Blog

One question I’ve been asked quite a few times over the years is whether it’s possible to send bulk marketing emails directly through Microsoft Outlook, rather than paying for a dedicated email marketing platform like Mailchimp or Campaign Monitor.

It’s an understandable question. Most businesses already have access to Outlook through Microsoft 365, so why pay for another service when you’ve already got software capable of sending emails?

Well, the short answer is that yes, you can send bulk emails through Outlook, but there are some fairly important limitations to consider before you start emailing thousands of customers.

In fact, depending on how many emails you’re planning to send, and what you’re sending them for, it might be a particularly bad idea.

How Many Emails Can You Send Through Outlook?

Firstly, it’s important to understand that Outlook itself isn’t necessarily what determines how many emails you can send. That depends largely on the email service you’re using.

For example, Microsoft 365 business accounts using Exchange Online generally have a limit of 10,000 recipients within a rolling 24-hour period, alongside a limit of 30 messages per minute. There’s also a default limit of 500 recipients per individual message, although administrators can configure this differently.

These limits might sound reasonably generous, particularly if you’re only planning to email a few hundred customers, but they’re designed to prevent abuse rather than encourage businesses to use Outlook as an email marketing platform.

Microsoft also has systems in place to identify suspicious sending behaviour, and accounts can be temporarily restricted if their activity resembles spam.

It’s worth remembering that these are technical limits, not targets. Just because Microsoft allows an account to send a particular number of emails doesn’t necessarily mean it’s happy for you to use that allowance for mass marketing.

What About Using BCC?

Probably the simplest way to send the same email to multiple people is to add their addresses to the BCC field.

This prevents recipients from seeing everybody else’s email address, which is obviously preferable to adding hundreds of customers to the To or CC fields.

However, there are several problems with this approach.

Firstly, everybody receives essentially the same email, with no straightforward way to personalise the message. Secondly, there’s no proper system for managing unsubscribes, tracking engagement or automatically removing invalid email addresses.

There’s also the risk of accidentally putting your entire mailing list into the CC field, which could result in a rather embarrassing data protection incident.

And perhaps most importantly, sending hundreds of identical emails to multiple recipients can make your messages look suspicious to spam filtering systems.

So while BCC might be perfectly adequate for sending an occasional announcement to a small group of people, I wouldn’t recommend it for regular marketing campaigns.

Using Mail Merge with Outlook

A considerably better option is to use Microsoft Word’s mail merge functionality, which allows you to send individual, personalised emails through Outlook.

You can start with a spreadsheet containing your recipients’ email addresses, names and any other information you want to include. Then, using the Mailings tab in Word, you can create an email template and insert fields that are populated automatically for each recipient.

For example, rather than sending an email beginning with ‘Dear Customer’, you could personalise it to say ‘Dear John’ or ‘Dear Sarah’, depending on the information in your spreadsheet.

Once you’ve finished preparing the message, you can select ‘Finish & Merge’ and choose to send the emails through Outlook.

The result is a separate email for each recipient, rather than a single message containing hundreds of addresses.

It’s actually a useful feature, particularly for businesses that occasionally need to send personalised communications to relatively small lists.

However, you’ll generally need the desktop versions of Word and classic Outlook configured correctly, and there are still limitations. For example, the standard email mail merge functionality doesn’t provide a straightforward way to include individual file attachments.

More importantly, it doesn’t solve the problems associated with sending large volumes of email through Microsoft 365.

Could Bulk Emailing Damage Your Reputation?

This is probably the biggest consideration, and one that businesses frequently overlook.

Email providers such as Microsoft and Google use various systems to determine whether incoming messages are legitimate or potentially unwanted.

If you suddenly start sending thousands of emails from an account that’s previously only sent a few dozen messages each day, there’s a possibility that your activity will be flagged as suspicious.

If recipients start marking your emails as spam, that can make matters worse.

Over time, poor sending practices can damage the reputation associated with your email domain, potentially affecting the delivery of legitimate business communications.

Imagine discovering that your sales enquiries, quotations or invoices are ending up in customers’ spam folders because somebody decided to send 5,000 promotional emails through Outlook.

That’s a fairly significant risk to take simply to avoid paying for an email marketing service.

It’s also worth remembering that Google and Yahoo introduced stricter requirements for bulk email senders in February this year, including requirements around authentication and making it easier for recipients to unsubscribe.

Email deliverability is becoming increasingly complicated, and it’s not something I’d recommend ignoring.

What About GDPR?

There’s also the question of whether you’re legally allowed to send the emails in the first place.

Under the UK’s Privacy and Electronic Communications Regulations (PECR), businesses generally need consent before sending unsolicited marketing emails to individuals, although there are exceptions for existing customers where certain conditions have been met.

The rules are different for marketing to corporate subscribers, but that doesn’t mean you can simply email anybody you like without considering data protection requirements.

You also need to provide a straightforward way for recipients to opt out of future marketing communications.

Dedicated email marketing platforms make managing these requirements considerably easier, with built-in unsubscribe links, suppression lists and records of subscriber preferences.

Outlook doesn’t provide the same functionality automatically, leaving you responsible for managing everything yourself.

So Should You Use Outlook?

Personally, I think it depends entirely on what you’re trying to achieve.

If you need to send a one-off communication to 50 existing customers, Outlook’s mail merge functionality might be perfectly adequate, provided you’re entitled to contact those people.

However, if you’re planning regular marketing campaigns to hundreds or thousands of recipients, I’d strongly recommend using a dedicated email marketing platform instead.

Services such as Mailchimp, Brevo and Campaign Monitor are specifically designed for this purpose, offering proper list management, campaign reporting, unsubscribe handling and tools to help manage deliverability.

Some even offer free plans for businesses with relatively small mailing lists, so the financial argument for using Outlook isn’t necessarily particularly strong.

Ultimately, the fact that Outlook can send bulk emails doesn’t automatically mean it’s the right tool for the job.

You could probably use Excel to manage your entire customer database too, but that doesn’t necessarily make it a good alternative to a proper CRM system.

If you run a website, there’s a good chance you regularly check Google Analytics to see how many visitors you’re getting, where they’re coming from and which pages they’re looking at. You might also use Google Search Console to monitor your search engine rankings and identify any problems Google has encountered while crawling your website.

However, there’s another source of information that I think is frequently overlooked, even by people who work in digital marketing, and that’s your website’s server log files.

Unlike Google Analytics, which relies on tracking code to collect information about visitors, server logs record requests made directly to your web server. They can tell you which pages are being requested, when those requests occurred, which IP addresses they came from and whether your server was able to respond successfully.

It might not sound particularly exciting, but you’d be surprised how much useful information is hiding in those files.

What Exactly Are Server Log Files?

Every time somebody visits a page on your website, their browser sends a request to the server hosting it. The server then responds by sending back the requested content, whether that’s an HTML page, an image, a stylesheet or something else.

Most web servers, including Apache and Nginx, can record these requests in files commonly referred to as access logs.

Each entry typically includes the visitor’s IP address, the date and time, the URL requested, the HTTP response code and information about the browser or software making the request.

For example, if somebody visits your homepage, you might see a request for / with a response code of 200, indicating that the server successfully delivered the page.

If somebody requests a page that no longer exists, you’ll probably see a 404 response instead.

And if your server encounters a problem, you might see a 500 error, indicating that something has gone wrong.

Most website owners will never need to look at this information, but if you’re trying to understand why something isn’t working properly, it can be extremely useful.

What Can Log Files Tell You About SEO?

From an SEO perspective, one of the most interesting things about server logs is that they allow you to see how search engine crawlers interact with your website.

Google uses automated software called Googlebot to discover and retrieve pages for its search engine. While Google Search Console provides information about crawling and indexing, your server logs can offer a much more detailed picture of which URLs are actually being requested.

For example, you might discover that Googlebot is repeatedly visiting hundreds of old URLs that no longer exist, or spending considerable time crawling pages that aren’t particularly important.

Alternatively, you might find that some of your most valuable pages haven’t been requested by Googlebot for weeks.

This doesn’t necessarily mean there’s a problem, as Google doesn’t crawl every page at the same frequency, but it can help identify areas worth investigating.

It’s particularly useful for larger ecommerce websites, where thousands of product pages, category pages and filtered URLs can create an enormous number of possible combinations for search engines to crawl.

Google only has a finite amount of resources available for crawling websites, something commonly referred to as a ‘crawl budget’. If those resources are being spent repeatedly requesting unimportant URLs, it can potentially delay the discovery of more valuable content.

Incidentally, it’s worth remembering that user-agent information can be faked, so a request claiming to come from Googlebot isn’t necessarily genuine. Google provides guidance on verifying its crawlers using IP addresses and DNS lookups.

Finding Problems You Didn’t Know Existed

Another useful application is identifying technical problems that might otherwise go unnoticed.

Let’s say your website has a page that occasionally returns a 500 error. Unless somebody reports it, or the problem occurs while you’re testing the website, you might never know there’s anything wrong.

However, those failed requests should appear in your server logs, making it possible to identify when the problem occurred and which URLs were affected.

You might also discover broken links, redirect loops or requests for files that no longer exist.

One particularly useful exercise is to look for URLs generating large numbers of 404 errors. Sometimes these will be requests for old pages that have been removed, but they can also reveal internal links that need correcting or external websites linking to incorrect addresses.

Of course, not every 404 is a problem that needs fixing. Websites constantly receive requests for URLs that have never existed, particularly from automated bots, so there’s little point trying to eliminate every error.

The important thing is identifying patterns that suggest something genuinely needs attention.

What About Security?

This is another area where server logs can be particularly revealing.

If you’ve ever examined the access logs of a publicly accessible website, you’ll probably have noticed some rather strange requests.

It’s not unusual to see automated systems trying to access WordPress administration pages, looking for vulnerable plugins or requesting files that have absolutely no business existing on your website.

Most of these attempts are simply automated scanning activity rather than somebody specifically targeting your business.

However, server logs can help identify suspicious behaviour, particularly when large numbers of requests originate from the same IP address or repeatedly target sensitive areas of your website.

They can also help explain sudden spikes in server load, which might otherwise be mistaken for an increase in genuine visitors.

Obviously, reviewing logs isn’t a substitute for proper website security, but it can provide useful evidence when something unusual happens.

How Do You Access Your Log Files?

That depends on where your website is hosted.

If you’re using a hosting control panel such as cPanel or Plesk, there’s a good chance you’ll find an option to download or view your access logs.

If you manage your own server, the files are commonly stored in directories such as /var/log/apache2/ or /var/log/nginx/, although their exact location will depend on your configuration.

For smaller websites, you can often get away with opening the files in a text editor, but larger sites can generate hundreds of thousands of entries, making manual analysis rather impractical.

Fortunately, there are tools available to help. Screaming Frog’s Log File Analyser, for example, can process server logs and provide useful information about search engine crawling behaviour without requiring you to manually inspect every request.

If you’re comfortable with a little programming, you can also analyse the files using Python, which makes it relatively straightforward to filter requests, identify patterns and produce reports.

Should You Be Checking Them Regularly?

Personally, I wouldn’t suggest that every small business owner needs to start downloading their server logs every morning.

For most websites, Google Analytics and Search Console will provide enough information to understand how the site is performing, and log file analysis probably isn’t going to transform your SEO overnight.

However, if you’re responsible for a large website, investigating technical SEO problems or trying to understand unexpected server behaviour, I’d strongly recommend taking a look.

There’s a considerable difference between knowing what Google Analytics says is happening on your website and seeing what requests your server is actually receiving.

And sometimes, the most useful information is the stuff your analytics software never recorded in the first place.

If you work in digital marketing, you’ll probably be aware that Apple has been making life increasingly difficult for advertisers over the last few years. What started with restrictions on third-party cookies in Safari has gradually expanded into a much wider effort to prevent companies from tracking people as they browse the internet.

The latest development comes with iOS 17, which introduces new privacy features designed to prevent websites and advertisers from identifying users through tracking information embedded in URLs.

While the update was actually released back in September, the implications for digital marketers are still being discussed, particularly when it comes to measuring the effectiveness of advertising campaigns.

So is Apple about to make website tracking impossible, or is this another change that sounds considerably more dramatic than it actually is?

What Is Apple Changing?

One of the more interesting features introduced in iOS 17 is something Apple calls ‘Link Tracking Protection’, which forms part of its wider Advanced Tracking and Fingerprinting Protection functionality.

Essentially, this allows Safari to automatically remove certain tracking parameters from website addresses when somebody clicks on a link.

You might have noticed that when you click an advertisement or a link in an email, the URL sometimes contains an enormous amount of seemingly meaningless information after the actual page address.

For example, rather than visiting:

www.example.com/products/

You might find yourself visiting something like:

www.example.com/products/?click_id=123456789

That additional information can be used to identify a particular click, allowing advertisers and analytics platforms to associate subsequent activity with the original advertisement.

Apple’s new feature identifies certain parameters that could be used to track individuals across websites and removes them before the destination page is loaded.

Importantly, the link itself should continue working normally. It’s the identifying information that’s being removed, rather than the actual destination.

Does This Affect Every Website Visit?

Fortunately for advertisers, the restrictions aren’t quite as comprehensive as they might initially sound.

By default, Link Tracking Protection operates in Safari’s Private Browsing mode, as well as when handling links through Apple’s Mail and Messages applications.

However, users can also enable the functionality for regular Safari browsing by changing their privacy settings.

This means that somebody browsing normally in Safari won’t necessarily experience the same restrictions as somebody using Private Browsing, although Apple has made the additional protection available to anyone who wants it.

It’s also worth remembering that Safari already includes Intelligent Tracking Prevention, which restricts the ability of third-party cookies and other tracking technologies to follow people between websites.

So while Link Tracking Protection introduces another obstacle for advertisers, it’s really an extension of changes that have been taking place for several years.

Will This Break Google Analytics?

This is probably the question that interests me most.

Google Analytics 4 relies on various methods to collect information about website visitors, including first-party cookies and events generated by the tracking code installed on a website.

Fortunately, the new restrictions don’t simply prevent Google Analytics from operating.

If somebody visits your website using Safari, Google Analytics can still record information about their visit, subject to the usual browser restrictions and consent requirements.

However, problems can arise when analytics platforms rely on identifying parameters in URLs to connect a particular visit or conversion to an earlier interaction.

For example, Google Ads uses identifiers such as the Google Click Identifier, or GCLID, to help associate website activity with advertising clicks.

If identifying information is removed before the website receives it, certain forms of attribution could become less reliable. The actual effect will depend on which parameters are affected, the browser settings being used and how the website’s tracking has been configured.

It’s important not to confuse this with ordinary UTM parameters, such as utm_source and utm_campaign, which are commonly used to identify the source of website traffic. Apple’s approach is primarily concerned with parameters that can identify individual users, rather than simply describing which marketing campaign generated a visit.

In other words, there’s no reason to assume that all your campaign tracking is suddenly going to stop working.

Haven’t We Been Here Before?

This isn’t the first time Apple has introduced privacy changes that have caused concern among digital marketers.

Back in 2021, the introduction of App Tracking Transparency in iOS 14.5 required applications to obtain permission before tracking users across other companies’ applications and websites.

That change caused considerable problems for Meta, particularly because Facebook’s advertising platform relied heavily on tracking users between its applications and external websites.

Apple also introduced Mail Privacy Protection with iOS 15, making it more difficult for email marketing platforms to determine whether somebody has actually opened an email.

As a result, email open rates have become considerably less reliable as a measure of engagement, particularly for audiences using Apple Mail.

The common theme is that Apple is gradually reducing the amount of information advertisers can collect about individual users.

From a privacy perspective, I can understand why people might welcome these changes. However, from a marketing perspective, it makes accurately measuring the performance of campaigns considerably more complicated.

What Can Advertisers Do About It?

Personally, I think the most important thing is to make sure you’re not relying too heavily on any single method of tracking.

If you’re using Google Ads, for example, it’s worth reviewing your conversion tracking configuration and considering features such as Enhanced Conversions, which can help improve attribution using appropriately collected first-party customer information.

Server-side tracking is another option worth investigating, although it’s important to understand that moving tracking away from the browser doesn’t automatically bypass privacy restrictions or remove the need for consent.

I’d also recommend regularly comparing your analytics data against actual business results, whether that’s ecommerce sales, customer enquiries or information recorded in your CRM.

After all, if Google Analytics reports 100 conversions but your business has only received 70 enquiries, there’s clearly something worth investigating.

Is This the End of Website Tracking?

I very much doubt it.

The restrictions introduced in iOS 17 make certain tracking methods less effective, but they certainly don’t prevent businesses from understanding how people interact with their websites.

What they do demonstrate, however, is that the days of being able to track somebody relatively easily across numerous websites and applications are gradually coming to an end.

I suspect we’ll see further restrictions from Apple and other technology companies over the next few years, particularly as public awareness of online privacy continues to increase.

For advertisers, that means adapting the way we measure performance rather than simply expecting the same tracking methods to work indefinitely.

And perhaps that’s not necessarily a bad thing. There’s a reasonable argument that advertisers have become a little too dependent on tracking absolutely everything people do online.

Although I’d still quite like to know which of my Google Ads campaigns generated that last enquiry.

If you’ve ever spent any time looking through your website’s Google Analytics reports, you’ll probably have noticed that a considerable proportion of your visitors are classified as ‘Direct’ traffic. Traditionally, this has been interpreted as people typing your website address directly into their browser, or perhaps accessing it through a bookmark they’ve previously saved. However, there’s a good chance that quite a few of those visitors actually arrived through something called ‘dark social’, and you might be surprised by just how much traffic it accounts for. Despite the rather sinister-sounding name, dark social doesn’t have anything to do with the dark web, illegal activity or people secretly browsing Facebook in the middle of the night. It’s simply a term used to describe website traffic generated when people share links privately, through services such as WhatsApp, Facebook Messenger, email or other messaging applications, where the original source of the visit can’t easily be identified.

The term was originally coined by Alexis Madrigal in a 2012 article for The Atlantic, when he noticed that an unexpectedly large proportion of the publication’s website traffic appeared to be coming from direct visits. Given that many of these visitors were arriving on articles with relatively long and complicated URLs, it seemed extremely unlikely that they were all typing the addresses into their browsers manually. Instead, it appeared that people were sharing links privately with friends and colleagues, generating traffic that conventional analytics platforms couldn’t properly attribute. More than a decade later, with the enormous popularity of private messaging applications, the problem is potentially even more significant.

How Does Dark Social Work?

Ordinarily, when somebody clicks a link from one website to another, their browser can pass information identifying the referring website. Google Analytics uses this information to help determine where visitors have come from, allowing you to distinguish between traffic from search engines, social media platforms and other websites. However, things become considerably more complicated when somebody copies a link and sends it to a friend through WhatsApp, for example. Depending on how the recipient opens that link, the browser might not provide any information about where it originated. Unless the URL contains additional tracking information, Google Analytics has no reliable way of knowing that the visit came from WhatsApp, so it may classify the session as Direct instead. Imagine that you publish an interesting article on your website, which somebody discovers through Google. They then share it with five friends through WhatsApp, who each visit your website and share it with several more people. Your analytics might record the original visitor as coming from Google, while many of the subsequent visitors appear to have arrived directly.

How Much Traffic Are We Talking About?

This is where things become particularly interesting, because some estimates suggest that dark social accounts for a substantial proportion of online content sharing. Research published by RadiumOne back in 2016 suggested that as much as 84% of consumers’ outbound sharing activity happened through private channels, rather than publicly visible social media posts. That sounds like an enormous figure, although it’s important to distinguish between the proportion of content being shared privately and the proportion of website visits that actually originate from those shares. They’re not necessarily the same thing, and I suspect the figures will vary considerably depending on the type of website you’re operating. A news website publishing articles that people frequently share with friends might experience far more of it than a small ecommerce website selling relatively obscure industrial components. Nevertheless, if you’re seeing a substantial amount of direct traffic arriving on individual blog posts or product pages, rather than simply your homepage, there’s a reasonable possibility that some of those visitors are arriving through private links. After all, how many people do you think are manually typing a 100-character URL into their browser?

Why Does This Matter for Digital Marketing?

The biggest problem with dark social is that it can distort your understanding of which marketing activities are actually generating results. Let’s say you’ve spent several hours creating an article and promoting it through LinkedIn. Somebody sees your post, shares the article with a colleague through Microsoft Teams, and that colleague subsequently visits your website and submits an enquiry. Depending on how the visit is recorded, Google Analytics might attribute that enquiry to Direct traffic, even though the original interest was generated by your LinkedIn activity. If you’re making marketing decisions purely on the basis of what Google Analytics reports, you could conclude that LinkedIn isn’t generating particularly good results, despite it potentially influencing valuable enquiries. This becomes even more significant when you’re trying to calculate the return on investment from different marketing channels. However, I wouldn’t suggest that dark social makes analytics data worthless. It’s simply another reminder that attribution has never been an exact science, and that the reported source of a conversion doesn’t necessarily tell you the full story of how somebody became a customer.

Can You Track Dark Social?

Unfortunately, there’s no straightforward way to identify every visitor arriving through privately shared links, although there are a few things you can do to improve the situation. The first is to make sure you’re using UTM parameters when sharing links through your own marketing campaigns. These allow you to identify the source, medium and campaign associated with a particular visit, even when normal referral information isn’t available. For example, adding utm_source=newsletter and utm_medium=email to links in an email campaign can help Google Analytics identify traffic generated by that campaign. Of course, this doesn’t solve the problem of somebody copying an ordinary website URL and sending it privately to somebody else. You can also examine patterns in your direct traffic, particularly when visitors are arriving on pages that would be unlikely destinations for somebody manually entering a URL. Another useful approach is simply asking customers how they heard about your business. It’s not particularly sophisticated, but sometimes a straightforward question on an enquiry form can reveal information that even the most complicated analytics setup has missed.

Should You Actually Worry About It?

Personally, I wouldn’t lose too much sleep over dark social, particularly if you’re running a relatively small website. It’s certainly useful to understand that some of your direct traffic probably originates from private sharing, and you should be cautious about assuming that Google Analytics provides a complete picture of your marketing performance. However, I think there’s a danger of spending so much time trying to account for every visitor that you lose sight of what you’re actually trying to achieve. If people are sharing your articles, recommending your products or sending links to your website to their friends, that’s generally a positive thing, regardless of whether Google Analytics can identify exactly where those visitors came from. By all means, use UTM parameters, review your attribution reports and make sure your conversion tracking is configured properly, but don’t assume that every unexplained visitor represents a problem that needs solving. Sometimes, the most effective marketing is simply somebody recommending your business to somebody else, and if they’re doing that through WhatsApp rather than Facebook, I’m not particularly bothered whether Google Analytics knows about it.

If you’ve been using Google Analytics for any length of time, you’ll probably have noticed that things have changed rather dramatically over the last year or so. The familiar interface that we’ve been using for more than a decade has been replaced by something completely different, and quite frankly, I’m not convinced that everything has changed for the better.

Google Analytics 4 (GA4) was actually launched back in October 2020, but it wasn’t until July last year that Google finally stopped processing new data through the standard version of Universal Analytics, effectively forcing millions of website owners to switch to the new platform.

Now that we’ve had several months to get used to it, I thought it would be worth looking at what’s changed, why Google decided to replace Universal Analytics in the first place, and whether GA4 is actually any better than its predecessor.

Why Did Google Replace Universal Analytics?

According to Google, Universal Analytics was designed for an earlier generation of the internet, when most people accessed websites using desktop computers and tracking users through cookies was relatively straightforward.

Things have changed considerably since then. People now move between mobile phones, tablets, desktop computers and applications, making it increasingly difficult to understand their behaviour using traditional website analytics.

There’s also the growing issue of online privacy, with browsers restricting cookies and legislation such as GDPR placing greater emphasis on how businesses collect and process personal information.

GA4 is intended to address these problems by introducing a more flexible approach to measuring user behaviour, including the ability to track activity across websites and mobile applications.

In principle, that all sounds perfectly reasonable. However, I do wonder whether Google underestimated just how much people liked the old version.

Everything Is an Event

Probably the biggest technical difference between Universal Analytics and GA4 is the way they collect and organise information.

Universal Analytics was primarily built around sessions and different types of hits, including pageviews, events and ecommerce transactions.

GA4, on the other hand, uses an event-based data model, meaning almost everything somebody does on your website is recorded as an event.

Viewing a page generates a page_view event, clicking certain external links can generate a click event, and scrolling down a page can generate a scroll event.

This is actually quite a sensible approach, as it gives website owners considerably more flexibility in deciding which interactions they want to measure.

GA4 also includes something called Enhanced Measurement, which can automatically track certain activities without requiring additional tracking code for each individual action.

However, this flexibility comes at a cost, because some of the relatively straightforward reports and metrics we’ve become accustomed to in Universal Analytics now require a little more work to access.

Where Have All My Reports Gone?

This is probably my biggest frustration with GA4.

Universal Analytics had a relatively straightforward reporting structure, with sections covering audience behaviour, traffic acquisition, website content and conversions.

If I wanted to see which pages were attracting the most visitors from Google, for example, I could generally find that information within a few clicks.

With GA4, the reporting interface feels considerably less intuitive, particularly if you’re already familiar with Universal Analytics.

Some reports have been reorganised, others have disappeared, and certain information now requires you to create custom reports or use the Explore functionality.

To be fair, GA4 does offer some powerful analysis capabilities, including funnel exploration and the ability to examine individual user journeys in considerably more detail.

However, I can’t help feeling that Google has made some relatively simple tasks unnecessarily complicated.

For somebody who works with analytics regularly, that’s frustrating enough. For a small business owner who just wants to know how many people visited their website last month, I suspect it’s even worse.

What Happened to Bounce Rate?

Another change that initially caused some confusion was the apparent disappearance of bounce rate.

In Universal Analytics, bounce rate represented the percentage of sessions where somebody visited a page without triggering another interaction hit.

GA4 takes a different approach, placing greater emphasis on something called engagement rate.

An engaged session is generally one that lasts longer than ten seconds, includes a conversion event or involves at least two page or screen views.

This arguably provides a more useful indication of whether somebody has actually interacted with your website.

For example, imagine somebody visits a blog post, spends five minutes reading it and then leaves without visiting another page.

Universal Analytics might have recorded that as a bounce, despite the visitor potentially finding exactly what they were looking for.

GA4 would recognise that session as engaged, which makes considerably more sense.

Interestingly, Google has since reintroduced bounce rate into GA4, although it’s calculated differently from the old version. It’s now essentially the percentage of sessions that weren’t engaged.

Are the Numbers Supposed to Be Different?

One thing that’s caused a fair amount of confusion is that the figures reported by GA4 don’t necessarily match those previously shown in Universal Analytics.

You might find that your website suddenly appears to have fewer users, more engaged sessions or different conversion totals, even though nothing significant has changed in your marketing activity.

There are several reasons for this, including differences in how the two platforms calculate sessions, identify users and attribute conversions.

GA4 also uses different reporting identity options and can incorporate modelling in certain circumstances, which makes direct comparisons even more complicated.

The important thing to remember is that the two platforms aren’t measuring everything in exactly the same way.

Consequently, I’d be cautious about comparing your GA4 figures directly against historical Universal Analytics data and assuming any differences represent genuine changes in website performance.

Don’t Forget Your Historical Data

There’s one particularly important issue that website owners need to be aware of.

Although standard Universal Analytics stopped processing new data on 1st July 2023, Google has allowed users to continue accessing their historical reports temporarily.

However, that access is due to end on 1st July 2024, after which the old Universal Analytics properties and their data will no longer be accessible.

And unfortunately, you can’t simply transfer that historical information into GA4.

If you haven’t already done so, I’d strongly recommend exporting any historical data you might need, particularly if you regularly compare website performance over several years.

You can export individual reports into spreadsheets or use other methods, such as the Google Analytics API, to retrieve larger amounts of information.

It’s not a particularly exciting task, but discovering you’ve lost ten years of website statistics because you didn’t download them in time would be rather annoying.

Is GA4 Actually Better?

Despite my complaints, I don’t think GA4 is necessarily a bad product.

Its event-based approach is considerably more flexible, its integration with BigQuery opens up some interesting possibilities for more advanced analysis, and its ability to combine website and application data is a genuine improvement.

However, I do think Google has sacrificed some of the simplicity that made Universal Analytics so accessible.

For businesses that only need relatively basic website statistics, GA4 can feel unnecessarily complicated, while more advanced users may find themselves spending additional time recreating reports that were previously available by default.

Ultimately, GA4 is here to stay, so there’s little point wishing we could go back to Universal Analytics.

My advice would be to spend some time getting familiar with the new interface, make sure your important conversions are being tracked correctly and, perhaps most importantly, export your historical data before it’s too late.

And hopefully, Google will eventually make some of those reports a little easier to find.

One of the questions I’m frequently asked by smaller businesses is where they should be spending their advertising budget. With so many different platforms available, from Google Ads and Facebook to LinkedIn, Microsoft Ads and various others, it can be difficult to know which is likely to generate the best return, particularly when you’ve only got a few hundred pounds a month to work with. Unfortunately, there’s no single answer that applies to every business, and I’ve seen plenty of companies waste considerable amounts of money simply because they’ve chosen to advertise somewhere that isn’t particularly suitable for their products or services.

The good news is that you don’t necessarily need an enormous advertising budget to achieve worthwhile results. In fact, smaller budgets can sometimes encourage businesses to be much more selective about how they spend their money, rather than spreading it across dozens of campaigns without really understanding which ones are working. However, there are a few important things I’d consider before committing any money to a particular platform.

Google Ads – Reaching People Who Are Already Looking

Personally, I think Google Ads is often the most sensible starting point for businesses with a limited advertising budget, particularly if they’re offering products or services that people actively search for.

The main advantage of Google’s search advertising is that you can reach potential customers at precisely the moment they’re looking for something. If somebody searches for ’emergency plumber Worcester’, for example, there’s a pretty good chance they need a plumber, and probably sooner rather than later. Compare that with somebody scrolling through Facebook who happens to see an advertisement for plumbing services, despite having absolutely no intention of hiring a plumber.

Of course, Google Ads isn’t necessarily cheap. Depending on your industry, some keywords can cost several pounds per click, or considerably more in particularly competitive markets. However, if you concentrate on highly relevant searches, restrict your geographical targeting and avoid wasting money on irrelevant keywords, it’s possible to generate worthwhile results without spending thousands of pounds every month.

I’d generally recommend starting with a relatively small number of carefully selected keywords rather than attempting to advertise for every product or service you offer. It’s also worth paying close attention to your search terms report and adding negative keywords to prevent your advertisements appearing for searches that aren’t relevant to your business.

Facebook and Instagram – Creating Demand Rather Than Capturing It

Facebook and Instagram advertising operate rather differently, because people generally aren’t using these platforms specifically to look for products or services. Instead, you’re attempting to attract their attention while they’re doing something else, which means your advertisements need to be interesting enough to interrupt whatever they were looking at.

This can work extremely well for certain businesses, particularly those selling visually appealing products or services that people might not have considered purchasing until they saw an advertisement. For example, somebody probably isn’t going to search Google for a particular handmade gift they’ve never heard of, but they might be tempted to buy one after seeing it advertised on Instagram.

Meta’s advertising platform also offers sophisticated audience targeting, allowing you to reach people based on factors such as their location, interests and previous interactions with your business, although privacy restrictions have made some forms of targeting and measurement more difficult in recent years.

However, I’d be cautious about assuming that cheaper clicks automatically mean better results. You might be able to attract hundreds of visitors through Facebook for relatively little money, but if none of those people are particularly interested in buying anything, the campaign isn’t achieving much. Ultimately, the objective should be generating customers rather than simply increasing website traffic.

What About LinkedIn and Microsoft Ads?

LinkedIn can be particularly effective for businesses selling products or services to other businesses, especially when you’re trying to reach people working in specific industries or job roles. However, advertising on LinkedIn can be expensive compared with other platforms, and I’d be reluctant to recommend it to a small business with a very limited budget unless there was a particularly compelling reason to use it.

Microsoft Ads, on the other hand, is something I think businesses sometimes overlook. Although Bing has a considerably smaller share of the search engine market than Google, it still attracts a substantial audience, and advertising costs can sometimes be lower due to reduced competition.

If you’re already running successful Google Ads campaigns, it might be worth testing similar campaigns through Microsoft Ads to see whether you can generate additional enquiries at a reasonable cost. However, I’d generally establish which keywords and advertisements are working on Google first, rather than immediately dividing a small budget between both platforms.

Don’t Spread Your Budget Too Thinly

One mistake I regularly see is businesses attempting to advertise on several different platforms simultaneously, despite having barely enough money to run one campaign properly.

Let’s say you’ve got £300 a month available for advertising. You could spend £100 on Google Ads, £100 on Facebook and £100 on LinkedIn, but that leaves you with relatively little money to test anything properly. If your average Google Ads click costs £2, for example, your entire monthly budget on that platform would only generate around 50 visitors.

At that level, it could take quite some time to gather enough information to establish which advertisements and keywords are actually producing results.

Personally, I’d be much more inclined to concentrate the entire £300 on whichever platform appears most likely to generate customers, at least initially. Once you’ve established a campaign that’s performing reasonably well, you can consider experimenting with other channels.

Make Sure You’re Measuring the Right Things

Perhaps the most important consideration is making sure you’re actually measuring the results of your advertising.

Google Ads and Meta both provide conversion tracking functionality, allowing you to measure actions such as purchases, enquiry form submissions and telephone calls. Without this information, you’re effectively spending money without knowing whether it’s generating any business.

However, even conversion tracking doesn’t necessarily tell the whole story. If you’re generating enquiries rather than online sales, it’s worth considering how many of those enquiries actually become customers, and how much revenue they generate.

For example, one campaign might produce 20 enquiries at £10 each, while another produces just five enquiries at £25 each. The first campaign might initially appear more successful, but if most of those enquiries are poor quality and the second campaign generates several profitable customers, the results could tell a very different story.

Start Small, Then Increase What Works

Ultimately, I think the most sensible approach is to start with the platform that best matches how your customers actually find and purchase your products or services. If people are actively searching for what you sell, Google Ads is probably worth investigating first. If you’re selling something that benefits from visual advertising or needs to be introduced to potential customers, Facebook or Instagram might be more appropriate.

Whatever you choose, make sure you’ve got proper conversion tracking in place, give your campaigns enough time to gather useful information and avoid making changes simply because an advertising platform recommends increasing your budget.

There’s nothing wrong with starting at £200 or £300 a month, provided you’re realistic about what that money can achieve.

I’d much rather see a business spending £300 and generating £1,000 in profit than spending £3,000 without having the slightest idea whether any of it is working.

Choosing a web hosting provider is one of those decisions that often doesn’t receive much thought until something goes wrong. If you’re setting up a new website, it’s tempting to simply choose whichever company offers the cheapest hosting package, particularly when some providers advertise prices starting at just a couple of pounds a month. After all, if two companies are offering to host exactly the same website, why would you pay £20 a month when somebody else will apparently do it for £2?

Unfortunately, not all web hosting is created equal, and choosing the wrong provider can result in slow loading times, unreliable service and some fairly unpleasant surprises when you eventually need technical support. Having worked with websites hosted by dozens of different companies over the years, I’ve encountered everything from excellent service provided by relatively small hosting businesses to some spectacularly poor experiences with much larger, supposedly reputable providers.

So what should you actually be looking for when choosing somewhere to host your website?

What Type of Hosting Do You Need?

Firstly, it’s worth understanding that there are several different types of web hosting available, and the most suitable option will depend largely on the size and complexity of your website.

Shared hosting is generally the cheapest option, with multiple websites hosted on the same server and sharing its resources. For a relatively straightforward WordPress website receiving a few hundred visitors a day, this might be perfectly adequate, particularly if the hosting provider manages its servers properly.

However, problems can arise when websites on the same server start consuming excessive resources, potentially affecting the performance of other customers. Cheap shared hosting packages can also impose fairly restrictive limits on things like memory, CPU usage and database connections, which aren’t always particularly obvious when you’re signing up.

A Virtual Private Server (VPS) provides a more isolated environment, with a defined allocation of server resources and considerably more control over how the server operates. However, you’ll generally pay more, and unless you’re purchasing a managed service, you may also be responsible for maintaining the server yourself.

For most small businesses, I’d probably recommend a decent shared hosting package or managed WordPress hosting rather than attempting to run their own server. There’s little point having complete control over a VPS if you don’t know how to configure or maintain it properly.

Does the Server Need to Be in the UK?

This is something I’m regularly asked, particularly by businesses concerned about website speed and data protection.

If most of your customers are based in the UK, it generally makes sense to choose a hosting provider with servers located here, or at least somewhere reasonably close, such as another European country. The physical distance between your visitors and the server can affect how quickly information travels, although the quality of the hosting infrastructure and network connections is often more important than the precise location.

You should also consider using a Content Delivery Network (CDN), such as Cloudflare, which can cache certain website resources on servers closer to your visitors, potentially improving loading times regardless of where your main server is located.

There’s also the question of GDPR. If your website collects personal information through contact forms, customer accounts or ecommerce transactions, you’ll need to understand where that information is being stored and processed.

Hosting your website in the UK can make certain aspects of data protection easier to manage, but it’s not a legal requirement for every UK business. Hosting elsewhere can be perfectly acceptable, provided you comply with the relevant UK GDPR requirements, including any rules that apply to international transfers of personal data.

How Important Is Website Speed?

From an SEO perspective, website performance is something I’d pay particular attention to. Google has been using page experience signals, including Core Web Vitals, as part of its ranking systems, and while having an exceptionally fast website isn’t going to guarantee that you’ll rank above your competitors, poor performance certainly isn’t desirable.

More importantly, slow websites are frustrating for visitors. If somebody clicks through to your website and has to wait several seconds for every page to load, there’s a good chance they’ll give up and go somewhere else, particularly if they’re browsing on a mobile phone.

However, it’s important to remember that hosting is only one part of website performance. A badly built WordPress website containing dozens of unnecessary plugins and enormous images can still be painfully slow even when hosted on an expensive server.

When comparing hosting providers, I’d pay attention to the resources included with each package, whether they use SSD storage, what caching options are available and whether they’re using reasonably up-to-date versions of PHP and other server software.

I’d also be cautious about companies advertising ‘unlimited’ resources, as there’s almost always a fair usage policy or some other restriction hidden in the terms and conditions.

What Happens When Something Goes Wrong?

Personally, I think technical support is one of the most important considerations when choosing a hosting provider, and it’s something that’s difficult to evaluate until you actually need it.

If your website suddenly stops working at 9am on a Monday morning, you probably don’t want to discover that your hosting company only offers email support and generally takes two days to respond.

For a business that relies heavily on its website for enquiries or sales, even a few hours of downtime can become expensive. I’d therefore recommend checking whether support is available 24 hours a day, how you can contact the company and whether the people you’re speaking to actually understand the technical issues you’re likely to encounter.

It’s also worth finding out precisely what the provider is responsible for. Some companies will help investigate WordPress problems, while others will simply confirm that the server is running and leave everything else to you.

A UK-based support team can be particularly convenient for British businesses, although I’d be much more interested in the quality of support than whether the person answering the telephone happens to be sitting in London or somewhere else.

Backups, Security and Reliability

Another thing I’d strongly recommend checking is how your website will be backed up.

Most reputable hosting providers offer some form of automated backup service, but the frequency and retention periods can vary considerably. Some might take daily backups and retain them for several weeks, while others charge additional fees or provide much more limited protection.

You should also establish whether backups are stored separately from the main server and how straightforward it is to restore your website if something goes wrong. Ideally, I’d recommend maintaining your own independent backups as well, rather than relying entirely on your hosting provider.

Security is equally important, particularly for WordPress websites, which are frequently targeted by automated attacks. Look for features such as free SSL certificates, malware protection, firewalls and the ability to keep your server software updated.

Most providers also advertise uptime guarantees of 99.9% or higher, although it’s worth remembering that 99.9% uptime still allows for more than eight hours of downtime over a year. Check what the guarantee actually covers and whether any compensation would amount to more than a small credit against your hosting bill.

Don’t Just Compare the Introductory Prices

Finally, be careful when comparing prices, particularly with providers offering heavily discounted introductory packages.

A hosting plan advertised at £2.99 a month might require you to pay for several years upfront, with the renewal price increasing substantially once the initial contract expires. You might also discover additional charges for backups, domain registration, email hosting or other features that you assumed were included.

For UK customers, it’s also worth checking whether advertised prices include VAT, as some hosting companies display prices excluding VAT until you reach the checkout.

Personally, I’d rather pay a little more for a reliable hosting provider with decent support than save £50 a year and spend half a day trying to resolve a problem that shouldn’t have happened in the first place.

Ultimately, the best hosting provider isn’t necessarily the cheapest or the one with the longest list of features. It’s the one that provides the performance, reliability and support your particular website needs, at a price you’re comfortable paying.

If your website is an important source of business, I’d suggest treating hosting as something worth investing in rather than simply another expense to minimise. After all, even the most beautifully designed website isn’t particularly useful if nobody can access it.

If you’ve been involved in email marketing for any length of time, there’s a good chance you’ve used Mailchimp at some point. It’s been one of the most popular email marketing platforms for years, particularly among smaller businesses, thanks to its relatively straightforward interface and the ability to get started without spending a fortune. However, there’s another platform that’s becoming increasingly popular among ecommerce retailers, and that’s Klaviyo. Although both services allow you to send marketing emails to your customers, they take rather different approaches to how those emails are created, targeted and automated.

I’ve worked with Mailchimp on quite a few websites over the years, and while it’s perfectly capable of handling most basic email marketing requirements, I’ve increasingly been looking at Klaviyo as an alternative for ecommerce businesses. The main attraction isn’t necessarily that it’s easier to use or that its emails look any better, but rather how closely it integrates with platforms such as Shopify and WooCommerce, allowing businesses to make much better use of the information they already have about their customers.

What’s the Difference Between Mailchimp and Klaviyo?

At first glance, there isn’t an enormous amount separating the two platforms. Both allow you to create email campaigns, manage mailing lists, segment customers and set up automated messages triggered by particular activities. Mailchimp has also developed considerably beyond its original email marketing functionality, introducing customer journey automation, ecommerce integrations and various other features designed to compete with more sophisticated marketing platforms.

However, while Mailchimp started life primarily as an email marketing service and gradually expanded into ecommerce, Klaviyo was built with online retailers in mind. Its main selling point is the ability to collect and use information about customers’ purchasing behaviour, allowing businesses to create highly targeted marketing campaigns based on what people have actually been doing on their websites. For example, rather than simply sending the same promotional email to everybody on your mailing list, you could target customers who purchased a particular product six months ago, haven’t ordered anything since and have recently been browsing related products.

Mailchimp can handle some of this functionality too, particularly through its more advanced plans, but Klaviyo’s approach to ecommerce data and segmentation is particularly appealing if you’re running a busy online shop.

Making Better Use of Customer Data

One of the biggest advantages of Klaviyo is its integration with ecommerce platforms, particularly Shopify. Once connected, Klaviyo can synchronise customer information, purchase history and other shopping activity, making that information available for segmentation and automated marketing.

This opens up some interesting possibilities. Let’s say you’re selling printer cartridges, and you know that a particular customer generally places an order every couple of months. Rather than sending them a generic newsletter advertising your entire product range, you could automatically send a reminder when they’re approaching the point where they might need to order again. Alternatively, you could identify customers who regularly spend more than £100 per order and offer them a discount or early access to new products.

Klaviyo also offers predictive analytics features, including estimates of customer lifetime value and when somebody might place their next order. Obviously, these predictions aren’t going to be perfect, and they’ll be considerably more useful for businesses with a reasonable amount of historical sales data. Nevertheless, the ability to identify patterns in customer behaviour and use them to generate additional sales is particularly interesting.

What About Abandoned Baskets?

Abandoned basket emails are another area where Klaviyo can be particularly useful. If somebody adds products to their basket but leaves without completing their purchase, you can potentially send them an automated reminder encouraging them to return and finish their order, provided you have the necessary customer information and permission to contact them.

This isn’t something exclusive to Klaviyo, of course. Shopify, Mailchimp and various other platforms also offer abandoned basket functionality, but Klaviyo provides considerable flexibility when it comes to deciding who receives these messages and what they contain. For example, you might want to treat somebody abandoning a £500 basket differently from somebody abandoning a £15 purchase, or avoid offering discounts to customers who regularly complete purchases without needing an incentive.

It’s also possible to create automated sequences for welcoming new subscribers, encouraging repeat purchases and contacting customers who haven’t ordered anything for a while. While setting these up takes a little effort initially, they can potentially generate additional revenue without requiring somebody to manually create and send every campaign.

Is Klaviyo More Expensive?

Unfortunately, there’s a fairly important consideration when comparing the two platforms, and that’s the cost. Both Mailchimp and Klaviyo offer free plans for smaller mailing lists, with paid subscriptions generally increasing as your number of contacts grows. However, Klaviyo can become relatively expensive as your customer database expands, particularly if you’re comparing it against one of Mailchimp’s cheaper plans.

It’s also important to check exactly which features you’re getting for your money, because simply comparing the monthly subscription prices doesn’t necessarily tell you very much. If you’re only sending one newsletter a month to a few hundred subscribers, you probably won’t benefit from most of Klaviyo’s more sophisticated functionality, in which case there’s little reason to pay extra for it.

On the other hand, if you’re running an ecommerce business generating thousands of pounds in sales every month, a well-configured automated email campaign might easily justify the additional subscription cost. As with most marketing software, the important question isn’t necessarily how much it costs, but whether the additional functionality generates enough revenue to make it worthwhile.

How Difficult Is It to Move?

Fortunately, moving from Mailchimp to Klaviyo isn’t particularly complicated, although there’s a little more involved than simply uploading a spreadsheet containing your customers’ email addresses. Klaviyo provides an integration that can import information from Mailchimp, including subscriber details and certain engagement data, which makes the initial migration relatively straightforward.

However, you’ll still need to recreate your email templates, configure your automated campaigns and make sure your ecommerce integration is working correctly. It’s also important to preserve your existing unsubscribe information and marketing preferences, rather than accidentally contacting people who have previously opted out. I’d recommend checking your email authentication settings as well, particularly SPF and DKIM, and monitoring deliverability carefully when you start sending through the new platform.

Personally, I wouldn’t cancel Mailchimp until I’d confirmed that everything was working properly in Klaviyo, particularly if you have existing automated campaigns generating regular sales.

Should You Make the Switch?

Ultimately, I think Klaviyo is worth serious consideration for ecommerce businesses that want to make better use of their customer data, particularly those already using Shopify. Its segmentation and automation functionality can be extremely powerful, and there’s considerable potential to generate additional revenue from customers you’ve already acquired.

However, that doesn’t mean everybody should immediately abandon Mailchimp. If your existing email campaigns are performing well and you have relatively straightforward requirements, switching platforms might simply create additional work without delivering any meaningful benefits.

My advice would be to start by identifying what you actually want to achieve with your email marketing, rather than choosing a platform simply because it has more features. If Klaviyo allows you to do something valuable that you’re currently struggling to achieve with Mailchimp, it might well be worth making the move.

If all you’re doing is sending the occasional newsletter, though, I’d probably save yourself the trouble.

If you’ve ever received an email that appeared to come from your bank, PayPal or some other reputable company, only to discover that it was actually a phishing attempt, you might have wondered how the sender managed to make their email address look so convincing. Unfortunately, one of the fundamental problems with email is that the underlying technology was developed long before spam, phishing and online fraud became the enormous problems they are today. As a result, it’s surprisingly easy to send an email that appears to originate from a domain you don’t actually own, unless the receiving email provider has appropriate security measures in place.

Fortunately, there are several technologies designed to prevent this, one of which is something called DMARC. Although it’s been around for more than a decade, it’s becoming increasingly important for businesses that want to protect their domains against impersonation and ensure that legitimate emails are delivered successfully. However, configuring it incorrectly can cause some fairly serious problems, particularly if your business uses several different systems to send emails.

What Exactly Is DMARC?

DMARC stands for Domain-based Message Authentication, Reporting and Conformance, which is a rather complicated name for something with a relatively straightforward purpose. Essentially, it allows the owner of a domain to tell receiving email servers how to handle messages that claim to come from that domain but fail certain authentication checks.

For example, imagine somebody attempts to send a fraudulent email pretending to be from accounts@example.com. Without appropriate protection, the recipient’s email system might have difficulty determining whether the message genuinely originated from the company that owns example.com. DMARC helps address this by allowing the domain owner to publish a policy specifying what should happen when an email fails authentication, potentially instructing the receiving server to reject the message entirely.

However, DMARC doesn’t actually authenticate emails on its own. Instead, it works alongside two existing technologies called SPF and DKIM, which you’ll need to understand before implementing it properly.

What’s the Difference Between SPF, DKIM and DMARC?

SPF, or Sender Policy Framework, allows a domain owner to specify which servers are authorised to send emails on behalf of a particular domain. This information is published through DNS records, which receiving email servers can check to determine whether an incoming message originated from an authorised source.

DKIM, or DomainKeys Identified Mail, works rather differently. Instead of checking which server sent the message, it uses a digital signature that allows the receiving server to verify that the email was signed by a particular domain and that certain parts of the message haven’t been modified since it was signed.

DMARC builds upon these technologies by checking whether the domain authenticated through SPF or DKIM matches, or ‘aligns’ with, the domain displayed in the email’s From address. An email only needs one of these methods to pass with the correct alignment to satisfy DMARC, although I’d generally recommend configuring both SPF and DKIM wherever possible.

This distinction is important because simply having an SPF record doesn’t necessarily mean that your emails will pass DMARC. The domain being authenticated also needs to align with the address your recipients actually see.

Why Can DMARC Cause Problems?

This is where things become a little more complicated, particularly for businesses using services such as Mailchimp, Microsoft 365 or other third-party email platforms.

Let’s say your company uses Microsoft 365 for normal business emails, but also sends newsletters through Mailchimp and automated notifications through its website. Each of these systems might be configured to send messages using an address ending in your company’s domain name, but they won’t necessarily authenticate those messages in the same way.

If you introduce a strict DMARC policy without checking these services first, you could discover that legitimate messages are suddenly being rejected or sent to recipients’ spam folders.

I’ve come across situations where businesses have configured email authentication without fully understanding how many different systems are sending messages on their behalf. It’s surprisingly easy to overlook something like an enquiry form, CRM system or automated invoice platform, particularly if it was configured several years ago by somebody who no longer works for the company.

The result can be rather frustrating, because everything might appear to be working correctly from the sending system’s perspective, while the intended recipient never actually receives the message.

How Do You Set Up DMARC?

Fortunately, you don’t need to introduce the strictest possible policy immediately. In fact, I’d strongly recommend against doing so unless you’re already confident that all your legitimate email services are configured correctly.

DMARC is controlled through a DNS TXT record, usually created at _dmarc.yourdomain.co.uk. A relatively straightforward starting configuration might look something like this:

v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.co.uk

The important part here is p=none, which tells receiving email servers that you’re not requesting any special action against messages that fail DMARC authentication. Instead, you’re effectively placing your domain into a monitoring mode, allowing you to see which systems are sending emails using your domain and whether they’re passing the required checks.

The rua value specifies where aggregate authentication reports should be sent. These reports are generally produced in XML format, which isn’t particularly convenient to read manually, although there are services available that can process them into more understandable reports.

Once you’ve established which systems are legitimately sending emails, you can check that SPF and DKIM are configured correctly and resolve any authentication failures before considering a stricter policy.

Moving from Monitoring to Enforcement

DMARC supports three main policies: none, quarantine and reject. As we’ve already established, none is primarily used for monitoring, while quarantine requests that receiving email servers treat messages failing authentication as suspicious, typically placing them into a spam or junk folder. The strictest option, reject, requests that those messages be rejected altogether.

Personally, I’d recommend starting with p=none and reviewing the reports for several weeks before making any changes. Once you’re confident that legitimate emails are passing authentication, you can consider moving to p=quarantine and eventually p=reject.

The UK’s National Cyber Security Centre recommends a similarly gradual approach, allowing organisations to identify legitimate sending services before introducing policies that could interfere with email delivery.

It’s also worth remembering that DMARC doesn’t eliminate every type of phishing. Somebody could still register a domain that looks similar to yours, for example, and use that to impersonate your business. What DMARC does is make it considerably more difficult for somebody to successfully send unauthorised emails using your actual domain name.

Is It Worth the Effort?

I think so, particularly if your business relies heavily on email for communicating with customers. DMARC can help protect your domain from being impersonated, while also providing useful information about the various systems sending emails on your behalf.

However, I wouldn’t recommend simply copying a strict DMARC record from an online tutorial and assuming that everything will work correctly. Take the time to understand your existing email configuration, identify any third-party services and monitor the results before introducing stricter restrictions.

For smaller businesses using a single email provider, the process might be relatively straightforward. For larger organisations with multiple websites, CRM systems and marketing platforms, it can require considerably more investigation.

Ultimately, DMARC is one of those technical improvements that most people will never notice when it’s working properly, but can cause an enormous amount of frustration when it’s configured incorrectly.

Given how much businesses depend on email, I’d suggest taking the time to get it right.