confirm your sending platform adds it to every campaign.
• Slow unsubscribes. Google and Yahoo expect opt-outs honoured within two days. CAN-SPAM allows up to 10 business days, but meet the stricter standard.
• Launching a new domain at full volume. Ramp up, starting with your most recently active guests.
• Sharing consent across brands without saying so. If your group runs several brands, name them at the point of consent.
• Forgetting SMS. PECR covers text messages as well as email. Apply the same consent and opt-out rules to both.
• Trusting opens as proof of interest. Use clicks, bookings and return WiFi logins as your engagement signals.

Frequently asked questions

What are email deliverability services, and does a venue need them?

Yes, any venue sending marketing email at volume needs them. Email deliverability services cover domain authentication, sending reputation, bounce and unsubscribe handling, and inbox monitoring. They decide whether your campaigns reach the inbox or the spam folder. For venues, the biggest factor is list quality. A list built from consented opt-ins at guest WiFi login gives any deliverability service far less to fix than a list assembled from old imports.

Is an opt-in at guest WiFi login valid consent under GDPR?

Yes, provided it meets the GDPR standard. Consent must be freely given, specific, informed and unambiguous under Article 4(11). The marketing box must be unticked by default, as Recital 32 requires. The WiFi must also work whether or not the guest opts in, in line with Article 7(4). Name the brands and channels covered, link your privacy notice, and make withdrawal as easy as signing up.

Do I need SPF, DKIM and DMARC if I only send a few hundred emails a week?

Yes, you should set up all three. Google requires every sender to authenticate with SPF or DKIM. Senders above 5,000 messages a day must use SPF, DKIM and DMARC together. Google treats a sender as bulk permanently once it crosses that line, and one busy promotion can do it. Setting up all three now costs little and protects your reputation before you grow.

What should I do with my existing email list when I switch platforms?

Keep only the contacts whose consent you can prove, and leave the rest behind. Old imports, paper cards with no record and purchased lists drive bounces and spam complaints on a new sending domain. Start your first sends with the most recently active guests, then grow volume week by week. Replace lost contacts with fresh, consented opt-ins captured at guest WiFi login.

Does Purple work with the WiFi hardware we already have?

Yes, Purple is hardware-agnostic and runs as a cloud overlay on your existing network. It works with Cisco Meraki, HPE Aruba, Ruckus, Juniper Mist, Ubiquiti UniFi, Cambium, Extreme and Fortinet. You keep your access points and add Purple on top, with no rip and replace required. Your guest WiFi login page then becomes the place where consented guest data is captured.

How is Purple Engage different from Mailchimp, Klaviyo or HubSpot?

Purple Engage builds the list, not just the campaign. Mailchimp, Klaviyo and HubSpot send to contacts you bring them. Purple Engage captures verified guest email and phone data at WiFi login, with a conscious-choice opt-in, and automates campaigns from it. Because Purple sees return logins, you can segment by real visits and measure repeat visits, not just opens and clicks.

Can I rely on the soft opt-in instead of asking for consent?

No, not for WiFi sign-ups in the UK. PECR regulation 22(3) allows the soft opt-in only where you collected contact details during a sale or negotiations for a sale. A free WiFi login is not a sale, so ask guests for explicit consent. A till or receipt prompt during a purchase may qualify, but it must offer a clear opt-out at collection and in every message.

How does Purple protect the guest data we collect?

Purple is ISO 27001 certified and compliant with GDPR and CCPA. It also holds Cyber Essentials certification and is a certified B Corp. Guest data captured at login is first-party data, collected with consent, for your venue's own marketing. Purple has operated since 2012 and runs across 80,000+ live venues. You remain responsible for your consent wording, privacy notice and response to data subject requests.