One-page brief

Send this to your team

From your saved setup. Slack paste or print PDF. Optional title for the stand-up — not a multi-client CRM.

Optional title (for PDF / Slack)

emailrules.today · as of 2026-08-05

All marketers (no filter saved yet)

Of 41 rules in this filter, 15 need a person, 20 shared with your email tool, 1 already handled by your tool, 5 nothing to do today, 1 upcoming.

costco.com · checked 2026-08-05

Nothing on this domain’s authentication is yours today

1 shared with the sending platform: DKIM keys published on 4 selectors.

The sender list is held by Proofpoint, so this is what the domain’s own record says rather than the whole picture.

The full check, with the record and the dated rules →

Open these five first

Highest signal — not the full shelf.

01LegalYours
Italy requires consent for individual open tracking from 29 October 2026
Italy follows France: from 29 Oct 2026, tying an open to a named person needs consent — aggregate open counts do not.
Do first: Put 29 October 2026 in the calendar with a two-month run-up. This is a build, not a checkbox, and the deadline will not move.
02LegalYours
EU B2B email has no blanket legitimate-interest permission
There is no EU-wide “B2B legitimate interest” free pass — France may allow careful B2B; Germany still wants consent or the customer exception.
Do first: Split your EU B2B cold list by country. Apply French professional-relevance rules and German consent rules separately. Delete the single "EU B2B" playbook.
03LegalYours
In Germany, marketing email needs express consent or the four-part customer exception
Germany defaults to express consent for marketing email — B2B is not a free pass; the customer exception is four strict conditions.
Do first: If you cold email German business addresses, stop and get counsel or switch to the four-part customer exception you can actually prove. Cold "legit interest" decks will not save UWG §7.
04LegalYours
Maryland restricts default profiling of under-18 users
In Maryland, default ad-style profiling of known under-18s is restricted — fix age capture and suppress abuse, do not panic-wipe every family account.
Do first: Find every field that could mark a profile under 18. Confirm marketing journeys cannot target that segment for behavioural advertising use cases.
05HygieneYours
Signup forms need anti-automation controls
Bots will stuff your form with junk and spam traps — CAPTCHA, rate limits, and double opt-in protect the list.
Do first: List every form, quiz, popup and API that can create an email profile. For each, note CAPTCHA/bot protection, double opt-in, and who owns the spike alert. Empty cells get fixed first.

How to use: Slack, print, or walk the five links. Full rules have plain English, whose job, and sources.

Not legal advice. Independent — no scores, no seed tests for sale.

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.