· 8 min read
List hygiene: the six-rule policy
Most list hygiene failures aren't about the rules being unknown. They're about the rules not being written down, so different team members handle them differently and occasional exceptions become permanent. A written hygiene policy removes the judgement calls. Six rules, covering the six ways list quality degrades, each automatically enforced. Here's the policy.
Justin Williames
Founder, Orbit · 10+ years in lifecycle marketing
Why a policy beats a cleanup
A list that never shrinks is a list that's slowly poisoning your deliverability. The list that gets cleaned up once a year has already done months of damage.
A cleanup is reactive — you notice bounce rates climbing and go hunting for the problem. A policy is preventative: automatic rules that keep the list healthy without anyone having to remember to do it. The six rules below can all be encoded as Braze segments or event-based automations. Each one maps to a specific degradation pattern.
The Deliverability Management skill covers the reputation mechanics these rules protect. Each rule below is optimising for one of those mechanics.
Rule 1: Hard bounce once, remove forever
An email that hard-bounces has told you the address doesn't exist, has been disabled, or has an irreversible delivery problem. Sending again produces another bounce, another negative reputation signal, zero chance of a response.
The rule: on any hard bounce, move the user's email subscription status to permanently unsubscribed from marketing, and flag the profile so manual re-subscription requires verification. Do not send marketing mail to the address ever again.
Exception: transactional mail can continue (password resets, security alerts) in case the user needs it for account recovery. Anything marketing-flavoured is suppressed permanently.
Rule 2: Soft bounce three times, suppress
Soft bounces are recoverable in principle — full mailbox, temporary server issue. In practice, three soft bounces in a row usually means the mailbox is abandoned or the provider is treating your mail as spam-adjacent. Continuing to send is a reputation drain.
The rule: three consecutive soft bounces flags the user for suppression from marketing sends. Re-evaluate if the user engages (opens, clicks, visits the product) within 30 days; otherwise confirm the suppression permanently.
Rule 3: Zero engagement in 180 days, sunset
180 days is the default floor. Aggressive programs sunset at 90; conservative programs at 365. The right number depends on your natural engagement cadence — a product used weekly can sunset at 90 days; a product used quarterly needs 365+.
The rule: users with zero engagement signal (opens, clicks, product visits, transactions) in 180 days are moved to a "quiet list" that receives at most one re-engagement message per quarter. If they engage, back to active. If they don't respond after two re-engagement messages, permanent sunset.
The win-back flows guide covers the re-engagement sequences that run before final sunset — they're the safety net that catches users who would have come back if asked.
Rule 4: Spam complaint, immediate suppression
A user marking an email as spam is the single strongest negative signal in deliverability. Continuing to send after a complaint is catastrophic — the next complaint compounds the reputation damage, and most mailbox providers will rapidly downgrade your sender reputation if complaint rates climb.
The rule: on any complaint (via feedback loop from major ISPs), suppress the user from marketing and transactional sends immediately. Don't re-evaluate. Don't ask them to re-subscribe. The user has told you they don't want your mail; continuing is at best bad manners and at worst a regulatory issue.
Rule 5: Role accounts, suppress by default
Role accounts (info@, sales@, support@) are usually monitored by multiple people, rarely opted in by the role-owner intentionally, and a known source of complaints. Some mailbox providers treat high volumes to role accounts as a reputation signal.
The rule: role accounts are suppressed from marketing sends by default. They continue to receive transactional. If a specific role account has been explicitly subscribed by an authorised user, flag it for inclusion — but make explicit opt-in the requirement.
Rule 6: Spam traps, immediate remediation
Spam traps are email addresses owned by mailbox providers or anti-spam organisations that exist only to catch senders who are acquiring list data through dubious means — scraping, purchased lists, old imports. Landing mail in a spam trap is a major negative signal.
The rule: if a third-party deliverability service flags a spam trap in your list (or a pattern suggests one), immediately investigate the source of the address and remove it. Review the acquisition path — you probably have other similar addresses you haven't yet identified. Never knowingly send to an address you can't trace back to a real opt-in.
,
How to actually implement it
Each rule becomes a Braze segment or a Braze-managed attribute flag. Hard bounce → segment excluded from all marketing. Soft-bounce-thrice → segment excluded. 180-day dormant → segment excluded from broadcasts, included in re-engagement only. Complaint → segment excluded permanently. Role-account → segment excluded by default. Spam trap → segment excluded and flagged for investigation.
The policy is only useful if it's enforced automatically. Document the six rules, implement the six segments, and audit quarterly that each is still firing as intended. The lifecycle audit checklist includes rule enforcement as one of the 30 points.
Frequently asked questions
- How often should I run list hygiene?
- Continuously. The six rules above should be automatic — Braze segments with event-based triggers — rather than a monthly cleanup job. The only quarterly check is auditing that the rules are still firing (part of the lifecycle audit).
- What's the right dormancy threshold for sunsetting users?
- 180 days is the default floor. 90 for high-frequency products (daily/weekly usage), 365 for low-frequency products (quarterly/annual usage). The threshold should reflect your natural engagement cadence, not an arbitrary round number.
- Can a suppressed user re-subscribe?
- For 180-day sunsets, yes — automatically on any engagement signal within the grace period. For hard bounces, spam complaints, and traps, re-subscription requires a manual verification step (usually a double-opt-in confirm). The burden is intentional; these are permanent suppression triggers for good reason.
- Why suppress role accounts like info@?
- Role accounts are usually monitored by multiple people, rarely opted in intentionally, and a known source of complaints. Some mailbox providers treat heavy role-account sending as a reputation signal. Suppress by default; include only with explicit confirmed opt-in.
- What if my list shrinks significantly after implementing this?
- Expect a 5–15% reduction on a first implementation for programs that haven't run hygiene before. That's the dead weight. Engagement rates, deliverability, and revenue-per-send all improve as a result. A smaller engaged list outperforms a larger unengaged one on every metric except raw size.
- How do I identify spam traps proactively?
- Third-party deliverability services (Validity, Email on Acid, etc.) run spam-trap monitoring. Signs you might have traps without a service: sudden deliverability drops, specific ISPs blocking you, or patterns of addresses that never open, never click, and have suspicious domains. Audit the acquisition path behind any suspicious addresses.
This guide is backed by an Orbit skill
Related guides
Email deliverability — the practitioner's guide
Deliverability is the cumulative result of every send decision over the lifetime of a domain. This guide covers the four pillars — authentication, reputation, engagement, and list hygiene — and how to recover when one breaks.
IP warm-up for Braze — the practitioner's playbook
A dedicated IP has no sending reputation on day one. This guide shows how to ramp to full volume in 14–30 days without triggering spam filters — including the Random Bucket Number methodology most teams miss.
Apple Mail Privacy Protection, four years in
In 2021, Apple broke the email open rate. Four years later, the dust has settled — and the lifecycle programs that adapted are outperforming the ones still measuring like it's 2020. Here's what actually changed.