Record
Corrections
Corrections are published, dated and kept visible. A reference that hides being wrong cannot be checked.
Send corrections to the address on the methodology page.
Fix the cause before requesting blocklist removal
What changed: Correction: this page cited a publisher's front door rather than the document it relies on. Repointed to the primary source itself. Four pages on this shelf had the same fault; a test now rejects any citation that is a bare origin.
Why it matters: Teams burn budget on delist services while the signup form still feeds traps every night.
Do next: Run sending IPs, From/DKIM domains and tracking domains through check.spamhaus.org.Full rule →
Signup forms need anti-automation controls
What changed: Correction: both sources on this page were dead links, and one of them named a document that does not exist. The M3AAWG sender guidance had moved, and there is no M3AAWG "Spamtrap Best Common Practices" — the spam-trap document is titled "Help! I Hit a Spam Trap!". Repointed both, corrected the title, and added M3AAWG's dated position paper on cold email. This page carried a verification date against URLs that returned 404, which is the failure this site exists to refuse; a test now checks every cited link on the shelf.
Why it matters: Deliverability crises often start on the form, not in the campaign builder.
Do next: List every form, quiz, popup and API that can create an email profile.Full rule →
Yahoo requires authentication and a spam rate below 0.3 percent
What changed: Correction: this page cited a publisher's front door rather than the document it relies on. Repointed to the primary source itself. Four pages on this shelf had the same fault; a test now rejects any citation that is a bare origin.
Why it matters: Brands that only watch Gmail get surprised when Yahoo and AOL placement falls.
Do next: If you have Yahoo volume, open Sender Hub (or ask your ESP for the shared-IP complaint view) and write down the 30-day spam rate next to Gm…Full rule →
California GPC opts out of sale and sharing, not marketing email
What changed: Correction: this page cited a publisher's front door rather than the document it relies on. Repointed to the primary source itself. Four pages on this shelf had the same fault; a test now rejects any citation that is a bare origin.
Why it matters: Teams waste sprints wiring GPC into Klaviyo suppressions that the law may not require — or they ignore GPC on the ad side where it does matter.
Do next: Ask privacy eng one question: when GPC fires, what fields change in the ESP within 24 hours?Full rule →
Maryland restricts default profiling of under-18 users
What changed: Correction: this page cited the Attorney General's homepage under a name that described "materials as published" rather than naming a document. Replaced with the statute itself, Md. Code Com. Law § 14-4601 et seq., and the enacted chapter text of HB 603, both dated. A citation has to land on the thing it cites.
Why it matters: Kids-and-ads rules are political and litigious.
Do next: Find every field that could mark a profile under 18.Full rule →
In Germany, marketing email needs express consent or the four-part customer exception
What changed: Correction: this page cited a publisher's front door rather than the document it relies on. Repointed to the primary source itself. Four pages on this shelf had the same fault; a test now rejects any citation that is a bare origin.
Why it matters: German addresses on a US Klaviyo account are a common compliance blind spot for global brands.
Do next: If you cold email German business addresses, stop and get counsel or switch to the four-part customer exception you can actually prove.Full rule →
EU B2B email has no blanket legitimate-interest permission
What changed: Correction: this page cited a publisher's front door rather than the document it relies on. Repointed to the primary source itself. Four pages on this shelf had the same fault; a test now rejects any citation that is a bare origin.
Why it matters: One Klaviyo segment labelled “EU B2B” without country logic is how legal risk hides in a filter name.
Do next: Split your EU B2B cold list by country.Full rule →
BIMI shows a logo after DMARC — it is not a bulk-sender mandate
What changed: Correction: this page cited a publisher's front door rather than the document it relies on. Repointed to the primary source itself. Four pages on this shelf had the same fault; a test now rejects any citation that is a bare origin.
Why it matters: Teams burn budget on certificates while spam rate and alignment are on fire.
Do next: If someone sold you “BIMI or no inbox,” open Gmail’s bulk sender requirements and BIMI Group docs side by side.Full rule →
Complaint feedback loops are provider-specific — Gmail is not Yahoo CFL
What changed: Correction: this page cited a publisher's front door rather than the document it relies on. Repointed to the primary source itself. Four pages on this shelf had the same fault; a test now rejects any citation that is a bare origin.
Why it matters: You cannot fix what you cannot see.
Do next: Write a three-row table: Gmail | Yahoo | Microsoft — for each, name the tool (Postmaster, CFL, JMRP/SNDS, ESP dashboard) and who owns enrol…Full rule →
Italy requires consent for individual open tracking from 29 October 2026
What changed: Correction: this page said the per-recipient pixel switch does not exist in the tools most people are on. Klaviyo shipped one in July 2026 and cites this deadline itself. Corrected, and kept the part that still lands on you: the pixel is still requested by the device, which is what Article 122 regulates.
Why it matters: If you sell into Italy and your ESP only has all-or-nothing open tracking, that is a product gap — not a footnote.
Do next: Put 29 October 2026 in the calendar with a two-month run-up.Full rule →
In France, tracking email opens needs its own consent
What changed: Correction: this page said no mainstream ESP ships a per-recipient pixel-free send path. Klaviyo shipped per-recipient open-tracking control in July 2026 — you can mark named recipients as unsubscribed from open tracking. Read the help page and corrected the claim, but kept the distinction it turns on: Klaviyo discards the open server-side, the pixel is still requested by the device, and there is still no recipient-facing way to object.
Why it matters: EU brands (and anyone mailing France) risk non-compliance and ugly vendor surprises.
Do next: If you are on Klaviyo, open the open-tracking settings and check whether anyone has ever used the per-recipient control.Full rule →
Gmail enforces authentication, PTR, TLS and a 0.30 percent spam rate
What changed: Correction: this page said Gmail enforces silently and that Google scopes ARC to indirect mail. Both were wrong. Google's guidelines name the failures they return (4.7.0, 4.7.28, 5.7.1, 5.7.26), and the word ARC does not appear on the page at all. Re-read both help paths and counted; the ARC claim was traced to a citation that does not exist.
Why it matters: If this is wrong, Gmail can reject mail with a clear bounce code or quietly file you in spam.
Do next: Open Google Postmaster Tools and look at user-reported spam over 30 days.Full rule →
Klaviyo counts Apple machine opens toward revenue by default
What changed: Correction: all three Klaviyo sources carried placeholder dates and two had the wrong article titles. Re-checked against Klaviyo's help centre and corrected.
Why it matters: This is how email teams lose credibility in board decks.
Do next: Open Klaviyo's account-level attribution settings, not the campaign ones, and look at the conversion window and whether opens count toward…Full rule →
Klaviyo holdout groups need 400,000 profiles
What changed: Correction: the source was cited with the wrong title and a placeholder date. Klaviyo's page is 'Getting started with global holdout groups', last updated 23 Sep 2025. The effective date was corrected to match.
Why it matters: Without holdouts, “email revenue” is often correlation.
Do next: Check your profile count.Full rule →
Tell us
Found something wrong?
About /rules/gmail-bulk-sender-requirements — no account, no address required. It goes into the queue this page publishes from.