October 5, 2026

Retention flows for DTC: email and SMS that shorten CAC payback

Email and SMS flows shorten CAC payback only by the repeat orders they cause, not by the revenue your email platform credits to them. Build the flows closest to an order first, meet the Gmail, Yahoo and Outlook.com sender rules before you scale, and collect SMS consent the way the TCPA and US carriers expect. Then hold out a random slice of each flow's audience and put the measured lift, not attributed revenue, into your payback math.

How does retention change CAC payback?

CAC payback is how many months a cohort's cumulative contribution takes to cover what you paid to acquire it. The definitions are in ROAS, MER or POAS. Retention moves it three ways: how many customers come back, how soon, and what each repeat order contributes after discounts and sending costs.

This is an illustration with made-up numbers. Say a brand pays a $40 CAC. The first order is $50 and contributes $20 after cost of goods, shipping, payment fees and returns. Repeat orders are also $50 and contribute $20 each, so the cohort pays back once it averages one repeat order per customer.

Cumulative per customer	Month 3	Month 6	Month 12
Repeat orders, current flows	0.30	0.55	0.90
Contribution, current flows	$26	$31	$38
Repeat orders, better flows	0.35	0.65	1.10
Contribution, better flows	$27	$33	$42

With current flows the cohort is still $2 short at month 12. Add 0.2 incremental repeat orders per customer and it pays back between months 6 and 12.

Now say a 20% off win-back code drove those extra orders. The $10 discount comes straight off the $20 contribution, since cost of goods and shipping don't change (I'm ignoring a small dip in payment fees). The extra orders add $2, not $4, and the cohort ends the year at exactly $40. If the code also goes to people who'd have reordered anyway, on 0.1 orders per customer, the cohort ends at $39 and misses payback.

So count only incremental orders, measured with a holdout, and charge each flow its discounts and sending costs. That incremental curve, not attributed revenue, is what we hold paid acquisition to for DTC brands.

Which flows to build first

The timings below are starting points to test, not benchmarks. Set replenishment and win-back timing from your own median days between first and second orders.

Flow	Trigger	Start testing at	Goal
Welcome	Signup, no order yet	At once, then 3 to 5 more over 2 weeks	First order, and learn what they want
Browse abandonment	Known visitor viewed a product, no add to cart	2 to 4 hours later	Return to the product
Cart abandonment	Added to cart, no checkout	1 to 4 hours, then 24 hours	Restart the order
Checkout abandonment	Started checkout, no order	30 to 60 minutes, then 24 hours	Recover the order, discount last
Post-purchase	Order delivered	Use tips 3 to 7 days after delivery	Fewer returns, reviews, a second order
Replenishment	Consumable ordered	Supply length minus 5 to 7 days	Full-price reorder
Win-back	No order in 1.5 to 2 times your median reorder gap	2 or 3 messages, then suppress	Reactivate, or stop mailing
VIP or loyalty	Crosses an order or contribution threshold	On crossing, then early access	Keep top customers buying

Start with checkout and cart abandonment. Baymard Institute's average of 50 studies puts documented cart abandonment at 70.22%, and the top reason in its survey of US shoppers who left checkout, at 40%, was extra costs such as shipping, taxes and fees. Test a message that makes total cost and delivery clear before you test a discount.

Keep order and shipping emails transactional. The FTC's CAN-SPAM guide says a mixed email counts as commercial if the subject line reads like a promotion or the transactional content isn't mainly at the start. Send cross-sells separately, with an unsubscribe link. For shoppers you can't identify, see retargeting after privacy changes.

What Gmail, Yahoo and Outlook.com require

All three require authentication and easy unsubscribes from high-volume senders. Gmail and Microsoft set the line at about 5,000 messages a day to their users. Yahoo doesn't publish one.

Rule	Gmail	Yahoo	Outlook.com
Who counts	Close to 5,000 a day to personal Gmail accounts, permanently	Bulk senders, no number published	Domains sending over 5,000 a day
Authentication	SPF and DKIM, DMARC p=none or stricter, aligned	Same as Gmail	SPF and DKIM pass, DMARC p=none or stricter, aligned
Unsubscribe	One-click header and visible link, honored within 48 hours	One-click header and visible link, honored within 2 days	Clear and easy to find
Spam rate	Under 0.3%, ideally under 0.1%	Under 0.3%	None stated
In force	February 2024, rejections ramping up from November 2025	February 2024	5 May 2025

Two details trip brands up. Gmail's bulk status doesn't expire, so once you hit the threshold you stay a bulk sender, even in quiet months. And since June 2024, a bulk sender whose user-reported spam rate tops 0.3% is ineligible for mitigation until it stays below 0.3% for 7 consecutive days.

Microsoft's announcement, updated 29 April 2025, says high-volume mail that fails authentication is rejected with error 550 5.7.515, not sent to Junk. Its postmaster policy page still says Junk first, so plan for rejection. Transactional messages don't need Gmail's one-click header, but marketing flows do.

Why open rates mislead

Apple's Mail Privacy Protection downloads remote content in the background by default, whether or not the person engages with the email, through two relays that hide their IP address. Apple announced it in June 2021 to stop senders using invisible pixels to learn when someone opens an email. For Apple Mail users with it on, a tracked open only means the app fetched your images, not that anyone read the message. What to change:

Judge subject lines and flow tests on clicks, orders and contribution per recipient.
Base engaged segments and sunset rules on clicks, site visits and orders.
Don't branch flows on opens. A resend to non-openers skips anyone whose mail app fetched the pixel.
If your platform credits orders to opens, switch attribution to clicks, and trust the holdout over either.

SMS consent in the US, EU and UK

This section is general information, not legal advice. Have a lawyer who knows the TCPA and state telemarketing law check your opt-in flow before you send a marketing text.

TCPA basics

The FCC's TCPA rules in 47 CFR 64.1200 cover texts as well as calls. Marketing texts sent with an autodialer need prior express written consent: a signed agreement, and electronic signatures can count, that clearly authorizes the seller to send marketing to that number and says signing isn't a condition of purchase. The statute lets people sue for $500 per violation, and up to triple that for willful or knowing violations.

CTIA, the wireless industry's trade group, expects consent regardless. Its Messaging Principles call for express written consent to marketing messages and say an opt-in shouldn't be transferred or shared.

Since 11 April 2025, people can revoke consent by any reasonable means. Replies of stop, quit, end, revoke, opt out, cancel or unsubscribe count automatically, and you must honor them within 10 business days at most. One confirmation text without marketing is allowed.

Where the FCC's consent rules stand

The one-to-one consent rule is gone. It would have tied each consent to one seller and to calls logically and topically related to the interaction. The Eleventh Circuit vacated it on 24 January 2025, and the FCC removed it in August 2025.
The revoke-all piece, which would make an opt-out from one kind of informational message cover a sender's unrelated messages too, was delayed until 11 April 2026 and then until 31 January 2027.
On 1 October 2026 the FCC released a Report and Order that takes effect 30 days after Federal Register publication and supersedes that delay. From then, callers may treat an opt-out from an informational message as covering only that category, though a stop to a marketing message still ends all marketing from that sender. Callers may also make the standard reply words their only accepted opt-out method if each text discloses it.
Since the Supreme Court's McLaughlin decision in June 2025, district courts interpret the TCPA themselves, giving the FCC's reading appropriate respect but not treating it as binding.

Either way, treat any stop reply as a stop for every marketing text from your brand.

Carrier registration

US carriers require businesses texting from ordinary 10-digit numbers to register for A2P 10DLC, a standard meant to keep long-code traffic verified and consensual. Brands and campaigns are registered with The Campaign Registry, and brands are verified before they can send. Toll-free numbers and short codes sit outside 10DLC. Start registration in week one.

Quiet hours

Federal rules bar telephone solicitations before 8 a.m. or after 9 p.m. at the recipient's location, and the FCC applies them to marketing texts sent to mobile numbers. Florida's telemarketing law and Maryland's telephone solicitation law set 8 a.m. to 8 p.m. in the recipient's time zone and cap solicitations at three per person in 24 hours on the same subject. Whether a state rule reaches your texts, or sets narrower hours, is a question for your lawyer. The simple policy is to text only between 8 a.m. and 8 p.m. recipient time, with SMS flow steps waiting for that window. Otherwise a one-hour text for a cart left at 11 p.m. goes out at midnight.

EU and UK

In the EU, the ePrivacy Directive requires prior consent for direct marketing by electronic mail, defined broadly enough to include SMS. The exception is the soft opt-in. Details collected during a sale can be used to market your own similar products if the customer can object easily and free of charge at collection and in every message. GDPR defines valid consent as freely given, specific, informed and unambiguous, and requires that it be as easy to withdraw as to give. National laws implement the Directive, so check each country you sell to.

The UK's PECR works the same way. The ICO says you can't send marketing emails or texts to individuals without specific consent unless the soft opt-in applies, and that its guidance is under review after the Data (Use and Access) Act 2025.

Measure each flow with a holdout group

Attributed flow revenue includes orders that would have happened anyway. A holdout shows how many wouldn't have.

As people enter a flow, randomly assign 10% to 20% to a holdout that gets nothing from it. Randomize at entry, never on opens or clicks.
Treat both groups the same everywhere else.
Run at least one full buying cycle, such as a week for checkout abandonment or a supply length for replenishment, and until both groups have enough orders to read.
Compare orders, revenue and contribution per person, counting orders from every channel.
Multiply the difference in order rate by the number of people who got the flow. That gives you incremental orders.

Another illustration with made-up numbers. In a month, 10,000 people enter a checkout abandonment flow. Of those, 9,000 get it and 1,000 are held out. Within 7 days, 8.0% of the flow group buy (720 orders) against 5.5% of the holdout. That's a 2.5-point lift, about 225 incremental orders. If your platform credits the flow with 600 orders, about 38% of them were incremental.

With groups this size, the 95% confidence interval runs from about 1.0 to 4.0 points, roughly 90 to 360 orders, so extend or repeat the test before you set targets on it. The sample-size notes in landing pages for paid traffic apply here too. Then put the number into your payback curve, and keep a small standing holdout on your biggest flows.

A 30-day build order

Days 1 to 3: set up SPF, DKIM and DMARC at p=none on your From domain, plus one-click unsubscribe headers, a visible unsubscribe link and Google Postmaster Tools.
Days 1 to 5: give SMS its own unticked signup checkbox with the consent disclosure, frequency, any fees and how to stop, and start 10DLC registration.
Days 4 to 10: checkout and cart abandonment, with holdouts live from the first send.
Days 8 to 14: the welcome flow.
Days 12 to 18: post-purchase, with order and shipping messages kept transactional.
Days 16 to 22: replenishment for consumables, timed from your own reorder data.
Days 20 to 25: browse abandonment, and a win-back that ends by suppressing people who don't respond.
Days 24 to 28: VIP rules based on contribution, not just order count.
Days 28 to 30: a weekly report on clicks, orders, contribution per recipient, spam rate and holdout lift.

SMS steps go live only after registration is approved and consent is in place. Until then, run every flow on email.

If you want help

We don't build email or SMS flows. Our Growth audit ($1,000, two to three weeks) checks your acquisition against margin and payback, which is where retention shows up, sets breakeven and target numbers per channel and ends with a prioritized plan. If you'd like us to run paid media afterward, that's Growth Marketing, and you can book a 30-minute call to start.

Sources

Facts checked on 4 October 2026.