For years, most businesses treated email compliance and deliverability as something that happened after they pressed Send.
Authenticate the domain. Monitor bounces. Keep complaints low. Watch sender reputation. Include an unsubscribe link.
All of that still matters.
But the standard for responsible email sending is expanding much further upstream.
Businesses increasingly need to answer questions such as:
Where did this email address come from?
When was it collected?
What did the person agree to receive?
Can you prove it?
Was the form used to collect it protected against abuse?
Does this person actually expect to hear from you?
That shift is clearly reflected in newly updated industry guidance.
On August 27, 2026, the Messaging, Malware and Mobile Anti-Abuse Working Group, better known as M3AAWG, published Version 4.0 of its Sender Best Common Practices. M3AAWG calls it a major rewrite of its previous guidance, with a stronger focus on address collection and data transparency.
The important story is not that M3AAWG published a new document.
The important story is what the standards are telling senders:
Email deliverability starts before you ever send an email.
What Is M3AAWG, and Why Does Its Guidance Matter?
M3AAWG stands for the Messaging, Malware and Mobile Anti-Abuse Working Group.
It is an industry organization that brings together companies and professionals working across messaging, security, anti-abuse and internet infrastructure. Its stated mission centers on fighting spam, malware, bots and other forms of online abuse.
M3AAWG is not a government regulator, and its Sender Best Common Practices are not laws. The organization explicitly describes the document as industry Best Common Practices and states that it is not legal advice.
That distinction matters.
But these recommendations still deserve attention because M3AAWG says they represent industry consensus around responsible sending practices. The document is specifically intended for ESP deliverability and compliance professionals, large senders, marketers and management.
So this is less about "new M3AAWG rules" and more about understanding where expectations for legitimate senders are heading.
And the direction is clear.
1. You Need to Know Where Your Email Addresses Came From
This may be the biggest change marketers need to pay attention to.
M3AAWG recommends that senders retain information surrounding the original signup, potentially including:
- date of collection
- signup IP address
- website or event where the address was collected
- how it was collected
- which department collected it, where relevant
- the disclosure and privacy language in place at signup
The purpose is straightforward: there may eventually be a need to demonstrate consent to a recipient, ISP, blocklist operator or regulator. M3AAWG also cautions that the storage of this information must comply with applicable privacy requirements.
For years, list hygiene often centered around one question:
Is this a valid email address?
That question is no longer enough.
The next question should be:
Why do we have this email address?
And after that:
Can we prove it?
That is a meaningful change.
Your CRM should not simply be a bucket containing email addresses. Ideally, it should preserve enough information to understand how and why each person entered your marketing database.
2. Getting an Email Address Does Not Give You Unlimited Permission
M3AAWG says consent should be clear and obvious and that the intended use of an email address should not be hidden inside legal language or obscure disclosures.
It also recommends telling subscribers what type of communication they are signing up for and the expected frequency. If an address was collected for one purpose and the business later wants to use it for a materially different purpose, M3AAWG recommends giving the recipient a separate opportunity to opt in.
This gets to one of the most important concepts in modern deliverability:
Recipient expectation matters.
Someone who requests a webinar expects communication about the webinar.
Someone who joins a weekly newsletter expects a weekly newsletter.
Someone who buys a product expects transactional communication surrounding that purchase.
That does not automatically mean they expect every future promotion your company decides to send.
M3AAWG makes the recipient's perspective especially clear in its conclusion. It says that recipient preferences and expectations should be the highest priority, even where a sender believes another policy or legal basis gives them the right to send.
Legal permission and recipient expectation are not the same thing.
And neither automatically guarantees inbox placement.
3. Confirmed Opt-In Is the Highest Standard
M3AAWG now clearly identifies three levels of subscription:
Single opt-in
The address is submitted and ongoing email begins without confirming ownership.
Single opt-in with notification
The subscriber receives a notification or welcome email. M3AAWG describes this as better.
Confirmed opt-in
The subscriber must take an affirmative action, such as clicking a confirmation link or replying, before ongoing messages begin. M3AAWG describes confirmed opt-in, commonly called double opt-in, as the highest-standard opt-in best practice.
That does not mean double opt-in has suddenly become universally mandatory.
But senders should not ignore the direction.
M3AAWG warns that single opt-in can allow typos and maliciously submitted addresses onto a list, potentially resulting in bounces, complaints and sender-reputation degradation.
Google's current subscription guidance also tells senders to have recipients confirm their email address before receiving subscription messages.
The question should therefore stop being:
Which signup process builds the biggest list?
A better question is:
Which signup process gives us the cleanest evidence that the person actually wants the email?
4. Your Signup Forms Are Part of Your Deliverability Infrastructure
This is a part of deliverability that many marketers completely overlook.
Your website forms can affect your email reputation.
M3AAWG's new standards include specific guidance on list bombing, where automated systems submit one victim's email address to hundreds of signup forms, triggering large numbers of confirmation or transactional emails.
The organization recommends layering protections such as CAPTCHA, rate limiting, monitoring repeated submissions and other bot-detection controls.
Why should a marketer care?
Because a compromised acquisition process can put people into your database who never asked to be there.
You can then end up with:
- invalid addresses
- people receiving email they never requested
- additional bounces
- spam complaints
- polluted CRM data
- damaged sender reputation
You can have perfect SPF, DKIM and DMARC authentication and still create a deliverability problem.
Authentication proves who sent the message. It does not prove that the recipient wanted it.
5. "It's B2B" Is Not a Deliverability Strategy
This will probably be the uncomfortable part for some sales organizations.
M3AAWG defines cold email as unsolicited email from an otherwise legitimate organization attempting to create a business relationship with someone who has no previous relationship with that sender.
Its position is explicit: M3AAWG views that type of cold email as abusive.
That does not mean every cold email is illegal.
Applicable law varies by jurisdiction and circumstance, and M3AAWG itself says its document is not legal advice.
But deliverability teams need to separate two questions:
"Are we legally allowed to send this?"
from:
"Does this recipient want or expect this message?"
Mailbox providers are heavily concerned with the second question.
Yahoo, for example, says its goal is to deliver messages consumers want and recommends sending timely, relevant email to an active and engaged audience. It also warns that unsolicited commercial email can negatively affect sender reputation.
This is particularly relevant to businesses using purchased lists, appended addresses, scraped data, enrichment platforms and large-scale automated outbound email.
A valid email address is not the same thing as an engaged prospect.
6. One-Click Unsubscribe Is Now Baseline Infrastructure
An unsubscribe link buried at the bottom of an email is no longer the entire unsubscribe system.
M3AAWG recommends the List-Unsubscribe header and says senders need RFC 8058 List-Unsubscribe-Post functionality to comply with updated requirements from major mailbox providers.
Google currently requires marketing and subscribed messages from bulk senders sending roughly 5,000 or more messages per day to personal Gmail accounts to support one-click unsubscribe, along with a visible unsubscribe option in the message.
Yahoo has comparable one-click unsubscribe requirements for bulk senders.
This is not simply about compliance.
Someone who no longer wants your emails will take an action.
You would much rather that action be:
Unsubscribe
than:
Report Spam
Yahoo explicitly warns that making unsubscribe difficult can lead recipients to block a sender or mark the message as spam, damaging domain reputation.
What Should Email Senders Audit Right Now?
You do not need to rebuild your entire email program tomorrow.
But you should be able to answer these six questions.
1. Where did every major segment of your database come from?
Can you identify the form, page, event, import or acquisition source?
2. What proof of consent do you retain?
Could you reasonably show when and how someone entered your database?
3. What did people actually agree to receive?
Does your current email program match the expectations you established at signup?
4. Are your forms protected against automated abuse?
Review CAPTCHA, validation, rate limiting and bot protection.
5. Are you using third-party or cold-acquisition data?
If so, distinguish between having an address and having recipient expectation.
6. Is your unsubscribe infrastructure actually compliant?
Confirm that your ESP or sending platform supports appropriate one-click unsubscribe headers, not simply a footer link.
The EmailSmart Perspective: Permission Gets You Onto the List. Engagement Helps Keep You in the Inbox.
There is one more step businesses cannot afford to miss.
You can follow strong acquisition practices and still develop deliverability problems later.
A subscriber can genuinely ask to receive your emails today and stop caring about them six months from now.
That is why permission and engagement solve different problems.
Permission answers:
Did this person ask to receive our email?
Engagement answers:
Are they still demonstrating that our email is relevant to them?
Google advises senders to periodically confirm that recipients still want their messages and to consider unsubscribing recipients who do not open or read them.
Yahoo goes further, explicitly telling senders that sending to users who are not reading their mail can harm delivery metrics and reputation, and recommends monitoring inactive recipients and considering reconfirmation campaigns.
This is where we believe many businesses still have a major blind spot.
They treat an opt-in as permanent permission to keep sending at the same frequency indefinitely.
It isn't.
At EmailSmart, we think about it this way:
Permission gets you onto the list. Continued positive engagement helps you continue earning access to the inbox.
That does not mean a single missed open suddenly makes somebody a bad contact.
It means businesses need to understand how the composition of the audience they mail changes over time.
Are you mostly mailing people who have engaged recently?
Are more of your sends going to people who have been inactive for 90, 180 or 365 days?
Are complaints increasing as engagement falls?
Are people clicking, replying and interacting, or are they increasingly ignoring the messages?
That is why EmailSmart focuses so heavily on engagement over time, not simply database size.
A list of 100,000 contacts is not automatically more valuable than a list of 25,000.
What matters is how many of those people still want to hear from you.
Deliverability Starts Before the Send, But It Does Not End There
The newest industry standards reinforce something senders need to understand:
Email deliverability is not one technical setting.
It is a chain.
How you collect the address.
What permission you establish.
How securely you collect it.
What you send.
How frequently you send.
How recipients respond.
How quickly you recognize when they stop responding.
SPF, DKIM and DMARC still matter.
Bounces and complaints still matter.
One-click unsubscribe matters.
But those are pieces of a larger system.
The businesses that adapt will stop asking only:
"Can we send to this person?"
They will start asking:
"Should we still be sending to this person?"
That is a much more important question for the future of email deliverability.
Sender reputation isn't created when you hit Send. It begins with how someone gets onto your list and continues to be shaped by what happens every time you email them.
Frequently Asked Questions
Are M3AAWG's new email standards legally required?
No. M3AAWG describes the document as industry Best Common Practices and explicitly states that it is not legal advice. Senders must separately comply with applicable laws and mailbox-provider requirements.
Is double opt-in now required?
Not universally. M3AAWG identifies confirmed opt-in, commonly called double opt-in, as the highest-standard opt-in best practice. Google also currently recommends confirmation of recipient addresses for subscription email.
Can signup forms affect email deliverability?
Yes. M3AAWG specifically connects unprotected forms with list bombing and recommends multiple safeguards against automated submissions. Poor acquisition controls can introduce unwanted and invalid addresses into a mailing database.
Does permission guarantee email deliverability?
No. Permission is an important foundation, but mailbox providers also evaluate sender reputation, complaints and other characteristics of a sender's mail. Google and Yahoo both encourage senders to manage inactive recipients and focus on audiences that continue to want their messages.
Is one-click unsubscribe required?
It is required for certain bulk marketing and subscription email. Gmail requires it for marketing and subscribed messages from senders meeting its bulk-sender threshold, and Yahoo has similar requirements for bulk senders.