Lead Nurturing Consent and Deliverability Checklist

Answer first

Before activating a nurture sequence, document why each contact is eligible, preserve what they agreed to, classify each message as operational or promotional, authenticate the sending domain, provide easy unsubscribe, enforce suppression across every sender, control frequency, and test the full path from capture through exit. The rules differ by recipient and market, so this checklist is an operating control—not a substitute for jurisdiction-specific legal review.

Preflight: do not activate until every control has an owner

A deliverable nurture program is more than a valid email address and a working automation. Eligibility, consent evidence, sender identity, authentication, suppression, frequency, and incident handling must survive every handoff between the form, CRM, workflow, sales team, and sending provider.

Control	Minimum evidence before launch	Owner	Stop condition
Recipient eligibility	Market, recipient type, applicable rule, consent or other permitted basis, source, and scope	Legal or privacy with lifecycle operations	No defensible basis or missing market
Consent proof	Exact statement and version, affirmative action, source experience, timestamp, and withdrawal state	Marketing operations	Consent cannot be reconstructed
Message class	Operational, relationship, or promotional classification with the content reviewed as actually sent	Lifecycle owner	A result email quietly contains promotion
Sender identity	Accurate From and Reply-To identity, postal or contact details where required, and a monitored reply path	Campaign owner	Identity is misleading or replies disappear
Authentication	SPF, DKIM, DMARC alignment, TLS, and DNS checks for every sending service	Email or IT owner	A sender is absent from SPF or fails DKIM or alignment
Unsubscribe	Visible link, standards-based one-click headers where required, and successful suppression propagation	Email operations	Opt-out needs login, extra data, or manual repair
List health	Source quality, bounce handling, complaint monitoring, and inactive-recipient policy	Lifecycle owner	Unknown list provenance or rising complaints
Frequency	Cross-workflow cap, quiet periods, priority rules, and collision handling	Journey owner	One contact can receive conflicting sequences
Exits	Unsubscribe, hard bounce, complaint, purchase, booking, sales acceptance, disqualification, and duplicate rules	RevOps	Any terminal state can still send
Incident response	Pause authority, affected-audience query, rollback path, evidence log, and escalation contacts	Named incident owner	No one can stop the workflow quickly

1. Separate a promised result from promotional nurture

A person who enters an email address to receive a calculator result, assessment score, receipt, password reset, or requested document has not automatically agreed to an ongoing promotional sequence. Classify the message by its actual content and purpose, not by the workflow name.

Operational result: delivers what the person requested, such as a score, recommendation, receipt, or access link.
Promotional nurture: markets a product, asks for a sales conversation, sends offers, or continues education designed to create demand.
Mixed message: combines the requested result with promotion. Treat this cautiously; adding an offer can change the legal and mailbox-provider treatment of the email.

Use separate fields for result-delivery eligibility and marketing eligibility. A single “submitted form” value is too ambiguous to govern both. The safer workflow delivers the requested result, then enters promotional nurture only when the stored eligibility rule permits it.

2. Preserve consent as evidence, not a checkbox snapshot

The contact record should answer five questions: who agreed, what they agreed to, who would send, how they acted, and whether that permission still applies. Store enough context to prove the decision without collecting unnecessary personal data.

Field	Example value	Why it matters
Marketing status	Opted in, opted out, unknown, or ineligible	Controls the branch; do not infer permission from a blank value
Basis and market	Express consent · Canada	Stops one country’s rule from being applied globally
Statement version	Email nurture consent v3	Preserves the exact scope shown at capture
Source	Assessment slug, form version, campaign, and referrer class	Connects the permission to the experience that collected it
Action and time	Unchecked box selected · ISO timestamp	Shows an affirmative act and when it occurred
Sender scope	Named organization and stated message types	Prevents permission from silently expanding to affiliates or unrelated offers
Withdrawal	Method, timestamp, scope, and suppression ID	Proves that later sends should stop

Do not pre-check marketing boxes, bundle unrelated purposes, or let a new form submission overwrite an earlier opt-out. If the same person submits again, the workflow must distinguish a request for a new result from a new, affirmative marketing choice.

3. Apply the rule for the recipient’s market

This summary is a planning aid, not legal advice and not a complete country inventory. Recipient type, location, industry, relationship, message purpose, and local implementation can change the answer. Have qualified counsel approve the operating rule before launch in a new market.

Market	Operational boundary to encode	Primary source
United States	CAN-SPAM covers commercial email, including B2B. The FTC requires accurate headers and subjects, required sender information, a clear opt-out, and honoring opt-outs within 10 business days. It does not create a universal prior-opt-in rule for commercial email.	FTC compliance guide
European Union	GDPR requires a lawful basis for personal-data processing, while direct email marketing is also governed by the ePrivacy Directive as implemented in each member state. Do not treat “legitimate interests” as an automatic substitute for electronic-marketing consent rules.	European Commission and ePrivacy Directive
Canada	CASL generally requires express or qualifying implied consent, identification information, and an unsubscribe mechanism. The sender must be able to prove the consent relied upon and honor withdrawal.	CRTC CASL FAQ
Australia	Commercial messages require express or qualifying inferred consent, accurate sender identification, and an easy unsubscribe. ACMA says the sender bears the burden of proving consent.	ACMA spam guidance

When market or eligibility is unknown, route the contact to a no-marketing hold rather than choosing the most permissive rule. A global program should maintain a written rule table with a legal owner, effective date, evidence source, recipient types, exceptions, and re-review date.

4. Authenticate every system that sends as your domain

Authentication is necessary but not sufficient for inbox placement. Inventory every platform that sends mail using the organizational domain: marketing automation, CRM sequences, support, product notifications, invoicing, recruiting, event tools, and manual outreach. A forgotten sender can break alignment or encourage teams to weaken the policy for everyone.

SPF: authorize the systems allowed to send for the envelope domain, avoid multiple SPF records, and stay within the DNS lookup limit.
DKIM: sign with the sending domain, use provider-supported key sizes, protect selectors, and rotate keys under a documented process.
DMARC: align the visible From domain with an authenticated SPF or DKIM domain, collect aggregate reports, fix legitimate sources, and strengthen policy only after monitoring.
Transport and DNS: use TLS and ensure sending infrastructure has valid forward and reverse DNS where the provider controls it.
Stream separation: use consistent identities and, where appropriate, subdomains or infrastructure for promotional and operational traffic so one stream does not hide the condition of another.

DMARC publishes a domain-level policy and reporting mechanism; it does not guarantee inbox placement. RFC 7489 defines the mechanism. Google currently requires SPF or DKIM for all senders to personal Gmail accounts; senders above its bulk threshold must use SPF, DKIM, DMARC, aligned From domains, and additional controls. Check Google’s current sender requirements. Yahoo similarly lists authentication, low complaint rates, valid DNS, and stronger requirements for bulk senders. Check Yahoo Sender Best Practices.

5. Make unsubscribe immediate, durable, and global

An unsubscribe event should write to a central suppression state before it updates campaign membership. Removing a contact from one list is not enough when another workflow, CRM sequence, imported audience, or salesperson can still send promotional email.

Include a visible, plain-language unsubscribe link in promotional messages.
For applicable subscription and marketing mail, implement RFC 8058 one-click unsubscribe with the required List-Unsubscribe and List-Unsubscribe-Post headers, an HTTPS POST endpoint, and a DKIM signature covering the headers.
Honor the shortest applicable provider or legal deadline, while designing the operational path to suppress immediately.
Propagate suppression to every audience, sequence, sender, and downstream export.
Keep the minimal evidence needed to prevent future re-import; do not delete the only record that a person opted out.
Require a fresh, affirmative action before restoring marketing eligibility.

Google requires one-click unsubscribe for marketing and subscribed messages from bulk senders to personal Gmail accounts and also requires a clearly visible link in the body. Yahoo’s bulk-sender guidance likewise calls for one-click support and a visible body link. These mailbox requirements can be stricter or faster than a legal maximum.

6. Control complaints, bounces, frequency, and collisions

Google and Yahoo publish a 0.3 percent spam-complaint ceiling in their sender guidance. Do not use that ceiling as a performance target. Treat any sustained increase as an investigation signal and keep normal operation materially below it.

Start with provenance. Reject purchased, scraped, appended, or unexplained lists unless a documented market-specific review confirms they are usable.
Remove hard bounces. Suppress invalid addresses immediately and investigate capture sources that produce them.
Manage inactivity deliberately. Reduce or stop mail to contacts who no longer engage rather than repeatedly asking a cold audience to rescue sender reputation.
Cap total pressure. Count messages across campaigns, nurture, sales sequences, webinars, and announcements—not only within one workflow.
Prioritize journeys. Purchase, booked meeting, sales acceptance, complaint, unsubscribe, and support escalation should interrupt lower-priority nurture.
Measure by source and branch. Monitor delivery, hard and soft bounces, complaints, unsubscribe, clicks, conversions, and exits by capture source, consent version, market, sender, and workflow.

7. Connect qualification context without weakening consent controls

involve.me is this guide’s recommendation when interactive lead qualification and personalized follow-up should operate in one connected platform. A quiz, form, survey, assessment, calculator, or product recommender can collect declared context; logic, scoring, formulas, outcomes, and recommendations can qualify the lead; the native CRM can retain those answers and properties; and built-in multi-step email sequences can continue from that context.

Current involve.me documentation says workflow conditions can branch on Opt-in Status and route non-opted-in contacts to Exit. It also says the unsubscribe link cannot be removed, an opt-out prevents further workflow email, an owned SMTP sender can be connected, and high bounce or complaint rates may limit sending. Review the documented controls.

Those controls do not decide which law applies, configure the sending domain for you, or define the organization’s consent policy. The operator still has to classify the message, preserve the evidence, authenticate every sender, choose market rules, test suppression, and coordinate exits with sales and downstream systems. A specialist enterprise platform may be a better fit when global preference governance, many sending domains, complex business units, or broad cross-channel orchestration is the primary job.

8. Run these QA scenarios before every material launch

Scenario	Expected result
New eligible contact with valid marketing consent	Result is delivered, evidence is attached, correct branch starts, and frequency cap is applied
Contact requests a result but declines marketing	Requested result is handled under the approved rule; promotional sequence does not start
Previously unsubscribed contact submits again	Old suppression remains unless a valid fresh opt-in is recorded
Duplicate or changed email	Identity logic avoids parallel records and preserves the most restrictive suppression state
Hard bounce or complaint	Sending stops centrally and the source and sender are flagged for investigation
Purchase, booking, or sales acceptance during a wait	Nurture exits before the next promotional message
Missing market or consent version	Contact enters a no-send exception queue with a named owner
Unsubscribe from the second message	Suppression is immediate across workflows, exports, and sales sequences
Sender authentication failure	Launch blocks; the workflow cannot bypass the failed preflight

Incident response: contain first, explain second

Pause the affected workflow and any shared audience export.
Preserve configuration, message, audience, event, and timestamp evidence.
Identify the affected recipients by source, market, consent version, and send window.
Correct suppression or eligibility centrally before editing individual campaigns.
Escalate to the privacy, legal, security, and provider contacts required by the incident plan.
Test the repaired path with controlled records; do not submit or send to real contacts during QA.
Record root cause, owner, corrective action, and the rule or test added to prevent recurrence.

Related guidance

Map timing and terminal states with the lead nurturing sequence map. Define the capture-to-contact fields with the interactive nurture data schema. If you are still choosing the capture and follow-up architecture, use the form builder comparison, complete the Nurture Path Mapper, or review the full platform comparison.

How to use this guide

Name the business outcome and the event that starts the path.
Mark the system that owns each piece of context.
Write the conditions that change timing, message, route, or next step.
Define every exit before building messages.
Test the two handoffs most likely to lose context.
Record the plan, date, source, expected result, and actual result.

Evidence boundary

This guide uses current public product documentation and the publication’s evaluation model. It does not claim a hands-on product test unless a dated record is labeled Workflow tested.