Validity's 2026 benchmark describes the mechanism: subscribers often use the "this is spam" button interchangeably with unsubscribing, but high complaint rates hurt a sender's reputation and deliverability, and unsubscribes don't (Validity 2026 Benchmark Report). Every opt-out you fail to honor, or hide, is a person who will reach for the other button. As the last post covered, Google wants complaints under 0.1% and never at 0.3%, and the average sender in Validity's data sits at 0.06%.

The header ritual

RFC 8058 defines one-click unsubscribe. You add a List-Unsubscribe-Post header containing List-Unsubscribe=One-Click next to a List-Unsubscribe header with an HTTPS URL, and you sign at least one valid DKIM signature that covers both headers. A mailbox provider can then unsubscribe someone by sending an HTTPS POST to that URL (RFC 8058). The standard exists because anti-spam software that fetches header URLs would otherwise unsubscribe people by accident.

Google requires this from senders of 5,000 or more messages a day: marketing and subscribed messages must support one-click unsubscribe and carry a clearly visible unsubscribe link in the body (Google sender guidelines). Its FAQ adds that one-click is required only for marketing and promotional messages, that transactional messages are excluded, and that mailto and plain URL links don't meet the requirement (Google FAQ). The same page says message recipients, not Google, determine the nature of the messages they receive, which makes "we're a campaign, not a marketer" a risky bet. Yahoo asks bulk senders for one-click and calls the RFC 8058 method highly recommended (Yahoo). Gmail's verified sender program for political committees recommends it too (Gmail Verified Sender Program policies).

The clocks

CAN-SPAM gives a sender up to 10 business days to honor an opt-out, and the opt-out mechanism has to keep working for at least 30 days after the message goes out (15 U.S.C. 7704; FTC compliance guide). Yahoo says to honor unsubscribes within 2 days (Yahoo). Google recommends 48 hours, and its sender-requirements table lists unsubscribe requests not honored within 48 hours as an issue that makes delivery support and mitigations unavailable (Google FAQ). The page doesn't reconcile the two statements, so treat 48 hours as the real deadline.

The legal clock runs about two weeks and the provider clock runs two days, so a weekly batch job that passes the first one fails the second.

Is your fundraising email even covered?

CAN-SPAM covers a "commercial electronic mail message," meaning one whose primary purpose is the commercial advertisement or promotion of a commercial product or service (15 U.S.C. 7702). That definitions section doesn't mention political, nonprofit or charitable messages at all.

The FTC's guidance is thin. Its compliance guide doesn't address political or nonprofit email. A 2015 FTC business blog post says CAN-SPAM applies only to commercial email and not to non-commercial bulk email, and that political messages are protected by the First Amendment, but it doesn't say whether a nonprofit's fundraising appeal counts (FTC blog). The FTC's 2008 rulemaking adds that CAN-SPAM does not set up a dichotomy between commercial and nonprofit messages, so a nonprofit whose email primarily promotes a commercial product or service gets treated like anyone else (FTC 2008 rule). A 2024 North Carolina Law Review article says political organizations aren't legally required to include unsubscribe links, though most do anyway (N.C. L. Rev. 102).

Put together, a plain donation or volunteer appeal probably sits outside the statute's definition. A merchandise email probably doesn't, since a hat or a T-shirt is a commercial product. That second half is my reading of the definition, not an FTC ruling I can point to, and mixed emails are where it gets hard. Confirm with counsel before treating any stream as exempt.

Exempt or not, the providers don't care about your tax status. Their rules look at the message and at what recipients make of it.

What it costs

The FTC's penalty ceiling is up to $53,088 per violating email (FTC compliance guide). In a September 2026 notice, the FTC said its civil penalty amounts stay unchanged for 2026 and that it will keep applying the 2025 levels (Federal Register notice). The FTC, state attorneys general and internet access providers can enforce CAN-SPAM, and the statute doesn't give consumers a private right to sue (15 U.S.C. 7706).

For scale, the FTC's August 2024 settlement with Verkada was $2.95 million, which the agency called the largest penalty it has obtained for a CAN-SPAM violation. It alleged more than 30 million commercial emails over three years, including failures to honor unsubscribe requests (FTC press release).

State law

CAN-SPAM supersedes state laws that expressly regulate commercial email, except to the extent they prohibit falsity or deception, and it leaves general laws such as fraud and computer crime alone (15 U.S.C. 7707). That is why the state statutes people mention mostly target misleading email, not unsubscribe timing.

Washington's CEMA defines a commercial electronic mail message as one sent to promote real property, goods or services for sale or lease (RCW 19.190.010). A 2026 amendment, HB 2274, took effect on 11 June 2026 and sets recipient damages at $100 or actual damages, down from $500 (RCW 19.190.040; DLA Piper summary). California's Business and Professions Code 17529.5 similarly targets deceptive commercial email advertisements and allows private suits (Cal. BPC 17529.5). Whether a campaign appeal counts as commercial under either state's definition is unsettled in anything I could find. Confirm with counsel.

Composite scenario: the weekly batch

Composite scenario. No real organization or person is depicted. A national advocacy nonprofit runs a donor list and an online merch store. A vendor processes unsubscribes in a weekly batch, and the email header carries only a mailto unsubscribe.

What went wrong:

• Monday: a supporter clicks unsubscribe.
• Wednesday: the merch sale email goes out. The supporter is still on the list.
• Wednesday: they hit "Report spam."
• Over the next two weeks: Gmail complaints climb past 0.3%.
• After that: the domain is ineligible for mitigation support and the fundraising sends start landing in spam.

How it should have gone: suppress on click, not weekly. Add RFC 8058 headers signed under DKIM. Share one suppression list across every vendor. Ask counsel which streams count as commercial, and hold all of them to the stricter provider rules anyway.

Don't be this sender

1. Your unsubscribe is a batch job.
2. Your header lacks List-Unsubscribe-Post.
3. Your vendors keep separate suppression lists.
4. You've never asked counsel which messages are "commercial."
5. Your unsubscribe link is hard to find, so people hit "spam" instead.

That wraps the series.

Google's sender guidelines already say what they expect from a new sender: start with a low sending volume to engaged users, increase it slowly, and avoid sudden volume spikes (Google email sender guidelines). They don't say how slowly, or for how long. No schedule appears on that page, so "slowly" is whatever the filter decides it means.

Validity reports that providers act on this directly. Its 2026 report says mailbox providers reject senders who suddenly increase volume, partly because their systems can't absorb the surge, and that rejections spiked over the holiday season as senders pushed volume to hit revenue goals (Validity 2026 Benchmark Report). The report's example is holiday retail. Political fundraising has the same problem on a tighter calendar.

The numbers that bite

Google asks bulk senders (more than 5,000 messages a day to Gmail accounts) to keep user-reported spam rates below 0.1% and to avoid ever reaching 0.3% (Google email sender guidelines). The rate is calculated daily. Cross 0.3% and you lose eligibility for mitigation support until the rate stays below 0.3% for seven consecutive days (Google FAQ).

Yahoo's line is 0.3% (Yahoo sender best practices). Validity puts the average complaint rate at 0.06% and says under 0.1% is now the expectation (Validity). That makes 0.3% the cliff edge, and healthy senders sit nowhere near it. If you're testing it, you're the outlier.

Programs built for campaigns use the same number. Gmail's verified sender program measures a 14-day average spam rate against 0.3%, and a violation costs you a seven-day suspension or permanent removal (Gmail Verified Sender Program policies). Verified or not, the line doesn't move.

Three mailbox providers, three moods

Gmail first. Google says it has been ramping up enforcement since November 2025, and that non-compliant messages face disruptions including temporary and permanent rejections (Google FAQ). Depending on the violation, you may get spam foldering instead.

Yahoo uses the same 0.3% ceiling, and bulk senders also need one-click unsubscribe and two-day unsubscribe handling (Yahoo). Its page says nothing about volume spikes, so that gap is yours to manage.

Microsoft wants SPF, DKIM and DMARC (at least p=none) from anyone sending 5,000 or more messages a day to Outlook.com consumer addresses. It began routing non-compliant mail to Junk on 5 May 2025 and said rejections would follow on a date to be announced (Microsoft Tech Community). The reject code is 550 5.7.515.

You can fail without ever seeing a block. Junk and spam foldering look like low engagement on a dashboard, and a team already behind on a deadline will read them that way.

The deferral zone

Gmail's 421 4.7.28 means it has detected an unusual rate of email from your IP address, netblock or domain and has temporarily rate limited it. Google's error page points you to its bulk sender guidelines and little else (Gmail SMTP errors and codes). It says nothing about ramping volume, which is a bit like a hospital sign that says "do not be sick."

Treat a 421 as a verdict. Before the next big send, check how your sending platform handles deferrals, so you know what it does with the queue when Gmail starts pushing back.

Deadline-night possession

Political and nonprofit programs spike on purpose. An end-of-quarter push, an election-eve appeal and a breaking-news ask all land on the same infrastructure that sent a few thousand messages last Tuesday. The senders most likely to be cold are often the ones told to send to everyone tonight.

The thresholds don't care why. A new domain with no history and a sudden jump looks the same whether it belongs to a PAC or a pill spammer. What you can control is who you send to first and how many complaints you collect. Keep complaints well under 0.1%, which is much easier before the spike than during it.

Composite scenario: the deadline night

Composite scenario. No real organization or person is depicted. A new 501(c)(4) registers a fresh sending domain in August. An end-of-quarter deadline is coming, and leadership wants "the whole file, tonight."

What went wrong:

• Early in the week: the domain sends about 4,000 messages a day.
• Deadline night: 700,000 messages go out in two hours.
• Hour one: Gmail returns 421 4.7.28 deferrals.
• Hour two: retries stack up and complaints on the Gmail slice reach 0.4%.
• Next morning: the team learns it is ineligible for mitigation support.

How it should have gone: decide the volume and segment plan weeks ahead, not on deadline night. Send engaged segments first. Watch Postmaster Tools while the send is running, and agree a stop rule at 0.1% complaints before anyone is tired. Have a plan for the rest of the file that does not require it all to go out at once.

Don't be this sender

1. Your biggest send of the quarter is also your first big send.
2. You don't know your Postmaster Tools spam rate today.
3. Your sending platform retries deferrals as fast as it can.
4. Leadership sets the volume the night before.
5. You have no stop rule for complaints.

Plan the spike while it's still a calendar entry.

Next week: night of the living unsubscribes.

Start with what a healthy program looks like. In its 2026 benchmark, covering 2025 sending, Validity put the average unknown-user rate (what the rest of us call hard bounces) at 1.46% and the average complaint rate at 0.06% (Validity 2026 Email Deliverability Benchmark Report). If your file bounces at 7%, you are not slightly off average. You are mailing people who aren't there.

Dead addresses cost you in two ways. The obvious one is the bounce itself, which mailbox providers read as a sign you don't know who you're mailing. The less obvious one is that old addresses don't always bounce. Some of them get repurposed to catch senders who aren't paying attention.

There is also a clock you don't control. Validity notes that Yahoo closes inactive accounts after 12 months and Gmail after 24, so the longer a segment sits, the more of it turns into hard bounces (same report).

Three kinds of ghosts

According to Spamhaus, most spamtraps fall into three groups: typos, recycled and pristine (Spamhaus on spamtraps).

• Typo traps are misspelled versions of real provider domains, think yaaho.com. Spamhaus ties them to addresses scraped from the web or bought from someone who scraped them.
• Recycled traps are real addresses that were abandoned and later turned into traps. Spamhaus says they make up most traps, and they mostly signal that you stopped cleaning your list.
• Pristine traps were never anyone's inbox. Spamhaus says mail landing in one points to scraped or improperly sourced data, which says something worse about where the list came from.

The distinction matters because the fix differs. Recycled traps are a hygiene problem. Pristine traps are a sourcing problem.

Haunted by a stranger's list

Rented and bought lists are where the pristine traps live. You can't see how the addresses were collected, you can't see how old they are, and you inherit all of it the moment you hit send.

Spamhaus takes a blunt position on this: it urges people to treat spamtraps as proof of a data collection or hygiene issue and not to go hunting for the offending address (Spamhaus). That is hard advice to take at 4 p.m. the week before an election, but it is the right advice. If a vendor can't tell you how a list was built, the list is the risk.

The blocklist tribunal

Blocklists don't care about your intentions. They care about what your mail looks like from the outside: the IP it came from and the domains it links to.

Two habits make this worse. The first is judging a listing by the IP alone. URL blocklists such as SURBL list the domains that appear inside message bodies (SURBL overview), so your link and tracking domains can put you on trial even when your sending IP is spotless. Check them before launch, not after the first deferral. The second is treating a listing as a mailbox-provider problem. Read your bounce logs first. The provider is usually telling you exactly what it saw.

Exorcism by sunsetting

A sunset policy retires addresses that have stopped engaging. Spamhaus says M3AAWG suggests waiting at least 12 months before dormant addresses can age into traps, and that mailbox providers may start investigating unengaged addresses somewhere between 3 and 12 months (Spamhaus on sunset policies, November 2023, so treat the numbers as guidance, not a rule).

Put plainly: if you mailed someone a year ago and they never opened, clicked or gave, they are not a subscriber. They are a liability with a name attached.

In practice, sunsetting is three moves. Segment by last engagement. Send the re-engagement ask to the middle of the pile, once, with a clear way to say yes. Suppress everyone who doesn't answer. Hard bounces get suppressed the first time, every time.

Political and nonprofit programs resist this because list size feels like strength. I'd take a 150,000-address file that people read over a 600,000-address file that bounces at 7%.

Composite scenario: the 2019 petition list

Composite scenario. No real organization or person is depicted. A statewide PAC inherits 600,000 addresses: a 2019 petition drive plus a rented "likely donors" list. Most of them haven't been mailed in years. A pre-election push is two weeks out, and the finance director wants the whole file.

What went wrong:

• Monday: the full file goes out. Hard bounces hit 7%.
• Tuesday: Gmail starts deferring mail.
• Wednesday: a recycled trap gets hit and the sending IP lands on a blocklist.
• Thursday: fundraising links land in spam, even for donors who gave last month.
• Friday: the consultant blames Gmail.

How it should have gone: verify the file at import and drop the rented segment. Send first to people who engaged in the last 12 months, then re-permission the rest or let them go. Check bounce and complaint rates after every send. Before launch, check the link domain against URL blocklists.

Don't be this sender

1. You email addresses you can't date.
2. You rent lists without asking where the consent came from.
3. You never suppress hard bounces or long-dormant addresses.
4. You've never checked your link and tracking domains against URL blocklists.
5. You blame the mailbox provider before reading your bounce logs.

If two or more of those sound familiar, your list is already haunted. The good news is that exorcisms are cheap compared to a blocklisting the week before Election Day.

Next week: what happens when a cold sender suddenly sends big.