Module 7 · 7.2

English

Nederlands English Deutsch Français

Consent, unsubscribing and a clean list

Module 7: Newsletters and mail from your website · Reading time: 12 minutes

Learning objective: After this lesson, you can build and maintain an address list that both the law and spam filters trust, and you can check whether a newsletter has a working one-click unsubscribe.

Key concepts: consent in advance (opt-in), confirmed opt-in (double opt-in), exception for existing customers (soft opt-in), ePrivacy Directive 2002/58/EC article 13, GDPR, unsubscribe link, List-Unsubscribe (RFC 2369), List-Unsubscribe-Post and one-click unsubscribe (RFC 8058), complaint rate, hard and soft bounces, inactive addresses, spam trap, bought list

Technology alone isn't enough

In lesson 7.1, you authenticated your domain with a sending service. SPF, DKIM and DMARC are all correct. Yet your newsletter can still end up in spam. That's because recipients such as Gmail, Yahoo and Outlook.com also look at how their users react to your mail. Do people click "This is spam"? Do they never open your mail? Are you sending to addresses that stopped existing years ago? If so, your reputation drops, however good your technical setup is.

In its sender guidelines, Gmail sets a threshold: keep your spam rate (the share of your mail that recipients mark as spam, measured in Google Postmaster Tools) below 0.1%, and never reach 0.3% or higher. Yahoo applies the same 0.3% threshold. That's one complaint per 333 emails. With a list of people who don't know why they're getting your mail, you'll never achieve that.

So a clean list starts with one question: does this person actually want my mail?

What does the law say?

The rules on unsolicited electronic messages (spam) come from the European ePrivacy Directive (Directive 2002/58/EC, article 13), which each country has implemented in its own national law. Check the rules and the supervisory authority that apply in your own country. In the Netherlands, for example: article 11.7 of the Telecommunications Act (Telecommunicatiewet), explained on the website of the Authority for Consumers and Markets (ACM). Personal data is also covered by the GDPR. This isn't legal advice, but the main principles are clear:

Consent in advance. Advertising by email, including messages for charitable or non-profit purposes, may only be sent to someone who gave consent for it beforehand. You must be able to prove that consent. In the Netherlands, the ACM states that consent must be given knowingly: no pre-ticked box, nothing hidden in the terms and conditions, and the choice must clearly be about advertising.
Exception for existing customers, often called soft opt-in. If you obtained the email address when selling a product or service, you may email that customer about your own, similar products or services. Condition: you clearly gave them the chance to say no when collecting the address, and you offer that again in every email.
Business addresses. Consent in advance applies in principle to legal entities too. The exception is narrow: addresses that the company itself made public specifically to receive advertising, used for that purpose. Simply taking an address from a website doesn't count as consent.
Unsubscribing and sender identity. Every message must let the recipient unsubscribe free of charge and easily. You must always state the sender's true identity and a valid address the recipient can use to send a stop request.

So there's no such thing as a "bought list with consent" that you can simply mail: the consent has to have been given to you, for your messages.

Confirmed opt-in: proof and quality at once

With a plain opt-in, someone enters their address in a form and is immediately added to your list. The problem: anyone can enter any address, including someone else's, and typos (jan@gmial.com) end up on your list too.

With confirmed opt-in (double opt-in), the address first receives an email with a confirmation link. Only after the click is it added to the list. That has three advantages:

You prove that the owner of the address gave consent themselves (keep the date, time and IP address of the confirmation). In the Netherlands, the ACM states that you must be able to demonstrate consent even years after sending.
Your list only contains addresses that exist and are actually read.
You prevent bad actors or bots from filling your form with other people's addresses. Those people complain later, and that affects you.

Many hosting providers require confirmed opt-in if you send mailings through their servers. At WebOké, for example, this is covered in knowledge base article 18; other providers cover it in their acceptable use policy.

One-click unsubscribe

An unsubscribe link at the bottom of the email is a legal requirement. Large recipients also want an unsubscribe button in their own program: Gmail and Yahoo then show "Unsubscribe" at the top of the email. That works through two header fields.

List-Unsubscribe (RFC 2369) provides one or two unsubscribe methods, between angle brackets:

List-Unsubscribe: <https://lists.example.com/afmelden?id=7f3a9c>, <mailto:afmelden@lists.example.com?subject=afmelden-7f3a9c>

List-Unsubscribe-Post (RFC 8058) states that the https link works with one click, without the recipient needing to confirm anything on a page:

List-Unsubscribe-Post: List-Unsubscribe=One-Click

When the recipient clicks Unsubscribe in Gmail, Gmail sends a POST request with exactly List-Unsubscribe=One-Click to that URL. Your server then unsubscribes the address immediately. A few rules from RFC 8058:

the URL must be https;
the link must be unique per recipient (it contains a code), so the server knows who is unsubscribing;
the List-Unsubscribe and List-Unsubscribe-Post header fields must fall under the DKIM signature, otherwise someone could replace them in transit;
a GET request on the same URL must not unsubscribe immediately (virus scanners and preview features follow links), only the POST.

Gmail requires bulk senders (more than around 5,000 emails a day to Gmail addresses) to offer one-click unsubscribe in marketing mail, plus a visible unsubscribe link in the text. Yahoo requires the same and wants an unsubscribe request processed within 2 days. Even if you're a smaller sender: every good sending service adds these header fields automatically. Still, check it (see the exercise).

Keeping your list clean

A list ages. People change jobs, mailboxes get closed, interest fades. Without maintenance, your bounces and complaints rise while your opens fall. Five fixed habits:

Remove hard bounces immediately. A hard bounce (a 5xx error such as 550 5.1.1 "address doesn't exist", lesson 6.2) means the address doesn't work. Keep sending to it, and recipients will see you as a careless or spamming sender. Sending services do this automatically.
Keep an eye on soft bounces. A temporary error (4xx, for example a full mailbox) can happen a few times, but if an address fails on every send, remove it.
Process complaints. Anyone who clicks "This is spam" must come off your list. Large recipients send a notification through a feedback loop; sending services process these.
Clear out inactive addresses. Someone who hasn't opened or clicked anything in a year sends a bad signal. First send a re-confirmation email ("Do you still want to receive our newsletter?"), and remove anyone who doesn't respond. Note: since Apple Mail Privacy Protection (lesson 2.3), opens are unreliable; look at clicks too.
Never buy, rent or scrape lists. Besides the legal problem, such lists often contain spam traps: addresses that blocklist operators and recipients deliberately maintain to catch spammers. Some are old addresses reopened as traps after years of silence, others have never been signed up to anything. Mailing them proves you don't have consent. A single hit can get you on a blocklist (lesson 5.2).

In practice

Example: you run a web shop and want to send customers a newsletter about similar products after a purchase. At checkout, you add an unticked box "I want to receive the newsletter", or you use the exception for existing customers: at checkout, you clearly state that you'll email customers about similar products, with the choice "no, rather not", and every newsletter has an unsubscribe link. All mail goes through a sending service with an authenticated domain (lesson 7.1). The service automatically removes bounces and complaints, and you clear out inactive addresses twice a year.

For an association with a mailing list on its hosting package (at WebOké this is called Mailing Lists in DirectAdmin; other control panels have similar list features), it concerns members who expect the mail. Here too: state in every email how to unsubscribe, and remove former members from the list.

Summary

Recipients track complaints: stay below 0.1% and never reach 0.3%.
Under the rules implementing the ePrivacy Directive (in the Netherlands: article 11.7 of the Telecommunications Act), you may only send advertising email with demonstrable consent given in advance, with an exception for existing customers regarding similar products. Always include the sender's identity and an unsubscribe option.
Confirmed opt-in gives you proof and a list free of typos and fake sign-ups.
List-Unsubscribe with an https link and List-Unsubscribe-Post: List-Unsubscribe=One-Click, under the DKIM signature, and process unsubscribes within 2 days.
Remove hard bounces and complainers, clear out inactive addresses, never buy lists (spam traps).

Quiz

Exercise

Exercise Z7.2: Checking unsubscribe headers. Paste the headers of a newsletter you send yourself (or of a newsletter you receive, or the sample file nieuwsbrief-kopregels-2.txt). Fill in: is there a List-Unsubscribe with an https link (yes/no), is there a mailto: variant (yes/no), is one-click unsubscribe enabled (yes/no), and do these header fields fall under the DKIM signature (yes/no, see h= in the DKIM-Signature). The program parses the headers and compares them.

Exercise Z7.2: Checking unsubscribe headers

File for this exercise: nieuwsbrief-kopregels-1.txt, nieuwsbrief-kopregels-2.txt

Paste the headers of a newsletter (one you send or receive), or choose an example file. The unsubscribe links are never actually opened.

Which headers?

Pasted headers (optional)

An https link in List-Unsubscribe?

A mailto: version?

One-click unsubscribe enabled?

Are the unsubscribe headers covered by DKIM (h=)?

What you enter and what we find isn't stored. Your browser remembers your answers and whether you've passed the exercise. If you're signed in, we only save that you got the exercise (almost) right in My courses; you can delete that there too.

Exercise O7.2: Reviewing your consent process. Describe how people end up on your list (form, checkout, event sign-up) and answer the checklist: is the box empty until someone ticks it themselves, does the person confirm their address, do you keep the date and time of consent, does every email include an unsubscribe link and your company name with address, and how often do you clear out inactive addresses? You'll then get the model answer with the points to watch out for.

Exercise O7.2: Reviewing your consent process

You do this exercise yourself; no one checks it. Tick off what you've done and mark the exercise as done.

The newsletter checkbox is empty until someone ticks it themselves (or I use the exception for existing customers, with an opt-out at the point of collection).
A new subscriber confirms their address via a link (confirmed opt-in).
For each address, I store the date, time and source of the consent.
Every email includes a working unsubscribe link, my company name and an address.
My system automatically removes hard bounces and complaints from the list.
I clean up inactive addresses at least once a year (after a re-confirmation email).

How do people end up on your list?

Your ticks and notes only stay in this browser; we don't send them anywhere. If you're signed in, we only save in My courses that you've done the exercise.

Cookies at WebOké

Cookie settings

Necessary

Marketing