Safeguard
Developer Tools•

What list and consent habits keep your email out of spam?

Send to people who signed up, skip pre-checked boxes, make leaving easy and ramp volume slowly. A list hygiene checklist grounded in Google guidance.

Safeguard Security Team
3 min read

Send only to people who asked for your mail, avoid pre-checked sign-up boxes, never buy lists, make unsubscribing easy and honor it fast, and increase volume gradually. Google's sender guidance ties these habits to spam complaints, which drive reputation and delivery.

Definition

List hygiene is the set of habits that keep your recipient list made up of people who want your messages. Consent hygiene is the record keeping that shows how and when each person agreed. Together they reduce spam reports, which mailbox providers use to judge you.

What Google's guidance says to avoid

Google's guidance lists these sending practices to avoid: purchasing email addresses from other companies, and sending messages to people who did not sign up, since those recipients may mark your mail as spam and future messages to them will be marked as spam. It also says to avoid opt-in forms that are checked by default and automatically subscribe users, and notes that some countries restrict automatic opt-in, so check the rules in your region.

It adds that if you manage mailing lists, you should send only to people who want the mail, and that frequent spam reports against your domain make future messages more likely to be marked as spam.

A hygiene checklist

HabitWhy
Unchecked opt-in boxesAvoids automatic subscription
Confirmation of new sign-upsReduces typos and fake addresses; some teams use a confirmation email
Unsubscribe link in every marketing messageGives a better exit than the spam button
One-click unsubscribe for bulk marketingRequired by Google for bulk senders
Honor opt-outs quicklyThe FTC guide says within 10 business days for US commercial mail
Remove bounces and long-inactive contactsProtects reputation
Steady, gradual sendingAvoids bursts that trigger limits
Segment by engagementStart campaigns with engaged users

Steps

  1. Audit every sign-up form for pre-checked boxes and change them to unchecked.
  2. Record consent: timestamp, source form, text shown. See consent record fields.
  3. Add one-click unsubscribe headers to marketing mail. See how it works.
  4. Propagate unsubscribes to every system that sends, including partners. See consent withdrawal across systems.
  5. Ramp new lists slowly and watch the spam rate. See spam rate targets.
  6. Review inactive contacts every quarter and remove those who no longer engage.

Where this meets security

Poor list hygiene is also an abuse path. Sign-up forms that email any address typed into them can be used to send unwanted mail to strangers. Confirmation messages should be short, contain no promotion, and be rate limited per address and per IP.

Where Safeguard fits

Safeguard's compliance and evidence automation helps teams keep consent and retention policies documented and checked. This post is general information, not legal advice. The free scan is at https://gold.safeguard.sh/scan.

Quick check

Is double opt-in required?

Not by the sources used here. Confirmation can reduce bad addresses, and some regions have their own rules, so check where your recipients live.

Can I email a purchased list once?

Google's guidance says not to purchase addresses, since recipients who did not sign up may report spam.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.