Deliverability, Consent and the Reviewed Send

What the mailbox providers now require

Google's sender guidelines, in force since February 2024, apply stricter requirements to bulk senders, those sending 5,000 or more messages a day to personal Gmail accounts. They must authenticate with SPF and DKIM, publish a DMARC policy (which may be set to 'none'), support one-click unsubscribe on marketing and subscribed messages with a visible unsubscribe link in the body, and keep the spam rate reported in Postmaster Tools below 0.30%, with Google recommending under 0.10%.

Yahoo enforced near-identical requirements from February 2024: SPF and DKIM, a DMARC policy of at least p=none, a working one-click List-Unsubscribe header, unsubscribes honoured within two days, and a spam rate below 0.3%.

Microsoft followed for Outlook.com consumer mailboxes: from May 5, 2025, domains sending more than 5,000 emails a day must pass SPF, DKIM and DMARC. Non-compliant mail is routed to junk at first and may then be rejected outright with an authentication error.

A team sending a few dozen sales emails a day is below these thresholds, but the authentication requirements are good practice at any volume, and complaint rates are judged per domain. A careless campaign on your main domain can put your invoices and customer replies in spam.

What the law requires

In the United States, the CAN-SPAM Act applies to all commercial email and, as the FTC's compliance guide puts it, makes no exception for business-to-business email. Each message must not use deceptive headers or subject lines, must identify itself as an ad where applicable, must include a valid physical postal address, and must tell recipients how to opt out. Opt-out requests must be honoured within 10 business days, and the opt-out mechanism must keep working for at least 30 days after sending. Each violating email can carry a civil penalty of up to $53,088 (the figure as updated in January 2024).

In the United Kingdom, the ICO's guidance on business-to-business marketing says that PECR's electronic-mail consent rule does not apply to corporate subscribers (companies, LLPs and some public bodies), so B2B email to them does not need prior consent, but you must not hide your identity and must provide a valid opt-out. Sole traders and some partnerships are treated as individuals and generally need consent or the soft opt-in. UK GDPR still applies to the personal data of business contacts, who have an absolute right to object to direct marketing. The ICO notes the guidance is under review following the Data (Use and Access) Act, so check it before relying on it. Other jurisdictions, including the EU, are stricter; take local advice.

Voice is different again. In February 2024 the US Federal Communications Commission ruled that AI-generated voices are 'artificial' under the Telephone Consumer Protection Act, which means calls using them need the called party's prior express consent. An AI agent that phones prospects is not a loophole.

Why agents need review, and suppression on the sending path

AI agents change two things. They make it possible to send far more than any seller could write, and they can produce text no person has read. Both make review more important, not less.

For regulated firms this is already a rule. FINRA Rule 3110(b)(4) requires broker-dealers to have procedures for review of incoming and outgoing correspondence by a registered principal, documented with who reviewed what and when; its supplementary material notes that merely opening a communication is not sufficient review. Even for unregulated teams the principle is sound: a person should have the chance to read anything that goes out under their name to someone outside the company.

The second lesson is about suppression. A do-not-contact list is only a control if the sending path reads it. A list that is consulted by one tool but not by the scheduler behind your campaigns is a record of people you are still emailing. Opt-outs also arrive at awkward times, often after a message was queued, which is why they need checking both when a message is scheduled and at the moment it is sent.

Kavanah's outbound controls

Settings, Outbound shows the capacity plan for your mailbox pool, a per-mailbox daily cap, and the workspace suppression list, where you can add addresses that must never be emailed. Kavanah keeps two lists with different meanings. A hard bounce or complaint is a fact about an address, so bounces captured from a synced Gmail mailbox go on a global list every workspace's sending obeys. An opt-out is said to one company, so opt-out replies, unsubscribes and manual entries go on your workspace's list. Both are checked before a cadence step is generated and again at the wire; a fully suppressed message is marked failed, not retried forever.

New cadences include an unsubscribe link by default, and network cadences, outreach to people you are not yet in a deal with, always do and cannot turn it off.

Every agent action that sends a message to a person is in the 'Send messages & email' action category. In safe mode those tools are removed from the agent entirely; in full mode the category's policy decides, and unless an admin deliberately sets it to allow, the send is parked for approval. Parked actions appear in Settings, AI Agent, under 'Waiting for your approval'. For parked emails this is a reply desk: a reviewer can approve as written, or edit the subject and body (nothing else, so a recipient cannot be quietly changed) and approve the edited version. The agent's original draft is kept alongside what was actually sent and who edited it, and the message is sent from the mailbox of the person whose run drafted it, not the approver's.

Finally, for firms with a records obligation, an owner can turn on compliance archiving, which sends a copy of outbound mail to the firm's archive address and journals what people say inside Kavanah. When it is on, a send that cannot carry the archive copy is refused rather than sent unarchived.