Policies

Most Mailfully accounts send from a shared IP pool. One account with a bad list degrades delivery for everyone behind the same IPs and domains, so the standards below are enforced automatically and without prior notice.

Every pause can be appealed and is reviewed by a person. See Appeals.

Sending standards

Two metrics can lead to an account being throttled or paused.

Metric	Threshold	Definition
Complaint rate	0.07%	Spam complaints ÷ delivered emails
Bounce rate	4%	Hard (permanent) bounces ÷ accepted emails

Cross either one and Mailfully may pause the account immediately and without notice.

Soft bounces do not count toward the bounce rate. Only permanent failures do, matching what lands on your suppression list.

How the rates are measured

On a rolling 7-day window, recalculated continuously.
Only after 500 sent emails in the window. Below that, a run of bounces or complaints can still throttle or pause sending. Obvious abuse is reviewed by hand.
Live sending only. Test mode traffic is excluded.

Both rates are visible in the dashboard and through GET /v1/analytics/daily and external reputation.

Maintain your lists

Delete suppressed addresses. Never import a suppressed address.
Never send to an address you have not confirmed. Signup typos are a leading source of hard bounces.
Validate addresses at collection time, not at send time.
Warm new domains gradually rather than jumping volume significantly in one day.

Email categories

Every email sent through Mailfully is either transactional or marketing. Declare each send with type: transactional (the default) or marketing. See Choosing a sending feature.

{
  "from": "receipts@yourdomain.com",
  "to": ["ada@example.com"],
  "subject": "Your receipt",
  "type": "transactional"
}

Category	What it covers
Transactional	Triggered by a specific action the recipient took, sent to one recipient, and containing information they need: receipts, password resets, order and shipping updates, security alerts, account notices, one-time codes.
Marketing	Anything whose primary purpose is commercial: newsletters, product announcements, promotions, re-engagement campaigns, onboarding drips, digests, event invitations.

The test is the message's primary purpose, not the system that triggered it. A receipt with a discount code stapled to the footer is marketing. An automated drip is marketing even though it is automated. If a message would be unwelcome to someone who did not ask for it, it is marketing.

Misclassifying marketing email as transactional to dodge a plan limit counts as quota circumvention and is grounds for a pause.

Free includes 5,000 emails a month, of which at most 1,000 can be marketing. See Quotas and plan limits.

Legal compliance

You are the sender. You are responsible for the legality of every message you put through the API, in every jurisdiction your recipients are in.

CAN-SPAM

Every commercial message must:

Use accurate from, reply-to, and routing information. No forged headers, no misleading domains.
Carry a subject line that reflects the contents of the message.
Identify itself as an advertisement where the recipient has not clearly opted in.
Include a valid physical postal address.
Offer a clear, working way to opt out.
Honor opt-outs within 10 business days, and keep honoring them. Selling or transferring an address that has opted out is prohibited.

You remain responsible when someone sends on your behalf.

Mailfully may pause an account without notice for CAN-SPAM violations. CAN-SPAM enforcement does not wait for a complaint threshold. One confirmed violation is enough.

Other regimes apply on top of CAN-SPAM depending on your recipients, including GDPR and ePrivacy in the EU, CASL in Canada, PECR in the UK, and the Australian Spam Act. Several of these require opt-in consent, which CAN-SPAM does not. Meet the strictest rule that applies to your list.

Bulk sender requirements

If you send marketing email at volume, the receiving networks impose their own rules and Mailfully enforces them:

Authenticate: SPF and DKIM must pass, and the sending domain needs a published DMARC record. Verify your domain before sending.
One-click unsubscribe: marketing messages must carry List-Unsubscribe and List-Unsubscribe-Post headers, and the unsubscribe must complete without a login or a confirmation step.
Unsubscribe processing: within 2 days.
Complaint ceiling: under 0.3% as reported by Google Postmaster Tools, a separate ceiling from Mailfully's own 0.07%.

See Gmail and Yahoo sender requirements for how these rules apply to those two networks specifically, and which side of each one Mailfully covers.

Permission and lists

Send only to people who asked to hear from you.

Prohibited outright:

Purchased, rented, leased, or exchanged lists, regardless of what the seller claims about consent.
Scraped or harvested addresses.
Appended addresses, including addresses guessed from a name and a domain.
Cold outreach to people who have no relationship with you.
Addresses carried over from a different company, product, or brand than the one the recipient signed up for.

Required:

A record of when and how each recipient opted in, producible on request.
A working opt-out in every marketing message.
Suppression of every address that bounces hard or complains. Mailfully does this for you; do not work around it.
Re-permission before mailing a list that has gone longer than 12 months without contact.

Prohibited content and uses

You may not use Mailfully to send:

Category	Examples
Spam	Unsolicited bulk email of any kind
Phishing and fraud	Credential harvesting, impersonation of a person or brand, invoice fraud, fake shipping or security notices
Malware	Viruses, ransomware, exploit code, or links to any of it
Illegal content	Anything unlawful where the sender or the recipient is, or content promoting it
Harassment	Threats, intimidation, doxxing, or coordinated targeting of an individual
Sexually explicit material	Adult content, escort services, and related solicitation
Regulated goods	Controlled substances, prescription pharmaceuticals sold without a prescription, tobacco, vaping products, weapons and ammunition
High-abuse financial offers	Payday and high-interest loans, debt relief and credit repair, work-from-home and get-rich-quick schemes, multi-level marketing, forex and binary options
Cryptocurrency promotion	Token sales, airdrops, and trading signals. Account and security notices for a licensed exchange are fine
Gambling	Casinos, sportsbooks, and lotteries, except where you hold a license valid in the recipient's jurisdiction
Deceptive claims	Miracle cures, unsubstantiated health or income claims, fake countdowns and fake scarcity

You also may not:

Send from a domain you do not control, or forge another party's identity in the headers.
Open multiple accounts to work around a quota, a pause, or a plan limit.
Resell raw Mailfully sending capacity as a standalone email service.
Use the API to test, probe, or validate address lists you do not intend to mail.
Send data the platform is not built to carry. Mailfully is not HIPAA-eligible and is not in PCI scope: no protected health information, no full card numbers, no government identifiers in message content.

A few categories above turn on who you are rather than what the message says. A regulated but lawful business, such as licensed gambling, a licensed pharmacy, or regulated finance, can be approved case by case. Ask before you send.

Mailfully may refuse or stop any sending that threatens platform deliverability, including sending that breaks no specific rule listed here.

Security and account hygiene

Follow API key security: keep keys server-side, rotate them, and scope them to what they need.
Verify webhook signatures on every delivery.
Report a suspected key compromise to security@mailfully.com immediately. Sending from a stolen key is still attributed to your account, and the resulting complaint rate is still yours.

Enforcement

What happens depends on what was breached.

Action	What it means	When
Warning and throttle	The daily limit is reduced, for test sends too, and sending continues at a lower rate. It lifts by itself once rates fall back. A throttle that lasts too long becomes a pause.	A bounce or complaint rate over a threshold in Sending standards
Pause	All sending refused. The API and your data stay readable.	A higher bounce or complaint rate, a throttle that lasts too long, or a content or legal breach
Termination	Account closed.	Repeat or severe abuse, or fraud

The ladder is not a sequence you are entitled to. A high enough bounce or complaint rate, CAN-SPAM violations, phishing, and malware go straight to a pause with no warning step.

What a pause looks like

Sends from a paused account fail with 403 and error type forbidden:

{
  "error": {
    "type": "forbidden",
    "message": "This account is paused."
  }
}

Do not retry a 403 in a loop. It will not clear on its own. This is different from account_suspended, which means account setup was never finished (see Errors).

A message that comes due while sending is paused is canceled, and is not sent after the pause lifts. A scheduled message due after the lift sends normally. Read routes stay available so you can export message history, events, and suppressions. Webhooks continue to deliver events for mail already in flight. Billing continues through a pause; no credit is issued for the period.

Appeals

A person reads every appeal.

Email contact@mailfully.com from an address on the account, and include:

Your org ID.
What you believe triggered the pause.
Where the affected list came from and how consent was collected.
What you have changed so it does not happen again.

We respond within 1 business day and aim to resolve within 3. Sending stays off during the review. If the pause was ours to fix, it is lifted and nothing is charged for the downtime.

Reinstatement usually carries conditions: a reduced daily cap, a clean re-permissioned list, or a period of monitored sending before full volume returns. There is no reinstatement fee.