# Sending compliance

This is practical guidance for people who send email, and it is not legal advice. Take your own advice on how these rules apply to your business.

## Every email you send

These apply to marketing and transactional mail alike, in every country we know of.

- The `from` address, the envelope sender and the subject must be accurate. Nothing in the headers should mislead the reader about who sent the message or what it contains.
- Give the recipient a real reply path. Send from a mailbox somebody reads, or set `reply_to` to one, and do not use an address that discards replies.
- Say who you are. Name the organisation sending the message somewhere the reader can see it, not only in the domain.
- Send only to addresses you obtained yourself. Bought, scraped and harvested lists cause complaints, and complaints cost you delivery to everyone.

## Marketing mail and transactional mail

A transactional message is sent because of something that recipient did. Password resets, receipts, booking confirmations and shipping notices are transactional.

A marketing message promotes something and goes out because you decided to send it, usually to a list. Newsletters, offers and product announcements are marketing.

The difference matters because the rules below mostly bite on marketing. If a message mixes the two, treat it as marketing when the promotional part is the main point of sending it.

## CAN-SPAM (United States)

CAN-SPAM covers commercial email sent to recipients in the United States. It does not require consent before you send, but it does require four things.

- Accurate headers and routing information, and a subject line that reflects what is inside.
- A valid physical postal address for your business in the message itself. A post office box or a registered agent address can qualify.
- A clear and working way to opt out, easy to find and easy to use, with no fee and no login.
- Honouring an opt-out within 10 business days. The opt-out mechanism must keep working for at least 30 days after you send.

Purely transactional messages are largely outside these rules, but their headers and subject must still be accurate.

## UK PECR and UK GDPR

Two sets of rules apply in the United Kingdom, and you need both.

PECR governs marketing by electronic mail. Consent is generally required before you market to an individual subscriber by email, and that consent must be freely given, specific and recorded.

There is one narrow exception, often called the soft opt-in. You may market your own similar products and services to someone who gave you their address during a sale or negotiations for a sale, provided you gave them a simple chance to object at that point and in every message since.

Every marketing message must offer a way to opt out, and you must act on an opt-out promptly. Rules differ for corporate subscribers, but individuals at those organisations can still object to receiving your mail.

UK GDPR sits underneath all of this. You need a lawful basis for holding the address at all, you must tell people what you do with it, and you must keep only what you need.

## Gmail and Yahoo bulk sender requirements

These are provider rules rather than law, and they decide whether your mail reaches an inbox. They apply to senders of roughly 5,000 messages a day or more to those providers, counted per sending domain.

- Authenticate with SPF, DKIM and DMARC. The DMARC record can start at `p=none`, and it must exist.
- Keep spam complaints below 0.3%, measured by the provider. Below 0.1% is the level to aim for, because a short spike above 0.3% can cost you delivery for weeks.
- Offer one-click unsubscribe on bulk mail, using the `List-Unsubscribe` headers described in RFC 8058, and process those requests within two days.

Falling below the bar does not produce an error from us. It shows up as mail going to spam or being rejected by the receiving provider.

## How Avelto helps

**Authentication.** When you add a domain we return the DKIM, SPF and DMARC records to publish. Verification checks the DKIM records; once verified we re-check DKIM and SPF nightly, and DMARC is advisory. See [Domains](/docs/domains).

**Complaints and bounces.** Addresses that hard-bounce or mark you as spam are added to your suppression list automatically, and later sends to them are refused before anything leaves. You can add an address yourself when someone unsubscribes. See [Suppressions](/docs/suppressions). Sending is paused on an account whose bounce rate for the day goes over 5% or whose complaint rate goes over 0.1%, judged once at least 20 emails have reached a final state that day; sends then return `403 account_paused`, the dashboard shows the reason, and we lift the pause once you have written in and the cause is fixed.

**One-click unsubscribe.** Set `unsubscribe_url` on a send and we add the `List-Unsubscribe` and `List-Unsubscribe-Post` headers, so a recipient can unsubscribe from their mail client in one click. The URL must be https, and it must accept an unauthenticated POST from the receiving provider.

Set `AVELTO_API_URL` to `https://api-staging.avelto.dev` and `AVELTO_API_KEY` to your key, then send a bulk message like this:

```bash
curl -X POST "$AVELTO_API_URL/v1/emails" -H "Authorization: Bearer $AVELTO_API_KEY" -H "Content-Type: application/json" -d '{
    "from": "Acme News <news@acme.com>",
    "to": "customer@example.com",
    "subject": "Your April update from Acme",
    "html": "<p>Hello from Acme.</p>",
    "unsubscribe_url": "https://acme.com/unsubscribe?token=abc123"
  }'
```

> **Transactional mail is left alone.** We do not add the `List-Unsubscribe` headers unless you ask for them. Leave `unsubscribe_url` off a receipt or a password reset and nothing is added. If you do want those headers on a transactional message, set them yourself through `headers`.

Your unsubscribe endpoint is yours to build. Record the request, stop sending to that person, and consider adding the address to your suppression list so a stray send cannot reach them.

## Checklist

- The `from`, envelope sender and subject are accurate, and the sender is identified in the message.
- Replies reach a mailbox somebody reads.
- Marketing goes only to people who consented, or who fit the soft opt-in for your own similar products.
- A physical postal address appears in commercial mail to the United States.
- Every marketing message has a working unsubscribe, honoured within days rather than weeks.
- SPF, DKIM and DMARC are published and the domain is verified.
- Bulk sends set `unsubscribe_url`, and your endpoint accepts an unauthenticated POST.
- You watch your bounce and complaint rates and act when they rise.

---

Rendered page: https://staging.avelto.dev/docs/compliance