Email compliance audit: how to check your campaigns against the law and mailbox provider standards

A compliance audit is not a box-ticking exercise. It is how you find weak spots in your email program before a regulator, a mailbox provider, or an angry subscriber finds them for you. This article covers a concrete audit sequence, the problems that show up most often, and the tools that speed the process along.

What an email compliance audit actually covers

A compliance audit is a structured review of your email program against applicable laws (CAN-SPAM, GDPR, CCPA, local regulations) and industry standards set by mailbox providers. The goal is to identify violations before they turn into fines, blacklisting, or reputation damage.

Most teams treat compliance as a one-time setup task. Configure SPF, add an unsubscribe link, move on. The problem is that compliance drifts. New team members import contacts without checking consent records. A developer changes the unsubscribe flow and breaks one-click processing. The ESP migrates infrastructure and DKIM alignment stops passing. Without periodic audits, these small gaps compound until something breaks publicly.

An audit covers five areas: consent and list acquisition, message content and headers, technical authentication, unsubscribe handling, and data management. Each has specific pass/fail criteria. The rest of this article walks through each one.

Consent and list acquisition

Every compliance framework starts here. CAN-SPAM allows implied consent for existing business relationships but requires explicit opt-out in every message. GDPR demands explicit, documented opt-in before the first email. Russian FZ-38 and FZ-152 require prior consent with proof.

During an audit, pull a random sample of 200–500 addresses. For each one, answer three questions: where did this address come from? Is there a consent record (timestamp, IP, form URL, text of consent)? Does the consent scope match what you are sending? If you cannot answer all three for most of the sample, you have a consent gap.

Common findings: addresses from trade shows with no digital consent trail, contacts from a merged business unit, subscribers who opted in for one content type and receive another. Each is a GDPR violation and a deliverability risk everywhere else.

List age matters too. An address collected four years ago with no interaction is not a subscriber; it is a liability. Validate before each send to remove dead addresses, role-based contacts, and disposable domains.

Message content and headers

CAN-SPAM requires a valid physical postal address, accurate “From” and “Subject” lines, and clear identification as an advertisement where applicable. GDPR adds the requirement to identify the data controller. Russian law mandates that the sender be identifiable and the advertising nature of the message be disclosed.

Open the last ten campaigns. Check: is the physical address present and current? Is the sender name consistent? Are subject lines accurate? Is there anything deceptive: fake “RE:” prefixes, urgency claims that do not reflect reality?

Header inspection goes deeper. Look at the raw message source. Verify the “From” domain matches your authenticated sending domain. Check that “Reply-To” is monitored. Confirm “List-Unsubscribe” includes both a mailto and an HTTPS URL. Since June 2024, Gmail and Yahoo require a one-click unsubscribe header for bulk senders; missing it sends your mail to spam.

Technical authentication: SPF, DKIM, DMARC

Authentication is not a legal requirement in the strict sense, but mailbox providers treat it as one. Without passing SPF and DKIM, messages are far more likely to be filtered. Without DMARC at p=quarantine or p=reject, Gmail deprioritizes your mail.

An audit should verify: SPF exists, is syntactically correct, and includes all IPs and third-party services that send on your behalf. DKIM keys are published, aligned with the “From” domain (not just the envelope sender), and use at least 1024-bit keys (2048-bit preferred). DMARC has at least p=none and an rua address for aggregate reports. If reports show failures, investigate before tightening the policy.

A frequent audit finding: the company uses three ESPs and a transactional email service, but the SPF record only covers two. The third sends unauthenticated mail that fails DMARC alignment. This is invisible until someone checks, which is the whole point of an audit.

Unsubscribe mechanics

CAN-SPAM gives senders ten business days to process an unsubscribe. GDPR and Russian law require it to be immediate. Anything slower than real-time is a deliverability problem: if someone clicks unsubscribe and gets another email the next day, they report it as spam.

Test the flow end to end. Subscribe a test address. Send a campaign. Click unsubscribe. Verify the address is suppressed within minutes. The unsubscribe page must not require a login, must not make stating a reason mandatory (asking is fine; requiring is not), and must not send a farewell email that lacks its own unsubscribe link.

Also verify the one-click List-Unsubscribe-Post header. POST to the unsubscribe URL with body “List-Unsubscribe=One-Click-Unsubscribe”. Anything other than a 200 means it is broken and Gmail will penalize you.

Data management and retention

GDPR requires a documented retention period for personal data. Russian FZ-152 requires deletion once the stated processing purpose is fulfilled. Even CAN-SPAM assumes you are not holding suppressed addresses indefinitely without reason.

An audit should answer: is there a written retention policy for subscriber data? Is it enforced automatically via sunset automation, or does it depend on someone remembering a manual cleanup? Are suppression lists kept separate from marketing lists? Can you fulfill a deletion request within 30 days?

Practical benchmark: no opens or clicks in 12 months means a re-engagement sequence, then removal if still inactive. One action that covers both compliance and deliverability.

How to run an audit: step by step

An audit is not a one-time event. Run it quarterly, or at minimum after every change to sending infrastructure, ESP migration, or list import.

Violations that audits find most often

Across email programs of all sizes, the same ten issues keep appearing:

• No proof of consent for 10–30% of the list. Addresses were imported from memory, with no record.
• SPF record does not include one of the active ESPs. Mail from that ESP fails DMARC.
• Physical address in the template is outdated after an office move.
• The unsubscribe page requires a login. A large share of people cannot complete the process.
• No List-Unsubscribe-Post header. Gmail shows a warning or filters to spam.
• Retention policy is not written down. Addresses are kept indefinitely.
• Suppression list is not synced across ESPs. Someone unsubscribed in one system and keeps receiving mail from another.
• DKIM keys are 512 bits. Receiving servers reject the signature.
• Transactional emails contain promotional blocks, turning them into marketing messages without corresponding permissions.
• No process for handling right-to-erasure requests. When a request arrives, nobody knows what to do.

Every one of these is a violation that can result in a fine. Most take one or two days to fix once you know they exist. That is the case for running the audit.

How often to audit

Quarterly is the minimum. Outside that schedule, run an unplanned audit after: switching ESPs, adding a sending domain, importing a large list, changing templates, or a regulatory update like the Gmail/Yahoo bulk sender requirements that took effect in 2024. A full audit takes a few hours to two days. Fixing the findings adds another week or two. That is a small investment compared to a fine in the tens of thousands of euros or a full domain block.

List validation as part of the audit

Invalid addresses generate bounces, bounces damage domain reputation, and poor reputation leads to spam placement. There is also a compliance angle: storing addresses you know to be invalid violates the data accuracy principle under GDPR Article 5(1)(d) and the data minimization principle.

Checking through uChecker takes minutes and surfaces invalid addresses, spam traps, disposable domains, and role-based contacts. Make it a standard step: before every bulk send and at least once a quarter for the full list. It closes the technical side and reduces legal exposure without replacing the consent work.