# CAN-SPAM Checklist for Small Teams: What to Fix Before You Hit Send

> A practical, step-by-step pass through the main CAN-SPAM requirements for commercial email, written for teams of one to ten people. Work through it today and you will know your campaigns cover the basics.

You send email to win customers, and somewhere in the back of your mind is a worry: are we actually allowed to do this? Small teams rarely have a compliance person. The founder writes the copy, a freelancer sets up the sending tool, and nobody owns the rules.

This checklist fixes that. It covers the core requirements of the US CAN-SPAM Act as they apply to commercial email, including cold outreach to businesses. It is a practical summary, not legal advice. Laws change and other countries have their own rules, so check what applies to you and your recipients. For the bigger picture, read [is cold email legal](https://getclient.pro/blog/is-cold-email-legal), and if you email people in Europe or the UK, read [GDPR for B2B cold email](https://getclient.pro/blog/gdpr-cold-email-b2b) too, because it is stricter.

## Step 1: Decide who owns compliance

CAN-SPAM holds both the business being promoted and the people sending on its behalf responsible. If an agency or freelancer sends for you, you are still on the hook.

Do this today:

- Name one person who signs off on every new campaign before it goes live.
- Write down which tools and inboxes send email in your name.
- If someone sends for you, agree in writing that they follow this checklist and handle opt-outs promptly.

Agencies doing this for clients should flip that around and put it in their own process. See [run outreach for clients](https://getclient.pro/blog/run-outreach-for-clients) for how to set that up.

## Step 2: Make your header information honest

The From name, From address, Reply-To and routing information must accurately identify who is sending. No pretending to be a customer, a colleague or a big brand.

Check each sending account:

- The From name is a real person, your company, or both (for example "Sam at Northside Plumbing").
- The domain belongs to you or your business.
- Replies go to an inbox someone actually reads.

Authentication is not a CAN-SPAM requirement, but it proves the mail really comes from your domain and helps it reach inboxes. If you have not done it yet, follow [set up SPF, DKIM and DMARC for cold email](https://getclient.pro/blog/set-up-spf-dkim-dmarc-for-cold-email).

## Step 3: Write subject lines that match the email

A subject line must not mislead people about what is inside. Tricks like "Re:" on a first message, fake invoice language or "Your account" when there is no account are exactly what the law targets.

A quick test: read the subject, then the first two lines of the body. If a reasonable person would feel tricked, rewrite it. "Quick question about your HVAC website" is fine if the email is about their HVAC website.

## Step 4: Identify the message as an ad where needed

Commercial messages must be identifiable as advertising. The law does not require a specific label, and the way to meet this depends on context. In practice, a short, honest pitch that clearly comes from a business offering something is very different from a message disguised as personal news. Avoid disguising a sales email as anything else, and check the guidance for your situation if you are unsure.

## Step 5: Include a valid physical postal address

Every commercial email needs your valid physical postal address. This can be a street address, a post office box registered with the postal service, or a private mailbox registered with a commercial mail receiving agency under postal rules.

Working from home and do not want your house in every footer? A registered PO box or mailbox service is a common solution. Put the address in your signature or footer template once so no campaign goes out without it.

## Step 6: Give a clear way to opt out, and honor it

This is the part small teams most often get wrong, simply because nobody is watching the replies.

The requirements, in plain terms:

- Tell recipients clearly how to stop getting your emails.
- The method must work for at least 30 days after you send.
- Honor opt-out requests within 10 business days.
- Do not charge a fee, ask for more than an email address and opt-out preferences, or make people do more than send a reply or visit a single page.
- Do not sell or transfer the addresses of people who opted out.

A one-click unsubscribe link is the cleanest way to do this. If you rely on "reply STOP" instead, someone must check replies daily and remove those addresses from every list and tool you use.

Replies from your connected inboxes also land in one Inbox, so a "please remove me" written in plain words does not get lost.

## Step 7: Keep one suppression list across everything

Opt-outs fail when lists live in several places. Someone unsubscribes from campaign A, then gets campaign B from a different tool a week later.

Do this today:

- Create one master "do not contact" list.
- Before importing any new list, remove anyone on it.
- If you export leads to another sender, carry the suppression list with them.

This matters more when you send multi-step campaigns. Every step in your [follow-up sequence](https://getclient.pro/learn/follow-up-sequence) must stop the moment someone opts out.

## Step 8: Run a pre-send check on every campaign

Turn the steps above into a two-minute ritual. Before launching, preview each step and confirm:

| Check | Pass when |
|---|---|
| From name and address | Real, yours, monitored |
| Subject line | Matches the body |
| Sales nature | Not disguised as anything else |
| Postal address | Present in every step |
| Opt-out | Visible, working link or clear instruction |
| Suppression | Opted-out contacts removed |
| Merge tags | Fill correctly, no broken text |

That last line is not a legal item, but a broken greeting looks careless and can undercut trust. Preview with a few real records before sending.

## Step 9: Keep simple records

You do not need a compliance system. A shared document is enough. Record when each campaign launched, who approved it, where the list came from, and how opt-outs were processed. If a question ever comes up, you can show you took the rules seriously.

Sending to a tight, relevant list also helps. Fewer annoyed recipients means fewer complaints. Defining your [ideal customer profile](https://getclient.pro/learn/ideal-customer-profile) before you build a list is the easiest way to get there.

If you want to try sending with opt-outs handled for you, new GetClient accounts get free credits with no card needed. See [plans and credits](https://getclient.pro/pricing) for details.

## Frequently asked questions

### Does CAN-SPAM apply to B2B cold email?

Yes. CAN-SPAM covers commercial email messages in general and does not exempt business-to-business email. Check the current rules for your situation, as this is not legal advice.

### Do I need permission before emailing someone under CAN-SPAM?

CAN-SPAM does not require prior consent for commercial email, but it does require honest headers and subjects, a postal address and a working opt-out. Other laws, such as GDPR in Europe, can be stricter, so check what applies to your recipients.

### Can I use my home address in the email footer?

You can, but you are not required to. A post office box or a registered private mailbox service can meet the postal address requirement, which many home-based businesses prefer.

### What happens if my freelancer sends a non-compliant email for me?

Both the business being promoted and the sender can be held responsible. Agree on the rules in writing and review campaigns before they launch.

### Is a 'reply to unsubscribe' line enough?

It can satisfy the opt-out requirement if it is clear and you honor requests within 10 business days. The risk is missed replies, so a one-click link plus someone checking replies is safer.

Source: https://getclient.pro/blog/can-spam-checklist-for-small-teams