Email is the rare channel where cannabis brands have direct, permission-based access to their customers. No algorithm gatekeepers. No content policy reviewers. No ad platform deciding your audience for you. But that direct line is breaking, and it's breaking quietly.
Your emails are disappearing. Your open rates are dropping. And it's probably not your subject lines.
Most dispensary email lists have a 30-40% invalidity rate from old addresses and spam traps.
*Most dispensary email lists have a 30-40% invalidity rate from old addresses and spam traps.*
The rules changed in 2024
In February 2024, Google and Yahoo introduced new requirements for anyone sending more than 5,000 emails per day. If you run a dispensary with a customer list, you probably cross that threshold during a promotion. The new rules require three things:
Email authentication. Your sending domain must have SPF, DKIM, and DMARC properly configured. Without all three, Gmail and Yahoo will either mark you as spam or reject your messages outright.
One-click unsubscribe. Every marketing email needs a one-click unsubscribe mechanism that works within two days. Not a "log in to update preferences" link. Not a "reply with UNSUBSCRIBE in the subject line." One click. Done.
Stay under 0.3% spam complaint rate. If more than 3 out of every 1,000 recipients mark your email as spam, your sender reputation collapses. Google monitors this daily and the threshold is unforgiving.
This was not a suggestion. <a href="https://support.google.com/mail/answer/81126" rel="nofollow noopener noreferrer" target="_blank">Google published the requirements</a> and started enforcing them. Yahoo followed. Together they handle roughly 50% of all consumer email in the U.S. If you're not compliant, half your list cannot see your messages.
Most cannabis email programs are violating at least two of the three requirements, and the operators running them have no idea.
CAN-SPAM is the floor, not the ceiling
The <a href="https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business" rel="nofollow noopener noreferrer" target="_blank">FTC's CAN-SPAM Act</a> has been law since 2003. It applies to every commercial email. Not just bulk sends. Not just cold outreach. Every single promotional message.
The requirements are not complicated. Your "From" and "Reply-To" must be accurate. Your subject line must reflect the content. You must identify the message as an ad. You must include a physical mailing address. And you must honor opt-out requests within 10 business days.
Violations hit $53,088 per email. Per. Email.
The thing is, CAN-SPAM compliance alone will not save your deliverability. It's the legal minimum. The technical requirements from Gmail and Yahoo are what actually determine whether your message reaches an inbox.
Most cannabis operators I've talked to have never heard of DMARC. Some have never checked their spam complaint rate. A few are still sending from personal Gmail accounts with a BCC list. Every one of those emails is going to spam, and the recipients have no idea they signed up for anything.
Customers who don't see your emails don't know they're missing them.
*Customers who don't see your emails don't know they're missing them.*
Your ESP probably doesn't want you
Cannabis brands face an extra hurdle most industries never think about. Email service providers can refuse to serve you. And many do.
Mailchimp explicitly <a href="https://www.covasoftware.com/blog/email-and-sms-marketing-strategies-for-420" rel="nofollow noopener noreferrer" target="_blank">prohibits promotion of cannabis</a>, vaping, CBD, or any federally illegal drug. Klaviyo's terms are similarly restrictive.
SendinBlue and Brevo block THC and CBD content. Constant Contact allows cannabis but restricts product imagery.
This means dispensaries often end up on smaller ESPs with weaker infrastructure. Deliverability on those platforms is worse by default. Their IP pools get flagged more often. Their bounce handling is less sophisticated.
If you're on a cannabis-friendly ESP, you need to be more disciplined than the mainstream senders. Your authentication has to be perfect. Your list hygiene has to be tighter. You have no margin for error because your sending infrastructure starts with less trust.
The <a href="https://sparksbox.com/services" target="_blank">email marketing strategy</a> that works for regulated brands is fundamentally different from what works for DTC startups. Same channel. Completely different rulebook.
The authentication trinity
Three DNS records determine whether your email reaches an inbox or a spam folder. Here is what each one does:
SPF (Sender Policy Framework): Tells receiving servers which IP addresses are allowed to send email from your domain. Without it, anyone can spoof your domain and your ESP's sends get rejected.
DKIM (DomainKeys Identified Mail): Adds a cryptographic signature to every email that proves the message was not modified in transit. It's a digital seal of authenticity.
DMARC (Domain-based Message Authentication, Reporting, and Conformance): Tells receiving servers what to do when SPF or DKIM checks fail. Without a DMARC policy, Gmail and Yahoo will guess. They will guess wrong.
If you send marketing email and cannot confirm all three are configured correctly, stop reading this and check. Right now. Your ESP's support team can verify your SPF and DKIM records. DMARC can be checked at any number of free online tools.
This is not a one-time fix. Authentication records drift. ESPs change their sending IPs.
Domains get reassigned. Someone on your team changes a DNS record without understanding the downstream effect. <a href="https://sparksbox.com/blog/ai-marketing-attribution-model-2026" target="_blank">Just like attribution models need regular calibration</a>, email authentication needs quarterly review.
Your 10,000-name list
The hardest truth in cannabis email marketing is that list size is a vanity metric. Most dispensary lists I've audited have 30% to 40% invalid addresses. Old emails. Typo domains. Abandoned accounts. Spam traps.
Sending to bad addresses damages your sender reputation. Internet service providers track bounce rates. A high bounce rate signals that you are not maintaining your list. That signal pushes more of your email to spam, including messages to valid recipients.
The fix is unglamorous. Run your list through a verification service. Remove hard bounces immediately. Re-engage inactive subscribers with a dedicated campaign, and if they do not respond, remove them. A clean list of 2,000 active subscribers outperforms a dirty list of 10,000 every time.
A dispensary with 2,000 verified subscribers who open and click will generate more revenue than one with 10,000 names and a 4% delivery rate.
This is also where <a href="https://sparksbox.com/blog/conversion-tracking-before-channel-spend" target="_blank">proper conversion tracking</a> becomes essential. If you cannot see which emails drive revenue, you cannot justify the list hygiene work. But the hygiene has to come first, because you cannot measure what never reaches the inbox.
AI is not helping
AI email tools are exploding. AI subject line generators. AI copywriting for drip sequences. Personalization engines that adjust content per recipient. Every one of these tools increases the volume and decreases the distinctiveness of marketing email.
Gmail and Yahoo's spam filters are also AI-powered. They learn what promotional email looks like and they get better at filtering it. The more cannabis brands use the same AI tools to write the same kind of subject lines with the same structure, the easier it is for filters to identify and block the pattern.
AI-generated email copy is also more likely to trigger spam filters. Language models produce text patterns that look like machine output. The very tools operators are adopting to improve their email marketing are making their email less deliverable.
This is the <a href="https://sparksbox.com/blog/ai-content-paradox-measurement-gap-2026" target="_blank">AI content paradox</a> playing out in email. The tools that promise efficiency are creating a sameness problem that filters are evolving to catch.
The open rate drop you're seeing might not be about content quality at all.
*The open rate drop you're seeing might not be about content quality at all.*
What to fix this week
This is not a six-month project. You can fix the fundamentals in days.
Check your authentication. Log into your domain registrar or DNS provider and verify SPF, DKIM, and DMARC records. If you do not know how, ask your ESP support team. They deal with this daily.
Audit your list. Run it through a verification service. Remove hard bounces and any address that has not opened in six months. Yes, this will shrink your list. That is the point.
Test your own deliverability. Sign up for a free Gmail and Yahoo account. Subscribe to your own list. See if your emails land in the inbox. Do this from different devices and networks.
Add one-click unsubscribe. This is not optional anymore. If your ESP does not support RFC 8058 list-unsubscribe headers, switch ESPs.
Review your sending cadence. The operators seeing the best deliverability send less often but with higher-quality content. Two well-timed, informative emails per week outperform five promotional blasts.
FAQ
Yes. CAN-SPAM covers every commercial email sent in or to the United States, regardless of industry. Cannabis dispensaries are not exempt. Each violating email can cost up to $53,088.
CAN-SPAM is a legal requirement. Inbox placement is determined by technical factors like authentication (SPF, DKIM, DMARC), sender reputation, spam complaint rates, and engagement signals. You can be legally compliant and still land in spam.
Constant Contact permits cannabis content with some restrictions on product imagery. Several smaller ESPs like Cannabis Creative and specialized platforms serve the industry. Mailchimp, Klaviyo, Brevo, and SendinBlue prohibit cannabis promotion. Always verify current terms before signing up.
DMARC tells receiving servers what to do with emails that fail authentication checks. Without a DMARC policy, Gmail and Yahoo apply their own filtering rules, which are increasingly aggressive. Yes, you need it. Configure it at minimum to "p=none" for monitoring, then move to "p=reject" when you are confident your SPF and DKIM are correct.
Remove hard bounces immediately. Run a full verification pass quarterly at minimum. Re-engage inactive subscribers every six months and remove those who do not respond. Monthly monitoring of bounce and complaint rates will catch problems before they damage your sender reputation.
AI tools can help with subject line testing and send-time optimization. They can also hurt deliverability by generating copy patterns that spam filters recognize. The most reliable path to better inbox placement remains the unglamorous work: authentication, list hygiene, and sending content people actually want. --- Cannabis email is not dead. But the era of sending whatever you want and assuming it reaches the inbox is over. The operators who fix their authentication, clean their lists, and send less but better will own this channel. The ones who keep blasting the same 10,000-name list from a platform that barely tolerates them will watch their open rates tick toward zero. The work is not complicated. It is just work.