Email course statistics, with every source

The thresholds that decide whether your mail arrives

Google asks bulk senders to keep the spam complaint rate reported in Postmaster Tools below 0.10 per cent and never to reach 0.30 per cent, and applies its bulk requirements from about 5,000 messages a day to Gmail addresses from one domain.

These are the only figures on this page that somebody enforces against you, and they are enforced by filtering rather than by a letter, so the first sign of a problem is usually a quiet fall in delivery. Both numbers are rates against mail the provider accepted from your domain, which is the detail that catches small senders: the same three complaints that are invisible on a list of a hundred thousand are the whole budget on a mailing of a thousand.

A small sender has no statistical cushion, only a structural one. That is the argument for confirmed opt-in stated as arithmetic rather than as principle: a handful of addresses that never really asked for the mail is a rate breach on a small list and a rounding error on a large one.

What a sender is required to do

Since February 2024, Google and Yahoo have both required SPF and DKIM on the sending domain, a DMARC record on the From domain, one-click unsubscribe in the message headers as RFC 8058 defines it, a visible unsubscribe link in the body, and any unsubscribe request honoured within two days.

Two sets of rules apply at once and they are not the same kind of thing. The mailbox providers publish requirements and enforce them by deciding where your mail lands; the law sets requirements and is enforced by a regulator. Where the two overlap, the providers ask for more and ask for it faster, so meeting the providers is what meeting the law looks like in practice.

The February 2024 date matters because it is when the two largest consumer mailbox operators published the same list at the same time, which moved this set of practices from advisable to load-bearing. Neither document has a version number, so the date belongs to the requirements rather than to the page they are written on.

What the most visited domains actually publish

Resolved on 20 September 2026 across the 1,000 highest-ranked domains of Tranco list PY96J: 764 of 1,000 publish an SPF record and 730 of 1,000 publish a DMARC record, and 613 of those 730 DMARC records ask for failing mail to be quarantined or rejected rather than sitting at p=none. These are this page’s own counts rather than anybody else’s figures, and the sample, the resolver and every selector queried are printed under the table so the run can be repeated.

Every other figure on this page is somebody else’s, which is both the strength of the rest of it and the limit: each one can be checked by following a link, and each one can also be got without coming here. This group is the opposite. It is a count of what a defined, public, permanently addressable list of domains had in their DNS on one morning, so none of it can be looked up anywhere else, and all of it can be repeated by anybody who wants to disagree.

The result that argues with the received account is the policy column. The usual claim is that DMARC in the wild is decorative — published at p=none to satisfy a requirement and left there. On this sample it is not: of the domains that publish DMARC at all, 613 of 730 ask for enforcement and 444 of 730 are at p=reject outright. What is missing is not the policy, it is the record. More than a quarter of the most visited domains in the world publish no DMARC record at all, and a domain with no DMARC record is a domain anyone can put in a From line.

Two limits decide how far these counts reach. The sample is the most visited websites rather than the largest senders: it contains content-delivery and interface domains that never send a message, and none of the small sending domains an email course actually runs on. And DKIM selectors are not enumerable — no query lists the selectors a domain has published, and a great many are generated per account — so the DKIM row is a floor taken from 24 named selectors the large platforms publish under, never a share. A domain missing from it may sign every message it sends.

What happens at the sign-up form

A dedicated opt-in page for a course commonly converts 15 to 30 per cent of its visitors and an inline form in a sidebar or an article footer 1 to 3 per cent. Of the addresses submitted, a fifth to a third never confirm.

These are planning bands, not measurements, and they are wide because the thing that moves them most is who is looking at the page rather than what is on it. Somebody who followed a link that said five-day course had already made most of the decision; somebody who reached the bottom of an article came for the article. No work on the form changes which of the two is reading it.

The confirmation loss is the figure people try hardest to avoid paying, and it is the one worth paying. What fails to confirm is mistyped addresses, bot submissions and interest that did not survive thirty seconds, which is precisely the population that produces the complaints the thresholds above are measured in. Part of the loss is recoverable by saying on the page that a confirmation is coming, sending it immediately, and sending exactly one reminder a day later.

What happens across the five days

Of confirmed readers, plan for 20 to 40 per cent clicking on day one, 15 to 30 per cent on day three and 10 to 25 per cent on day five, which is one in ten to one in four finishing. Cumulative unsubscribes across a five-day course usually total 2 to 8 per cent of confirmed readers.

Engagement does not decay smoothly. It falls sharply from day one to day two, flattens across the middle, and often ticks up on the last day, because the subject line says the course is finishing and the readers still present have selected themselves. Reading day one as the baseline is the commonest way to misread your own numbers: it arrives while the reader is still looking at the inbox, having just clicked a confirmation link, and no later day will match it.

Completion is counted as a click and not as an open, and that is not a stylistic preference. Apple Mail Privacy Protection loads remote content through a proxy whether or not the reader looked at the message, so the pixel an open is measured by fires regardless. The resulting open rate is not noisy, it is wrong in a consistent and flattering direction. A click is an act somebody chose to perform, inflated a little by security scanners, so it is an upper bound rather than a headcount.

What the inbox shows, and where it cuts

A phone reliably shows the first 30 to 40 characters of a subject line, and Gmail stops rendering a message at about 102,400 bytes and replaces the rest with a link.

Both of these are observed constants: nobody publishes them, they have held for years, and either could move without an announcement. They are here because they are the two figures that decide whether the writing is read at all, and because a page of sourced numbers that quietly omits the unsourceable ones is a page that has hidden its own limits.

The character figure is a pixel measurement being reported in characters, so it moves with the width of the letters you chose. Treat the narrowest inbox your readers use as the budget, and put the interesting word before the cut rather than trying to land exactly on it.