37 terms · also linked inline across the site · Back to rules

• Alignment

  When the domain that passed SPF or DKIM matches the domain in your From line (what the inbox shows).

  Alignment means the authenticating domain and the From domain are the same organisation’s domain (strict or relaxed rules). Mail can “pass DKIM” while DMARC still fails if the signature is for the ESP’s domain, not yours. That is a common silent spam-folder cause.

• Apple MPP

  Mail Privacy Protection — Apple preloads images so classic open tracking no longer means a human opened the email.

  Apple Mail Privacy Protection (MPP) proxies and prefetches images, which fires open pixels without a real read. Platforms that still count those opens into revenue or engagement can flatter your numbers. Know how your ESP attributes MPP opens.

• BIMI

  Optional branding — shows your logo in some inboxes if DMARC is strong enough.

  BIMI (Brand Indicators for Message Identification) can display a logo next to messages in supporting clients. It generally needs DMARC at quarantine or reject and extra DNS/brand verification. It is not a spam filter fix.

• Bulk sender

  Someone sending large volumes (providers often use ~5,000 messages/day to their users as a threshold).

  Gmail, Yahoo and Microsoft publish extra rules for high-volume senders to their consumer inboxes. Thresholds are about messages per day to their users, not your total list size. Under the threshold you still need basic authentication; above it, rules get stricter.

• CAN-SPAM

  US federal rules for commercial email — honest subject lines, real postal address, working unsubscribe (opt-out model).

  CAN-SPAM does not require prior opt-in at the federal level, but it bans deceptive headers/subjects, requires a physical address, and requires honouring opt-out within 10 business days. State laws (e.g. Washington subject lines) can be tougher.

• CASL

  Canada’s anti-spam law — commercial email needs consent you can prove, plus identification and unsubscribe rules.

  CASL (Canada’s Anti-Spam Legislation) is strict: consent (express or limited implied types), sender identification, and unsubscribe timing. Penalties can be large. “They bought something years ago” is not automatically enough — clocks and proof matter.

• CEMA

  Washington State law used against misleading commercial email subject lines — active lawsuit territory.

  Washington’s Commercial Electronic Mail Act (CEMA), after court rulings, is used against false or misleading subject lines (e.g. fake urgency). Damages rules have changed; the risk is real for US consumer senders who email Washington residents.

• Complaint rate / spam rate

  Share of people who hit “Report spam” — Gmail and Yahoo watch this closely (often stay under 0.3%).

  User-reported spam is a core reputation signal. Gmail’s bulk guidelines treat 0.3% as a line you must not reach and ask you to stay near 0.1%. It moves with list quality and send frequency, not with pretty design alone.

• Consent

  A clear, informed yes to marketing (rules vary by country) — silence or pre-ticked boxes are usually weak.

  Consent is permission. Quality matters: freestanding, informed, and recorded (who, when, what they saw). Bundling marketing into “I agree to terms” is a classic fine pattern in Europe.

• Dedicated IP

  A sending IP address used only by you — you own its reputation; setup is more work.

  On a dedicated IP, your traffic alone shapes reputation. Shared IPs pool many customers (ESP manages neighbour risk). Dedicated needs careful warming and monitoring; shared is default for most mid-market brands.

• DKIM

  A digital signature on each message that proves it was not altered and came from a domain that published a key.

  DKIM (DomainKeys Identified Mail) attaches a cryptographic signature to outgoing mail. Receivers verify it with a public key in DNS. “DKIM passing” means the signature checks out; that is not always the same as “aligned” with your From address.

• DMARC

  A DNS policy that tells receivers what to do when SPF/DKIM checks fail for your domain.

  DMARC ties SPF and DKIM to your visible From domain and can ask receivers to quarantine or reject failing mail. It also can send you reports (rua) about who is sending as you. The policy lives on your domain’s DNS — no ESP can publish it for you.

• DNS

  The internet’s phone book — where you publish SPF, DKIM keys, and DMARC for your domain.

  DNS (Domain Name System) stores public records for your domain. Email authentication records live there. Changes can take time to propagate. Your domain registrar or DNS host (Cloudflare, Route53, etc.) is where you edit them.

• Double opt-in

  The person confirms their email via a link before you add them to marketing — stronger proof they meant to join.

  Double opt-in (DOI) means after someone submits their address, they must click a confirmation email. It is best practice for list quality and strong evidence of consent. In some places it is not literally written into the statute but courts treat it as good proof.

• Email headers

  Hidden technical lines on a received message — authentication results, path, unsubscribe headers live here.

  Headers are metadata at the top of a raw email (Received, Authentication-Results, DKIM-Signature, List-Unsubscribe, etc.). You view them in Gmail “Show original” or similar. Pasting headers lets us see alignment on a real message, which DNS alone cannot prove.

• ePrivacy

  EU rules (as a Directive) on electronic marketing and cookies — member countries implement details in national law.

  The ePrivacy Directive sets EU-wide ideas (consent for marketing email to people, soft opt-in exception) but countries implement differently. Always check the country you send into, not only “the EU” as one blob.

• ESP

  Email service provider — the tool that sends your campaigns (e.g. Klaviyo, Mailchimp, Braze).

  An ESP (email service provider) is the platform you use to store contacts, build emails, and send them. It is not your website host and not Gmail. Examples: Klaviyo, Mailchimp, Braze, HubSpot, Salesforce Marketing Cloud.

• From domain

  The domain after @ in the From address people see in their inbox.

  The From domain is what recipients trust visually (you@yourbrand.com). Authentication should align to that domain. Sending as you@esp-domain.com or misaligned signatures causes trust and DMARC problems.

• GPC

  Global Privacy Control — a browser signal to opt out of sale/sharing of personal data, not automatically “stop all email.”

  GPC is a privacy signal browsers send. In California and Colorado it mainly affects sale/sharing and certain targeting uses. It is not the same as an email unsubscribe unless your own policy maps it that way. Do not invent a legal email ban the statute does not write.

• Hard bounce

  A permanent failure — the address does not exist or will never accept mail. Stop sending.

  A hard bounce means the receiving server rejected the address as permanent (unknown user, invalid domain, etc.). ESPs usually suppress these automatically. Keep mailing them and you look like a spammer.

• Holdout group

  People intentionally excluded from email so you can measure whether email caused the revenue.

  A holdout (control) group does not get the campaign or gets suppressed from a channel so you can compare behaviour. Some ESPs gate large holdouts behind list-size requirements. Without holdouts, “email revenue” is often last-click storytelling.

• One-click unsubscribe

  Inbox apps can unsubscribe someone with one click using special email headers — no landing page required.

  Gmail and Yahoo require bulk senders to support RFC 8058-style one-click unsubscribe: List-Unsubscribe plus List-Unsubscribe-Post headers. The mail app posts once and the person is out. Your ESP usually adds this automatically if you send through them.

• Open rate

  Estimated share of emails “opened” — badly distorted by Apple Mail Privacy Protection and other auto-loads.

  Open rate counted a tracking pixel load as an open. Apple’s Mail Privacy Protection and similar features load images automatically, so opens are inflated or meaningless for large slices of the audience. Use clicks, purchases, and replies for decisions.

• Opt-in

  The person actively agreed to receive your marketing email before you send it.

  Opt-in means permission first. How strict that is depends on country: the EU generally needs a clear yes; the US federal CAN-SPAM is more opt-out oriented but still bans deception and requires working unsubscribes.

• Opt-out

  The person can stop your marketing email easily — and you must honour it.

  Opt-out is the unsubscribe path. Laws and mailbox providers set how fast you must stop (e.g. CAN-SPAM within 10 business days; Yahoo bulk wants List-Unsubscribe handled quickly). Honouring opt-out is separate from whether you needed opt-in to start.

• PECR

  UK rules for electronic marketing — individuals generally need consent or a complete soft opt-in.

  PECR (Privacy and Electronic Communications Regulations) governs marketing calls, texts and emails in the UK. For individual subscribers, consent or soft opt-in conditions apply. Corporate subscribers are treated differently. The ICO enforces.

• PTR / reverse DNS

  A DNS record that maps an IP address back to a hostname — providers expect sending IPs to have valid reverse DNS.

  PTR (pointer) records let receivers check that an IP’s reverse name matches forward DNS. Gmail and others expect this for sending IPs. On shared ESP IPs, the ESP owns PTR; on dedicated IPs, you or your host must set it.

• rua (DMARC reports)

  An email address in your DMARC record where aggregate reports about your domain are sent.

  rua is a DMARC tag pointing to where receivers send aggregate XML reports. Without rua (or a reporting service), you publish policy blind. Reports show who is sending as your domain and whether checks passed.

• Seed test / seed list

  Sending to a panel of test inboxes to guess placement — scores vary wildly between tools.

  Seed tests drop your campaign into many provider inboxes and report where it landed. Two tools often disagree. We do not sell seed scores; use them as one signal, not truth.

• Soft bounce

  A temporary failure — full mailbox, downtime, or greylisting. May succeed later; rules differ by ESP.

  A soft bounce is a temporary problem. Providers retry; after several soft bounces some ESPs convert the address to suppressed. There is no universal “seven soft bounces” law — each ESP documents its own classifier.

• Soft opt-in

  A narrow legal exception: you may email existing customers about similar products if you offered opt-out at signup and in every message.

  Soft opt-in is not “anyone who bought once, forever.” In the EU/UK it is a limited path next to full consent: details collected in a sale (or negotiation), your own similar products/services, and a free opt-out at collection and in every email. Bought lists do not inherit it.

• Spam trap

  An address run by anti-spam operators to catch people who mail bad or stolen lists — hitting one hurts reputation.

  Spam traps are not real customers. Pristine traps were never real users; recycled traps were abandoned addresses turned into traps. Hits usually mean bad collection, purchased lists, or mailing the long-dead. Fix the source of addresses; delisting alone does not fix the cause.

• SPF

  A public DNS list of servers allowed to send mail for your domain.

  SPF (Sender Policy Framework) is a DNS record that says which mail servers may send email claiming to be from your domain. Receivers check it to spot fakes. You publish it once in DNS; your ESP usually tells you what to add.

• Sunset / sunsetting

  Stopping or reconfirming people who have not engaged for a long time — protects reputation.

  Sunsetting means you stop regular marketing (or re-permission) for inactive contacts. Gmail and Yahoo tell bulk senders to focus on willing recipients. There is no single official “180 days” number — you set a policy from your cadence and business.

• TLS

  Encryption in transit — mail is sent over a secure connection between servers.

  TLS (Transport Layer Security) encrypts the hop between mail servers. Gmail’s sender guidelines expect TLS when sending to Gmail. Your ESP almost always handles this; custom MTAs must be configured.

• Tracking pixel / open pixel

  A tiny image in the email that loads when images load — used to guess opens.

  An open-tracking pixel is usually a 1×1 image URL unique to the send or person. When it loads, the ESP records an “open.” Privacy features and image blocking make this unreliable; some countries require separate consent for this kind of tracking.

• Transactional email

  Mail needed to complete a user action or account (receipts, resets) — not the same as a promo newsletter.

  Transactional messages facilitate a transaction or account the user requested. Marketing is promotional. Mislabeling promos as transactional to skip unsubscribe rules is a common enforcement target (e.g. Australia). When in doubt, include unsubscribe and be honest about content.