Click here to go back to www.spam.org

"Best Practices" and Guidelines for Bulk Email Senders

On one end of the spamming spectrum is the rabid anti-spammer who will threaten anyone who CC’s more than one e-mail. On the other end is the sleazy spammer who cares for nothing but his .0001% response from the innocent. In the middle is a vast group of people who just want to communicate in convenient and appropriate ways. This document should not be read or understood to constitute legal advice. It is simply indicating what "Best Practice" might be. If in doubt, you might want to ask yourself "does my email list make the world a better place?", or "are the vast majority of people on this list excited to be receiving it?".

The CAN-SPAM Federal Law, which went into effect on January 1, 2004, created a single national standard to regulate commercial e-mail for bulk e-mail publishers and marketers that must be followed (see spam.org compliance guidelines). In addition to just staying out of trouble, there are some widely accepted practices, which, if put into practice, can greatly improve both the effectiveness of your message, and the reputation of your company. Here's a brief list of activities that are now outlawed and/or regulated under CAN-SPAM:

"You'll notice that none of these practices are ‘accidental.’ They're malicious ways of forcing messages into the inboxes of people who don't want them. This is not only annoying, but also unprofitable and illegal. If you really want to run a successful, long-term e-mail marketing campaign, the only way you'll succeed is to honestly promote a legitimate business with real and valuable products or services." – from: How to Run a Successful, Legal E-Mail Marketing Campaign, February 02, 2004, By Corey Rudl

In addition to the "known" spammers causing the majority of the unsolicited email problem, there are also many companies and individuals who are contributing to the problem because of a lack of understanding of industry best practices and generally accepted guidelines. As an example for those companies, below is EmailLabs recommended list of Dos and Don'ts of permission email marketing:

The Dos:

  • Do seek permission to communicate with customers, prospects and readers.
  • Do use the double opt-in or at least single opt-in subscription approach.
  • Do include a working unsubscribe link or email address on all emails.
  • Do immediately honor unsubscribe requests.
  • Do publish your privacy policy relating to the use of information gathered in your email list members.
  • Do re-optin subscribers/customers that you have not been communicated to via email in more than 6 months.

The Don'ts:

  • Don't pre-check email subscription/sign-up boxes.
  • Don't ever BUY an email list.
  • Don't ever mislead recipients with false from names, misleading subject lines or deceptive offers.
  • Don't email list members more frequently than they would reasonably expect to hear from your organization.

There are some basic principles underlying the proper running of mailing lists (see http://www.linx.net/noncore/bcp/mailinglist-bcp.html ):

Why use "best practices"?

There are three main reasons to use best practices:

  1. Avoiding legal trouble
  2. Not abusing shared internet resources
  3. Maintaining good relationships with the recipients

    These subjects are covered in the 2 chapters below. Also see
    Spamcon.org "Rights, Responsibilities & Definitions

Legal

Marketers do not have a First Amendment right to harass consumers who want to be left alone. That principle was reaffirmed recently when the U.S. 10th Circuit Court of Appeals upheld the legality of the government's do-not-call registry. The case focused on telemarketers, but clearly the ruling would also apply to spammers.

At the very least you need to comply with legal requirements if you are to maintain any long-term relations with recipients of your e-mails. (See CAN-SPAM Compliance) If there is a legal challenge to your list you will want to have been sure in your list building to have confirmation of the status of addresses. Much of this can be handled by choosing good mailing list software, which automates and logs information during the opt-in process. Then you need to be sure to back up the logs files, and save all confirmation e-mails that you receive.

Make sure that your email database includes opt-in evidence. You must be able to prove that every single name on your list really, truly signed up. Critical data is:

It is Best Practice to keep copies of every request to join mailing lists and also of all confirming responses. The sending IP address and exact time of arrival should also be recorded. This information may be needed to investigate forgeries or just to demonstrate the bona fides of the list operator. It is not unknown for people to forget that they have joined a list and then to complain about the incoming email that they have requested. If suitable records have been kept then the list owner will be able to demonstrate that they have acted honourably throughout.

Net Etiquette

Internet Resources

See Netiquette Guidelines at cybernothing.org. Understanding the way the internet works is important in understanding online relationships:

"Each of the interconnected computers that comprise the Net is owned by somebody. The owner of that computer is the only person who can decide how that computer's time and memory are to be used. (Governments dispute this, of course.) A very quick way to prove that you don't know what you're talking about is to argue that you should be allowed to send as many messages as you like, to whomever you please, because "nobody owns the Net." The people who own the machines on which the Net runs will dispute this, and rightly so. To remain in harmony with the Net, you need to use the Net's resources in such a way that you would like your resources used. It's much like the "Golden Rule" of the Christian tradition, in that a society works best when people treat each other with the respect with which they would like themselves treated.

The Internet is a big, confusing place with rules and traditions that often seem silly or counterproductive to the new user. However, if you treat the Internet as a separate society, and learn to respect the Net's etiquette just as you would respect the etiquette of a foreign country in which you were doing business, you and your business will prosper." - from: Marketing on the Internet Without Getting Burned Author: John C. Mozena , 1997
http://www.panix.com/~moz/work/primer.txt

When an unwanted e-mail goes out, it is a waste of internet resources. When it goes to a bad address, and requires a bounce back e-mail, it is a double waste. If it is reported as spam, and administrators time is wasted, it is infinitely more disruptive to the running of networks. Your goal should be to trim your list to the truly interested, or let mechanisms allow people to trim themselves.

Maintaining good relationships

Any long term relationship is a two way street, and this is true for e-mail relationships as well. If someone isn’t interested in you, or what you have to say, leave them alone.

Whether you are sending information, or promoting a product, remember that people buy products and services from companies they trust. Think of your e-mails as part of an ongoing dialog between you and your potential customers.

Building and Maintaining a List

Prior relationship – customer list:

It is accepted practice to use an existing list of past customers who have given you their e-mail address. Email sent by an organization with whom the recipient had previously established a relationship is allowable, provided that the sender provides a mechanism for recipients to easily remove themselves from the mailing list.
In case of dispute, the Bulk Email Sender should have a record of past correspondence.

Privacy Policy:

Before starting to build a list further, you will need to develop a privacy policy for that list. People need to know what you will be doing with the list before they commit to being on it. They should also be aware of the process involved in getting off the list. If email addresses are acquired via a web page subscription form (or indeed through any other data capture mechanism) then it should always be entirely clear what purpose the addresses are to be used for.

You must let people know in advance if you are planning to share the list with others. The email addresses supplied for mailing lists should not be used for purposes that are unconnected with the list.

Many list management setups offer the ability to provide a list of all the people who have joined a mailing list. It is Best Practice to disable such features and to ensure that it is not normally possible to obtain such reports in an automated manner, in other words, keep it secure. There is an obvious danger that such lists will be used by the unscrupulous for the sending of bulk unsolicited email. Allowing list members to see the membership lists but preventing outsiders from doing so is not sufficient to prevent abuse, as spammers can join a list to view and copy it. It is always Best Practice to make the membership list disclosure policy clear.

The Opt-in methods:

Opt out:
All bulk email sent to recipients who have not expressly registered permission for their addresses to be placed on the mailing list, and which requires recipients to opt-out to stop further unsolicited bulk mailings, is by definition Unsolicited Bulk Email.
AboutSpam.com calculates that if all the businesses in the US were to send you an opt-out e-mail, it would take you about 14.3 years to complete the opt-out processes.
The sending of Unsolicited Bulk Email is illegal in most of Europe and is against all ISP Terms of Service worldwide.

Single, or Unconfirmed Opt-in:
The Recipient has, according to the Bulk Email Sender, unverifiably initiated a request for the address to be subscribed to the Bulk Email Sender's mailing list. The Bulk Email Sender has subscribed the address to the mailing list without verifying if the address owner has in fact granted permission or not. That step prevents someone else from signing up my email address to lists, one of the most popular forms of harassment and abuse on the Internet, by the way. No one should be running any unconfirmed signups for email anymore, not if they are a legitimate operation.
Unconfirmed Opt-in means that anyone can subscribe anyone, therefore if the address submitted by an unverified user was "President@Whitehouse.gov", the President has 'opted-in' and will receive bulk mailings whether he likes it or not until he opts-out.
In case of dispute, the Bulk Email Sender has no verifiable proof and is therefore liable for sending Spam, the sending of which is against all ISP contracts, against European laws, and against
Spamhaus SBL policy.

Confirmed Opt-in:
Also known as "Double Opt-in" or "Verified Opt-in". The Recipient has verifiably confirmed permission for the address to be included on the specific mailing list, by confirming (responding to) the list subscription request verification. This is the Best Practice for all Internet mailing lists, it ensures users are properly subscribed from a working address and with the address owner's consent.
In case of dispute the Bulk Email Sender is fully and legally protected because the reply to the Subscription Confirmation The request received back from the recipient proves that the recipient did in fact opt-in and grant verifiable consent for the mailings.

To make it simple to join lists it is common to offer an option to join by means of a checkbox on the same web page that captured an email address for another purpose, such as a purchase. This is perfectly acceptable, but it is Best Practice for this checkbox to be unchecked, and require an explicit action to add the address to the mailing list rather than having joining as the default setting, which might be overlooked.

Unsubscribe:

If a customer doesn’t want to receive e-mail from you any more, you will do more harm than good to your reputation by continuing to send them. Any good e-mail list software will have easy unsubscribe options built right in. This enables the recipient to automatically control what they are subscribed to.

List managers should provide an unsubscribe process which requires the fewest number of "clicks" possible. A "1-click" unsubscribe process is the ideal, as long as it is clearly stated that clicking on that link will immediately unsubscribe. A 2-click process may be necessary in some cases for security reasons, or if you find that many people are accidentally unsubscribing.

Subscribers should not have to go through the process of having to provide a password or to surmount other obstacles to removing themselves from mailings they no longer wish to receive. An unsubscribe request should result in the subscriber being immediately and completely removed from the mailing list. There should be a way for people to contact you if there is an unsubscribe problem (a list administrator contact address), and a way for you to manually unsubscribe addresses.

Bounce Handling:

There should be a policy covering bounced, or undeliverable e-mails. Continually sending to a bad address is an undesirable waste of resources. Some e-mail list software has a mechanism, or the ability to add this in, for handling bounces.

Bounce Handling Policy (from the Institute for Spam and Internet Public Policy) :
Senders should mark an address as "dead", meaning the sender should remove the address from the delivery list and not attempt to deliver to the address until the sender has reason to believe that delivery rejection would not occur, if the following two conditions are both met:

A. Three (3) consecutive delivery rejections have occurred; AND
B. The time between the most recent consecutive delivery rejection and the initial consecutive delivery rejection is greater than fifteen days.

Sending Software

Discuss needed features and make some recommendations:
Essentially the software used should enable you easily to follow legal requirements, as well as best practices, and in fact, should make it hard for you not to.

It is Best Practice to ensure that potential and current subscribers to a mailing list are aware of the list's policies and procedures. This is most usefully provided on a web page, so that a single URL can be provided to those who need to consult the information. This URL may also include an archive of past e-mails if this is useful.

Mailing lists should have a specific person, or persons, who "own" the list and are responsible for its operation. It should be possible to contact the owner by email at an "administrative" address without using the list itself, as a back up method, in case of instances where there is trouble with the unsubscribe process. Therefore, the recipient’s actual e-mail address should be on the "To:" header line, not something like "undisclosed recipient", so as not to create unsubscribe problems.

I have personally sent out bulk e-mail, for non-profit community projects, using 3 different set-ups or methods, all of which I was happy with. These include:

Sending via a hosted online service, such as Vertical Response, Inc. where you pay per e-mail sent.

A free newsletter set-up such as bravenet.com , though this is limited to lists of 500 recipients or less.

Setting up your own E-mail List software, such as Dadamail.org on your own server.

If others reading this have specific recommendations and personal experiences with other set-ups that you would like to share, contact me via www.spam.org and I can add them to this document, or set up a separate list. I am also interested in info about set-ups which didn't work well.

Filter Watch

Ensuring that your email is received by the intended recipients requires some knowledge of the current state of e-mail filters, and what they look for. For example, an e-mail with this on the subject line:
v_i_a_g_r_a c_h_e_a_p_! or, C_H_E_A_P -_D_R_U_G_Z -_C H E_A P 05446

may not reach all of the intended. This may be an extreme example, but the whole subject of filters, and what to avoid sending needs to be studied. There is little information available.

Whitelist:
For maximum delivery you may need to ask people to add you to a whitelist, if they use one. For instance, some people who receive e-mail thru AOL.com have settings where e-mail is only delivered to them if the sender is in their address book.

References and Resources

LINX Best Current Practice Operating Mailing Lists - http://www.linx.net/noncore/bcp/mailinglist-bcp.html

Mainsleazespam.com - http://mainsleazespam.com/./index.html

How to Run a Successful, Legal E-Mail Marketing Campaign, February 02, 2004, By Corey Rudl

America Online E-mail Guidelines - http://postmaster.info.aol.com/guidelines/

AOL Postmaster Best Practice Recommendations for Incoming Mail - http://postmaster.info.aol.com/guidelines/bestprac.html

emaillabs.com - http://www.emaillabs.com/antispam_view.html

Netiquette Guidelines - http://www.cybernothing.org/cno/docs/rfc1855.html

The Spamhaus Project - http://www.spamhaus.org/mailinglists.html

SpamCon Foundation - http://spamcon.org/about/principles.shtml

S. 877 - CAN-SPAM Act of 2003 - http://www.spamhaus.org/legal/CAN-SPAM.html

Some interesting calculations from http://aboutspam.com/thedma.php