Complaints, Unsubscribe and Compliance Incidents

First 15 minutes

1. Validate the report origin and content before any automated action because an ARF is not self-authenticating.
2. Suppress the validated Yahoo complainant for further campaigns and limit the implicated bulk stream when complaint evidence warrants it.
3. Correlate privacy-minimized headers and ARF metadata to the identity, message, campaign, source, and consent record.

Now

• Suppress a validated Yahoo complainant from further campaigns for the enrolled DKIM domain.

Next 24 hours

• Enable Amazon SES account-level COMPLAINT suppression in the relevant Region or configuration set when that is the chosen control.

Next 7 days

• Investigate the source of the complaint spike before restoring the implicated optional bulk stream.

Technical checks

Verification criteria

• A validated complaint can be traced to the correct sending identity, message, campaign, acquisition source, and consent record.
• When Amazon SES COMPLAINT suppression is enabled, a complaint recipient appears on the applicable account-level suppression list.
• The implicated Gmail stream no longer approaches the scoped 0.3 percent user-reported spam boundary before normal volume resumes.

Escalation criteria

• Escalate the implicated bulk stream when validated complaints spike or Gmail's scoped spam rate approaches 0.3 percent.
• Do not escalate missing Gmail ARFs as an Amazon SES malfunction because SES states that Gmail does not provide those complaint reports to it.

Prevention

• Keep Yahoo Complaint Feedback Loop enrollment aligned with the DKIM domains used for campaigns.
• Validate ARFs and preserve privacy-minimized correlation to campaign and consent evidence.
• Use Amazon SES COMPLAINT suppression where its Region-specific behavior fits the sender's controls.

Business impact

• A validated complaint can require recipient suppression and can expose a campaign, acquisition-source, or consent-record problem.

Provider notes

• Yahoo's Complaint Feedback Loop is DKIM-domain based and returns ARFs only for enrolled signing domains.
• Amazon SES does not receive Gmail Spam-button complaint data, so those complaints do not automatically populate SES complaint suppression.

Open questions

• The enrolled feedback loops, DKIM domains, complaint volume, affected campaigns, and internal consent evidence are unknown.
• Complaint feedback coverage differs by mailbox provider and ESP; absence of an ARF is not evidence that no recipient complained.

First 15 minutes

1. Inspect the received message for both List-Unsubscribe with an HTTPS URI and List-Unsubscribe-Post: List-Unsubscribe=One-Click.
2. Confirm that the final valid DKIM signature covers both unsubscribe headers.
3. Separate Gmail interface eligibility from whether the sender's body link and endpoint work.

Now

• Add the missing HTTPS List-Unsubscribe and List-Unsubscribe-Post pair when the received message lacks it.

Next 24 hours

• Correct DKIM coverage so both unsubscribe headers survive ESP transformations under a valid signature.

Next 7 days

• Verify endpoint success, gradual volume, and acceptable spam reports instead of repeatedly changing header syntax alone.

Technical checks

Verification criteria

• The final received message contains the complete RFC 8058 header pair under a valid DKIM signature that covers both headers.
• The endpoint succeeds without redirects and the sender has checked volume and spam-report prerequisites, while recognizing that UI rendering is not guaranteed.

Escalation criteria

• Escalate a persistent Gmail UI-eligibility issue only after the received headers, DKIM coverage, endpoint behavior, volume, and spam-report prerequisites have been verified.

Prevention

• Classify marketing and promotional traffic separately from transactional password-reset mail before applying Gmail's one-click rule.
• Test the visible body link independently because it does not replace the RFC 8058 header POST.
• Monitor the complete received-message prerequisites rather than using Gmail interface appearance as the only test.

Business impact

• Recipients do not see Gmail's sender-adjacent control, but its absence does not establish that the sender's body link or endpoint failed.

Provider notes

• Gmail may withhold its sender-adjacent unsubscribe control even when the sender added one-click headers because automated eligibility checks also apply.
• For Gmail, a mailto link, body link, or preference page alone is not RFC 8058 one-click.

Open questions

• No raw received headers, DKIM h= value, endpoint trace, message classification, sending volume, or Gmail reputation data was supplied.
• Gmail does not disclose every automated UI-eligibility signal, so correct prerequisites do not guarantee that the control will render.

First 15 minutes

1. Inspect the received message for List-Unsubscribe with an HTTPS URI and List-Unsubscribe-Post: List-Unsubscribe=One-Click.
2. Verify that the final valid DKIM signature covers the header pair and that the endpoint identifies recipient and list without browser session state.
3. Run the production-equivalent seed through the visible link, direct POST, and downstream suppression before release.

Now

• Add the RFC 8058 HTTPS header pair and keep the campaign blocked until the pre-send gate passes.

Next 24 hours

• For in-scope Gmail bulk marketing, provide both RFC 8058 one-click and a clearly visible body link.

Next 7 days

• For Yahoo-hosted consumer domains, keep a visible no-login unsubscribe process and process requests within Yahoo's two-day guidance.

Technical checks

Verification criteria

• A production-equivalent seed proves the visible link, DKIM-signed RFC 8058 headers, direct POST response, and downstream suppression for the campaign list.
• For Yahoo scope, test that the no-login process completes and the request is processed within two days.

Escalation criteria

• Escalate recipient-jurisdiction and message-purpose questions to legal review because the CAN-SPAM rule is scoped and is not individualized legal advice.
• Escalate to the ESP when its transformed message or suppression path cannot meet the applicable Yahoo process.

Prevention

• Keep the Gmail volume and message-class rule explicit in campaign configuration rather than applying it universally.
• Make the production-equivalent unsubscribe seed test a blocking pre-send control for optional marketing campaigns.

Business impact

• A missing working opt-out can create compliance exposure for covered commercial email and provider noncompliance for in-scope Gmail bulk traffic.

Provider notes

• Gmail requires RFC 8058 one-click plus a clearly visible body link for marketing and subscribed mail above 5,000 messages per day to personal Gmail accounts.
• Yahoo advises a visible no-login unsubscribe process and processing requests within two days for its hosted consumer domains.

Open questions

• Recipient jurisdictions, campaign classification, Gmail daily volume, Yahoo scope, and the ESP's header behavior are unknown.
• Provider thresholds and legal duties vary; Gmail, Yahoo, RFC 8058, and U.S. CAN-SPAM cover different scopes and are cumulative where applicable.

First 15 minutes

1. Open the verified primary domain's Compliance status dashboard and record each requirement-level result.
2. Check direct personal-Gmail mail for both SPF and DKIM authentication and organizational From-domain alignment with at least one authenticated domain.
3. Record the daily Postmaster Tools spam rate and compare it with the below-0.1% guidance and the 0.3%-or-higher level Google says to avoid.

Now

• Correct the failed authentication, DMARC, DNS, TLS, spam-rate, or one-click control for the affected personal-Gmail stream.

Next 24 hours

• Recheck SPF, DKIM, From-domain alignment, DMARC, forward and reverse DNS, and TLS after the change.

Next 7 days

• Keep promotional one-click unsubscribe and daily spam-rate monitoring in the release checklist for personal-Gmail traffic.

Technical checks

Verification criteria

• The verified primary-domain Compliance dashboard reports the corrected requirement as compliant, allowing for its usual 24-hour update and possible longer delay.

Escalation criteria

• Escalate through Gmail's bulk-sender mitigation path only after every listed requirement is met and delivery problems continue.

Prevention

• Continuously validate SPF, DKIM, alignment, DMARC, forward and reverse DNS, TLS, daily spam rate, and one-click unsubscribe for the traffic where each requirement applies.

Business impact

• Non-compliant personal-Gmail traffic can be temporarily or permanently rejected or placed in spam.

Provider notes

• Gmail treats a primary domain as a bulk sender after about 5,000 messages to personal Gmail accounts within 24 hours, and that classification does not expire.

Open questions

• The domain's current Compliance status rows and exact Gmail SMTP errors were not supplied, so the failing requirement is not yet identified.
• Whether each affected stream is promotional, subscribed, transactional, forwarded, or mailing-list traffic remains unresolved and changes which requirements apply.

First 15 minutes

1. Confirm which Gmail Postmaster spam-rate population and time period the observed increase represents.
2. Use Gmail Feedback Loop data to isolate a complaint-heavy campaign or traffic stream when Feedback-ID was populated consistently.
3. If attribution is credible and enforcement risk is approaching, pause the affected promotional stream while keeping unrelated critical transactional mail separate.

Now

• Pause the credibly affected promotional stream and preserve unrelated critical transactional traffic.

Next 24 hours

• Limit mail to recipients who want it, verify subscription confirmation and unsubscribe handling, and review inactive-recipient exposure.

Next 7 days

• Keep Feedback-ID coverage consistent and use it to identify message types that continue to generate complaints.

Technical checks

Verification criteria

• Verify that the scoped Gmail Postmaster spam rate falls below the sender's pre-incident baseline without relying on messages already placed in spam.
• Confirm that the formerly complaint-heavy Feedback-ID no longer has an unusual spam rate after the audience and campaign changes.

Escalation criteria

• Treat Gmail Postmaster Tools values as guidance for mail to personal Gmail accounts, not an enforcement range; escalate when persistent Gmail impact breaches a documented local operating threshold, or when a provider takes a documented action such as Amazon SES placing the account under review or pausing sending.

Prevention

• Populate Feedback-ID consistently so complaint-heavy campaigns or streams can be isolated.
• Confirm addresses, reconfirm interest where appropriate, make unsubscribe easy, and consider removing inactive recipients.

Business impact

• Sustained Gmail complaints can worsen spam classification, while excessive Amazon SES complaints can put the sending account under review or pause its ability to send.

Provider notes

• Gmail Postmaster spam rate applies to DKIM-authenticated messages delivered to engaged personal-Gmail recipients' inboxes; it is not a universal cross-provider complaint rate.

Open questions

• The incident's affected campaigns, acquisition sources, consent state, frequency change, recipient mix, and exact complaint onset are not provided.
• Complaint metrics, feedback-loop coverage, thresholds, and enforcement differ by mailbox provider and ESP; Gmail and SES claims must stay within their stated scopes.

First 15 minutes

1. Inspect application, queue, CDN, and WAF logs to confirm whether one-click POSTs reach the unsubscribe handler.
2. Identify whether each affected address needs a global or message-group suppression, then contain the corresponding bulk stream.

Now

• Suppress the affected bulk stream when request processing cannot stay inside the Gmail window.

Next 24 hours

• Restore end-to-end POST receipt through intermediaries and confirm processing in handler logs.

Next 7 days

• Document how every deployed provider maps global opt-outs and message-group opt-outs into the central suppression model.

Technical checks

Verification criteria

• Handler and intermediary logs show that test one-click POSTs are received and affected Gmail recipients are removed within 48 hours.
• Handler logs show that controlled one-click requests are received and processed inside the Gmail window.

Escalation criteria

• Escalate to the ESP and the accountable compliance owner if the affected bulk stream cannot process one-click requests within the Gmail window.
• Seek legal review before applying bulk-stream containment logic to messages classified as transactionally required.

Prevention

• Maintain an explicit provider mapping between global opt-outs and message-group opt-outs.
• Use and validate an opaque or hard-to-forge recipient-and-list component in each unsubscribe URI.

Business impact

• Recipients can remain on a mailing stream after opting out, creating a direct compliance and trust risk for the affected Gmail-bound bulk mail.

Provider notes

• SendGrid distinguishes a Global Unsubscribe from a Group Unsubscribe, so its suppression scopes must not be treated as universal provider behavior.

Open questions

• The deployed providers, lists, regions, consent scopes, and current synchronization topology are not supplied; list-scoped and global opt-outs must be mapped before remediation.
• Whether unsubscribe POSTs are lost at the edge, accepted but delayed, or written to only one provider cannot be determined without handler, queue, and suppression logs.
• Provider suppression scopes and propagation semantics vary; SendGrid's global/group model is not universal.

First 15 minutes

1. Classify the affected messages as promotional or transactional before applying the Yahoo one-click requirement.
2. Inspect a received Yahoo message for List-Unsubscribe, List-Unsubscribe-Post, and valid DKIM coverage of both headers.

Now

• Contain an affected promotional stream when unsubscribe requests cannot be honored within two days.

Next 24 hours

• Correct the RFC 8058 header implementation and DKIM coverage rather than relying on a body link.

Next 7 days

• Recheck one-click behavior after RFC 8058 headers, DKIM coverage, and request processing are verified.

Technical checks

Verification criteria

• A newly received Yahoo message has correctly configured one-click headers and valid DKIM coverage of both headers.
• A controlled one-click request is honored within two days for the affected promotional stream.

Escalation criteria

• Escalate to the ESP or Yahoo deliverability channel when compliant headers and request processing are verified but the control remains absent, supplying the received message evidence.

Prevention

• Test RFC 8058 headers, DKIM coverage, and two-day unsubscribe processing on every promotional release path.

Business impact

• Promotional recipients can lose the expected one-click opt-out path, creating a compliance and trust risk when requests are not honored within two days.

Provider notes

• Yahoo also requires sufficient sender reputation and engagement for its blue Unsubscribe control and publishes no numeric display threshold.

Open questions

• Yahoo does not publish the numeric reputation or engagement threshold that controls display of the blue Unsubscribe option.
• No received Yahoo message source is supplied, so header presence, DKIM coverage, redirect behavior, and POST response cannot be verified.
• The absence of mailbox UI alone does not distinguish malformed RFC 8058 headers from insufficient Yahoo reputation or engagement.

First 15 minutes

1. Freeze the affected audience export, message events, configuration state, and trace data with provenance and restricted access.
2. Compare the application audience snapshot with the SMTP envelope recipient and provider message trace.
3. Contain the faulty workflow while determining whether the error is isolated or repeated.

Now

• Limit damage by keeping the affected workflow paused while the complete recipient scope is validated.

Next 24 hours

• Repair the recipient-selection path that produced the unintended delivery and test it against the validated scope.

Next 7 days

• Document the corrected selection path and the evidence required before any future restart of that workflow.

Technical checks

Verification criteria

• A controlled provider trace shows that the SMTP recipient and final state match the intended application audience.
• The repaired workflow completes a scoped test without adding unintended recipients before production restart.

Escalation criteria

• Escalate to security or privacy owners when evidence contains sensitive data or its integrity and provenance cannot be preserved.
• Escalate to privacy or legal review promptly when GDPR may apply or breach risk and notification duties are uncertain.

Prevention

• Preserve auditable recipient-selection evidence, configuration changes, and trace provenance with restricted access.
• Require full recipient-scope validation before restarting a workflow after a wrong-recipient event.

Business impact

• Repeated wrong-recipient sends can expose information, damage trust, and expand the population requiring containment.
• If the event is a GDPR personal-data breach, regulator notification may be required without undue delay and, where feasible, within 72 hours unless risk is unlikely.

Provider notes

• Exchange Online message trace can show delivered, expanded, quarantined, or spam-filtered states; field names and retention differ elsewhere.

Open questions

• The message content, data sensitivity, affected population, jurisdictions, recipient-selection logic, aliases, groups, and forwarding rules were not provided.
• The root cause remains unresolved until the application audience snapshot, SMTP envelope recipient, provider trace, and downstream expansion or forwarding evidence are compared.
• Notification duties and deadlines depend on applicable law, breach definition, risk, contracts, and regulator; privacy or legal review is required.

First 15 minutes

1. Export the recipient-level affirmative event, timestamp, acquisition source, notice and purpose version, method, and current withdrawal or suppression state.
2. Preserve record provenance, log investigative actions, and restrict access to the incident evidence.

Now

• Build the per-recipient evidence bundle and quarantine records whose identity, purpose, or current state cannot be joined reliably.

Next 24 hours

• Reconcile withdrawal events so consent can be withdrawn as easily as it was given wherever GDPR consent applies.

Next 7 days

• Version the notice and purpose fields used in future evidence bundles and retain their link to each affirmative event.

Technical checks

Verification criteria

• Each affected recipient can be joined to the asserted consent event and current withdrawal or suppression state where GDPR consent is the basis.
• The evidence export preserves provenance and investigative actions with access limited under the applicable policy.

Escalation criteria

• Escalate to privacy or legal review when jurisdiction, lawful basis, or the ability to demonstrate consent is uncertain.
• Escalate to security when evidence integrity, provenance, or controlled access cannot be maintained.

Prevention

• When GDPR consent is included in a written declaration that also covers other matters, keep the consent request clearly distinguishable, accessible, and written in clear and plain language.
• Make withdrawal as easy as giving consent and preserve the current withdrawal state per recipient.
• Use confirmed opt-in as a deliverability evidence event without treating it as universal proof of legal validity.

Business impact

• Where GDPR consent is the asserted lawful basis, missing recipient-level proof creates a compliance gap because the controller must be able to demonstrate consent.

Provider notes

• Yahoo recommends confirmed opt-in to reduce accidental, malicious, fake, and automated subscriptions; legal validity still depends on applicable law.

Open questions

• Applicable jurisdictions and the lawful basis asserted for each processing purpose were not provided; GDPR Article 7 applies only when GDPR consent is the basis.
• The current data model, record retention, notice versions, acquisition sources, withdrawal events, and ability to join them per recipient are unknown.
• Exact proof requirements vary by law, purpose, regulator, and counsel; the proposed evidence bundle is an operational pattern, not a universal statutory checklist.

First 15 minutes

1. Determine daily personal-Gmail volume and whether the affected messages are marketing, promotional, subscribed, transactional, or hybrid.
2. Inspect a received message for the HTTPS List-Unsubscribe and exact List-Unsubscribe-Post value required by RFC 8058.
3. Validate that a DKIM signature covers both unsubscribe fields in its h= tag.
4. Compare received samples to confirm the RFC 8058 header pair and valid DKIM coverage are consistently present.

Now

• Implement the RFC 8058 List-Unsubscribe HTTPS URI and List-Unsubscribe-Post value for Gmail traffic subject to one-click.
• Sign both unsubscribe fields with a DKIM signature that validates at the receiver.

Next 24 hours

• Process Gmail one-click requests within 48 hours and Yahoo bulk requests within two days, while checking whether applicable law is stricter.

Next 7 days

• Automate received-message and processing-log tests for each provider and message class.

Technical checks

Verification criteria

• A received message contains the exact RFC 8058 header pair with an HTTPS URI.
• A valid DKIM signature covers List-Unsubscribe and List-Unsubscribe-Post and names both in h=.
• Processing logs show Gmail requests completed within 48 hours and Yahoo bulk requests within two days for the applicable streams.

Escalation criteria

• Escalate to Gmail delivery support only after applicable one-click requests are being honored within 48 hours.
• Escalate to Yahoo or the ESP when a functioning Yahoo bulk control and two-day processing still do not restore expected behavior.

Prevention

• Continuously test that DKIM validates and covers both RFC 8058 unsubscribe fields.
• Alert on Gmail one-click requests approaching 48 hours and Yahoo bulk requests approaching two days, while preserving any stricter legal deadline.

Business impact

• For Gmail, failure to honor one-click requests within 48 hours can make delivery support or mitigation unavailable.
• Yahoo bulk marketing and subscribed mail that lacks functioning controls or two-day processing fails Yahoo's sender requirement.

Provider notes

• Gmail's 5,000-message daily threshold counts messages to personal Gmail accounts and is not a universal bulk definition.
• Gmail excludes transactional messages such as password resets and reservation or form confirmations from this one-click rule, while hybrid classification requires separate assessment.
• Yahoo highly recommends RFC 8058 POST but also accepts mailto for senders it classifies as bulk.

Open questions

• Daily Gmail volume, Yahoo bulk classification, message types, current headers, DKIM h= coverage, endpoint behavior, and unsubscribe-processing logs were not provided.
• Hybrid or ambiguous message classification remains unresolved and can change whether a provider's one-click rule applies.
• Gmail and Yahoo differ in scope wording and accepted methods; applicable law can add separate unsubscribe duties and timelines.