Email Compliance & Drip Campaigns

Built-in CAN-SPAM and GDPR compliance for every CRM email and drip campaign sent through the Kantivo Platform.

Overview

Kantivo Platform includes full CAN-SPAM and GDPR compliance for all CRM and drip campaign emails. This is built in at the platform level — every email sent through the system automatically includes the required compliance elements.

You do not need to manually add unsubscribe links, physical addresses, or sender identification. The platform handles it for you, so you can focus on writing great emails while staying on the right side of the law.

What's Automatically Included in Every Email

When the platform sends a CRM email or drip campaign message, the following compliance elements are automatically injected:

Compliance footer with organization name, physical mailing address, and unsubscribe link
List-Unsubscribe header (RFC 8058) — Gmail and Outlook show a native "Unsubscribe" button
List-Unsubscribe-Post header — enables one-click unsubscribe without visiting a webpage
Reply-To header — configurable per partner in Email Settings
Organization identification — Mailgun custom variables track which org sent the email
Sender identification — from name and email clearly identify the sending organization

No extra work required

These elements are added automatically by the platform's email engine. Even if your template does not include an unsubscribe link, one is appended in the compliance footer. You cannot accidentally send a non-compliant email.

Setting Up Email Compliance

Before you can send CRM emails or activate drip campaigns, you need to configure two things: your compliance details and your Mailgun credentials.

  1. Admin Portal → Settings → Email Compliance — Enter your organization name and physical mailing address. This is required before any CRM email can be sent. The address appears in the compliance footer of every outgoing email.
  2. Partner Portal → Email Settings — Configure your Mailgun API key, sending domain, from name, from email address, and reply-to email. Each partner (or the org's house partner) needs their own Mailgun configuration.
  3. Test Connection — Click the "Test Connection" button to send a test email and verify your Mailgun configuration works. Fix any issues before activating campaigns.

Blocked until configured

The platform will not send any CRM or drip campaign emails until both the compliance address and Mailgun credentials are configured. You will see a clear error message explaining what is missing.

🔗 Mailgun Configuration Hierarchy

Kantivo Platform uses a hierarchical Mailgun configuration system. This means you do not need to set up Mailgun for every single user — credentials cascade down from the organization level.

Configuration flow-down

Organization The org's house partner sets up Mailgun. This configuration flows down to all partners who have not configured their own.
Partner Individual partners can override with their own Mailgun API key and domain. Their consultants inherit this configuration.
Consultant Consultants use their own config, or fall back to their parent reseller's, or the org's house partner's.
Daily limits — When using a parent's Mailgun, consultants have daily send limits (configurable by the reseller, default 50/day)
No platform default — Every org must configure their own Mailgun; there is no shared platform email account
Platform notifications — Invitations, approvals, and system alerts use the platform's own email, not your Mailgun
Isolation — Each org's email reputation is entirely separate from other organizations

Why no platform default?

CRM and marketing emails must come from your domain to build your brand reputation and deliverability. A shared platform email would hurt everyone's deliverability. Kantivo requires each organization to configure their own Mailgun account so your emails come from your domain, under your control.

🔓 Unsubscribe Management

Every CRM and drip campaign email includes a unique unsubscribe link. When a recipient clicks it, the platform handles everything automatically — no manual intervention needed.

Every email includes a unique, per-contact unsubscribe link
Contact is immediately set to "do not contact" when they unsubscribe
All active drip campaign enrollments are cancelled automatically
Unsubscribe tokens are cryptographically secure and tied to a specific contact+org pair
Clean, branded confirmation page shown after unsubscribing
No authentication required — recipients can unsubscribe without logging in

One-click unsubscribe

Thanks to the List-Unsubscribe-Post header, email clients like Gmail can process the unsubscribe without the recipient ever leaving their inbox. The native "Unsubscribe" link in the email header triggers an immediate opt-out.

Bounce & Complaint Handling

Mailgun webhooks feed bounce and complaint events back into the platform in real time. The system automatically takes action to protect your sender reputation.

Event Type Action Taken Contact Status
Hard bounce Contact flagged as do_not_contact; unenrolled from all campaigns Blocked
Soft bounce Event recorded; contact not blocked (may retry on next send) Active
Spam complaint Contact immediately blocked and unenrolled from all campaigns Blocked

Webhook setup required

To enable automatic bounce and complaint handling, configure a webhook in your Mailgun Dashboard. Point it to https://your-api-url/api/v1/webhooks/mailgun and enable the Bounced, Complained, and Failed event types.

🔍 Email Verification & Anti-Probe Awareness

The CRM’s built-in email verifier runs syntax, MX, and SMTP checks on every contact you ask to verify. Results are scored 0–100 and cached for 30 days. The campaign enrollment modal automatically excludes contacts that score below 40, so bad addresses never enter your sending stream.

What makes the verifier production-grade is what it does when an SMTP probe gets blocked — not just rejected.

Verification result categories

Result Score Meaning Auto-excluded?
Valid 95 SMTP probe confirmed the mailbox exists No
Deliverable (catch-all) 75 Domain accepts everything; will not bounce but cannot prove mailbox exists No
Deliverable (Gmail / M365) 70 Recognized accept-all provider; SMTP cannot verify mailbox existence here No
Protected (likely valid) 60 Recipient is behind an anti-spam appliance (SpamExperts, Proofpoint, Mimecast, Barracuda, etc.) that policy-rejects probes No
Unknown 45–50 SMTP probe inconclusive (temp failure, connection error, unexpected response) No
Disposable 10 Domain is on the disposable email blocklist Yes
Invalid 10 SMTP probe definitively rejected with 550–553 (no such mailbox) Yes

Why “Protected (likely valid)” matters

Many corporate inboxes — especially those hosted by managed-service providers, web hosts using Plesk/cPanel, or any business that fronts their mail with a security appliance — sit behind an anti-spam gateway. These gateways policy-reject SMTP RCPT TO probes from unknown senders regardless of whether the mailbox is valid. Naive verifiers interpret the rejection as “mailbox not found” and silently destroy the contact record.

The platform recognizes the MX patterns of major anti-spam appliances (SpamExperts, Proofpoint, Mimecast, Barracuda, AppRiver, Symantec MessageLabs) and skips the SMTP probe entirely for those domains. Score is set to 60 (Protected) so the contact stays in your CRM and remains eligible for campaigns.

The verifier never sets bounce status

A failed SMTP probe is not the same as a real bounce. The email_bounce_status field on a contact is only ever set by actual Mailgun delivery webhooks (real send attempts that the recipient’s server rejected). The verifier only writes email_verification_result and email_verification_score — it never auto-flags a contact as hard-bounced based on a probe.

Recovering wrongly-flagged contacts

If you do see a contact you know is valid showing an Invalid result (perhaps from an older version of the verifier, or because the recipient’s server briefly returned an unexpected response), use the Undo Verification button in the contact detail panel. It clears:

Undo Verification deliberately does not change the contact’s status (active / inactive / do_not_contact) or unsubscribe state — those are deliberate choices that may have been made independently and should be reviewed manually.

📧 Drip Campaign Setup

Drip campaigns let you set up a sequence of emails that are sent automatically on a schedule. Once you enroll a contact, the platform handles timing and delivery — the scheduler runs every 5 minutes and sends any emails that are due.

  1. Create Templates — Build email templates with variables like {{first_name}}, {{company_name}}, and {{unsubscribe_url}}. Templates can be plain text or HTML.
  2. Create a Campaign — Give it a name and select the target audience. Campaigns can be activated or paused at any time.
  3. Add Steps — Each step has a template, a delay (in days or hours after the previous step), and an optional subject line override.
  4. Enroll Contacts — Add contacts individually or in bulk. Enrolled contacts start at step 1 and progress through the sequence automatically.
  5. Activate — Toggle the campaign to active. The scheduler picks up due emails every 5 minutes and sends them through Mailgun.
  6. Monitor — Track sent, failed, and skipped emails in the send log. Contacts who unsubscribe or bounce are automatically unenrolled.

Automatic unenrollment

If a contact unsubscribes, bounces, or is marked as do_not_contact, they are automatically removed from all active drip campaigns. You never have to manually clean your enrollment lists.

💡 Template Best Practices

Templates are the building blocks of your drip campaigns and one-off CRM emails. Following a few best practices ensures maximum deliverability and engagement.

Include {{unsubscribe_url}} for custom unsubscribe link placement (if omitted, the compliance footer adds it automatically)
Use personalization variables like {{first_name}} and {{company_name}} for better engagement
The system warns you if a template is missing an unsubscribe placeholder
Keep templates concise — plain text with line breaks works, or use HTML for richer formatting
Write clear subject lines that match the email content (reduces spam complaints)
Test templates by sending to yourself before enrolling contacts in a campaign

Available template variables

{{first_name}}, {{last_name}}, {{email}}, {{company_name}}, {{phone}}, {{unsubscribe_url}} — these are replaced with real contact data at send time. If a variable has no value for a contact, it is replaced with an empty string.

🏢 Physical Address Requirements

The CAN-SPAM Act (United States) requires a valid physical postal address in every commercial email. This is not optional — it is federal law, and violations carry significant penalties.

Accepted Format Example
Street address 123 Main Street, Suite 400, Austin, TX 78701
PO Box PO Box 4521, Austin, TX 78765
Registered commercial mail receiving agency PMB 218, 456 Oak Avenue, Austin, TX 78704

Penalties for non-compliance

The FTC can impose fines of up to $50,120 per email that violates the CAN-SPAM Act. Kantivo enforces this requirement: CRM emails are blocked until a valid physical address is configured in Admin Portal → Settings → Email Compliance.

Don't want to use your home address?

If you work from home, you can use a PO Box or a commercial mail receiving agency (like a UPS Store mailbox) instead of your home address. These are fully compliant alternatives.

← All Documentation CRM Overview →