Separate permission from inbox placement
An address that passes validation is not automatically an address you may market to. Likewise, lawful permission does not guarantee inbox placement. Treat permission management and deliverability as related but distinct systems: one determines whether a message should be sent, while the other concerns how receiving systems handle it.
For a course newsletter, document the recipient category, jurisdiction, channel, purpose, and applicable permission rule before importing contacts. Rules vary by location and context. The UK ICO explains direct-marketing requirements for electronic mail, including responsibilities of senders and instigators. [1](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/guidance-on-direct-marketing-using-electronic-mail/what-are-the-rules-on-direct-marketing-using-electronic-mail) Use appropriate legal advice for your circumstances rather than treating a CRM checkbox as a legal conclusion.
Store evidence that survives an import
Design a consent record with the collection timestamp, source form, wording or notice version, channel, purpose, and evidence reference. Distinguish newsletter permission from an inquiry that only requests a quotation. A generic subscribed field cannot explain what someone agreed to or whether the evidence applies to your planned campaign.
When importing a legacy list, preserve unknown status rather than converting blanks into yes. Quarantine records with missing provenance for review. If an applicable exception is used instead of consent, document its conditions and supporting evidence separately. For example, a soft opt-in has specific legal requirements and should not become a blanket label assigned to every person who has ever contacted the business.
Make suppression a rule, not a segment
Maintain a suppression mechanism that marketing workflows cannot casually bypass. Process unsubscribe requests, complaints, and relevant hard-bounce outcomes across integrations and future imports. A contact removed from one list should not be silently reactivated when a spreadsheet is uploaded next month.
Test this lifecycle with internal addresses: subscribe, send a permitted test message, unsubscribe, re-import the record, and attempt another marketing send. Verify what happens in every connected system. Retain only the information needed for the suppression purpose under your retention policy, rather than assuming deletion of the entire record is always the safest way to prevent future contact. Document who can change status and why.
Authenticate the sending infrastructure
Review SPF, DKIM, and DMARC configuration with the person responsible for DNS and your sending provider. Confirm that the visible sending domain and authentication results align with the provider's guidance. Inspect a received test message's headers rather than relying solely on a green setup screen.
Gmail's sender guidelines distinguish requirements for all senders from additional requirements for higher-volume senders, including authentication and unsubscribe-related provisions. [2](https://support.google.com/mail/answer/81126) Read the current rules for your volume and message type. Authentication helps establish sending legitimacy, but it does not establish consent, erase a poor reputation, or guarantee delivery to the inbox.
Send messages people recognize and can leave
Use a recognizable sender name, accurate subject line, and content consistent with the collection promise. If people signed up for monthly analytics tutorials, an unrelated daily promotion creates a relevance problem even if the technical setup is correct. State why recipients are receiving the message and provide a clear way to opt out.
Monitor delivery failures, complaints, unsubscribe patterns, and meaningful engagement, not just opens. Privacy features and image handling can make open measurements unreliable indicators of individual interest. Investigate sudden changes before expanding volume. Avoid purchased-list shortcuts and services that promise to manufacture reputation; neither addresses the underlying question of whether recipients actually want your messages.
Use a campaign preflight and incident plan
Before launching, record the audience selection rule, exclusion count, permission evidence, sending domain, unsubscribe test, and campaign owner. Review a sample of records from the final audience rather than only the original import. Confirm that scheduled sends recheck suppression when appropriate, especially if someone unsubscribes after the audience was assembled.
Define when to pause: unexpected complaints, broken unsubscribe behavior, wrong audience selection, or authentication failures. Keep an incident checklist for stopping workflows, preserving evidence, notifying responsible staff, and correcting affected records. A trustworthy CRM operation is not one that never encounters mistakes; it is one that prevents foreseeable mistakes and can detect and contain the rest promptly.
Sources & further reading
Last editorial review: 27 October 2026. Examples are educational, not live employer data or guaranteed outcomes.