Email Marketing Done Lawfully

CAN-SPAM: the US floor

The FTC's CAN-SPAM Act compliance guide for business sets out the requirements for commercial email. Header information — From, To, Reply-To and routing — must be accurate and identify the sender. Subject lines must not be deceptive. The message must be identified as an advertisement, clearly and conspicuously, though the law allows flexibility in how. It must include a valid physical postal address. It must tell recipients how to opt out of future email, with a mechanism that works and that your own spam filters do not block. Opt-outs must be honoured within 10 business days, and you may not charge a fee or ask for more than an email address to process one. And you cannot contract away responsibility: both the company whose product is promoted and the company that actually sends can be held liable.

Two points surprise small B2B teams. The FTC states plainly that the law makes no exception for business-to-business email. And penalties are per email: the guide lists penalties of up to $53,088 for each separate violating message. A sloppy sequence sent to a few thousand prospects is not a small exposure.

The 2024 mailbox-provider rules

Law sets the minimum; mailbox providers set the rules that decide whether you reach the inbox. Since February 1, 2024, Google's email sender guidelines have required more of anyone sending more than 5,000 messages a day to personal Gmail accounts: SPF and DKIM authentication, a DMARC record for the sending domain (a policy of 'none' is acceptable), alignment of the From domain with the SPF or DKIM domain, valid forward and reverse DNS, TLS, and — for marketing and subscribed messages — one-click unsubscribe with a visible unsubscribe link in the body. Google requires keeping the spam rate reported in Postmaster Tools below 0.30%, and recommends staying below 0.10%.

Yahoo's sender best practices set the same shape: authenticate with SPF and DKIM and publish DMARC, support one-click unsubscribe through a List-Unsubscribe header (the RFC 8058 POST method highly recommended), show a clearly visible unsubscribe link, honour unsubscribes within 2 days, and keep the spam rate below 0.3%.

Note the timing difference. CAN-SPAM allows 10 business days to honour an opt-out; Yahoo expects 2 days. Run to the stricter number. And although the hard requirements attach to bulk volume, the practices are simply how reputable mail looks; a small sender who ignores them gets filtered on reputation long before the volume threshold matters.

One-click unsubscribe, and what 'stop' must mean

RFC 8058, the standard both providers point to, defines how one-click works. The message carries a List-Unsubscribe header containing an HTTPS URI and a List-Unsubscribe-Post header with the value List-Unsubscribe=One-Click; the mail client can then unsubscribe the recipient with a single POST, without opening a web page. The standard requires a valid DKIM signature covering both headers, and the URI must carry enough information to identify the recipient and the list so the unsubscription can complete automatically.

The technical mechanism is the easy part. The hard part is operational: an opt-out must stop every future send to that address, from every sequence, campaign and scheduled message — including messages already queued before the opt-out arrived. The usual way this fails is a suppression list that exists but is not checked by every sending path, so a person who unsubscribed from the newsletter still receives step four of an outbound sequence. Treat 'checked at send time, on every path' as the definition of having a suppression list at all.

Opt-outs also arrive in forms no header captures: a reply that says 'please stop emailing me'. Honour those as opt-outs too.

Deliverability is a reputation you spend

Every send either builds or spends your domain's reputation with mailbox providers. Reputation is spent by complaints (recipients clicking 'report spam'), by bounces from bad addresses, and by sudden volume spikes from a domain with little history. It is built by mail people open, read and reply to, at a volume that grows steadily.

Practical rules: verify addresses before a cold sequence rather than learning from bounces; cap daily volume per mailbox and raise it gradually; write to people who fit your ICP with a reason they would recognize, because relevance is the best complaint prevention there is; make leaving easy, since a recipient who cannot find the unsubscribe link reaches for the spam button instead; and remove people who never engage. Many teams also send cold outbound from a separate subdomain so that a mistake there does not poison mail from the main domain — a common practice rather than a requirement.