Built-in CAN-SPAM and GDPR compliance for every CRM email and drip campaign sent through the Kantivo Platform.
Compliance is built in, not bolted on.
Kantivo Platform includes full CAN-SPAM and GDPR compliance for all CRM and drip campaign emails. This is built in at the platform level — every email sent through the system automatically includes the required compliance elements.
You do not need to manually add unsubscribe links, physical addresses, or sender identification. The platform handles it for you, so you can focus on writing great emails while staying on the right side of the law.
Every CRM and drip campaign email gets these elements without any action on your part.
When the platform sends a CRM email or drip campaign message, the following compliance elements are automatically injected:
These elements are added automatically by the platform's email engine. Even if your template does not include an unsubscribe link, one is appended in the compliance footer. You cannot accidentally send a non-compliant email.
Three steps to get your email system ready.
Before you can send CRM emails or activate drip campaigns, you need to configure two things: your compliance details and your Mailgun credentials.
The platform will not send any CRM or drip campaign emails until both the compliance address and Mailgun credentials are configured. You will see a clear error message explaining what is missing.
How email sending credentials flow through your organization.
Kantivo Platform uses a hierarchical Mailgun configuration system. This means you do not need to set up Mailgun for every single user — credentials cascade down from the organization level.
CRM and marketing emails must come from your domain to build your brand reputation and deliverability. A shared platform email would hurt everyone's deliverability. Kantivo requires each organization to configure their own Mailgun account so your emails come from your domain, under your control.
One click to opt out, fully automated.
Every CRM and drip campaign email includes a unique unsubscribe link. When a recipient clicks it, the platform handles everything automatically — no manual intervention needed.
Thanks to the List-Unsubscribe-Post header, email clients like Gmail can process the unsubscribe without the recipient ever leaving their inbox. The native "Unsubscribe" link in the email header triggers an immediate opt-out.
Automatic processing of bounces, failures, and spam complaints.
Mailgun webhooks feed bounce and complaint events back into the platform in real time. The system automatically takes action to protect your sender reputation.
| Event Type | Action Taken | Contact Status |
|---|---|---|
| Hard bounce | Contact flagged as do_not_contact; unenrolled from all campaigns | Blocked |
| Soft bounce | Event recorded; contact not blocked (may retry on next send) | Active |
| Spam complaint | Contact immediately blocked and unenrolled from all campaigns | Blocked |
To enable automatic bounce and complaint handling, configure a webhook in your Mailgun Dashboard. Point it to https://your-api-url/api/v1/webhooks/mailgun and enable the Bounced, Complained, and Failed event types.
Built-in pre-send verification that knows when not to trust an SMTP probe.
The CRM’s built-in email verifier runs syntax, MX, and SMTP checks on every contact you ask to verify. Results are scored 0–100 and cached for 30 days. The campaign enrollment modal automatically excludes contacts that score below 40, so bad addresses never enter your sending stream.
What makes the verifier production-grade is what it does when an SMTP probe gets blocked — not just rejected.
| Result | Score | Meaning | Auto-excluded? |
|---|---|---|---|
| Valid | 95 | SMTP probe confirmed the mailbox exists | No |
| Deliverable (catch-all) | 75 | Domain accepts everything; will not bounce but cannot prove mailbox exists | No |
| Deliverable (Gmail / M365) | 70 | Recognized accept-all provider; SMTP cannot verify mailbox existence here | No |
| Protected (likely valid) | 60 | Recipient is behind an anti-spam appliance (SpamExperts, Proofpoint, Mimecast, Barracuda, etc.) that policy-rejects probes | No |
| Unknown | 45–50 | SMTP probe inconclusive (temp failure, connection error, unexpected response) | No |
| Disposable | 10 | Domain is on the disposable email blocklist | Yes |
| Invalid | 10 | SMTP probe definitively rejected with 550–553 (no such mailbox) | Yes |
Many corporate inboxes — especially those hosted by managed-service providers, web hosts using Plesk/cPanel, or any business that fronts their mail with a security appliance — sit behind an anti-spam gateway. These gateways policy-reject SMTP RCPT TO probes from unknown senders regardless of whether the mailbox is valid. Naive verifiers interpret the rejection as “mailbox not found” and silently destroy the contact record.
The platform recognizes the MX patterns of major anti-spam appliances (SpamExperts, Proofpoint, Mimecast, Barracuda, AppRiver, Symantec MessageLabs) and skips the SMTP probe entirely for those domains. Score is set to 60 (Protected) so the contact stays in your CRM and remains eligible for campaigns.
A failed SMTP probe is not the same as a real bounce. The email_bounce_status field on a contact is only ever set by actual Mailgun delivery webhooks (real send attempts that the recipient’s server rejected). The verifier only writes email_verification_result and email_verification_score — it never auto-flags a contact as hard-bounced based on a probe.
If you do see a contact you know is valid showing an Invalid result (perhaps from an older version of the verifier, or because the recipient’s server briefly returned an unexpected response), use the Undo Verification button in the contact detail panel. It clears:
email_verification_cache so the next verify call doesn’t hand back the bad resultUndo Verification deliberately does not change the contact’s status (active / inactive / do_not_contact) or unsubscribe state — those are deliberate choices that may have been made independently and should be reviewed manually.
Auditable consent records for every contact.
Every CRM contact has built-in consent tracking fields to help you comply with GDPR and similar privacy regulations. The platform records when and how consent was given, making it easy to demonstrate compliance during an audit.
| Field | Description | Example Values |
|---|---|---|
| Consent Status | Current state of the contact's consent | granted, withdrawn, not_required, unknown |
| Consent Date | When consent was granted or withdrawn | 2026-03-15T14:30:00Z |
| Consent Source | How consent was obtained | web_form, import, manual, api |
| Consent IP | IP address at the time of consent (if captured) | 203.0.113.42 |
PATCH /contacts/:id/consentPATCH /contacts/:id/email-opt-outConsent is tracked for audit purposes. Whether to block email sends for contacts without explicit consent is an organization-level policy decision — the platform gives you the data and tools, and you decide how strictly to enforce it based on your jurisdiction and business requirements.
Automated email sequences that run on autopilot.
Drip campaigns let you set up a sequence of emails that are sent automatically on a schedule. Once you enroll a contact, the platform handles timing and delivery — the scheduler runs every 5 minutes and sends any emails that are due.
{{first_name}}, {{company_name}}, and {{unsubscribe_url}}. Templates can be plain text or HTML.If a contact unsubscribes, bounces, or is marked as do_not_contact, they are automatically removed from all active drip campaigns. You never have to manually clean your enrollment lists.
Write better emails that stay compliant.
Templates are the building blocks of your drip campaigns and one-off CRM emails. Following a few best practices ensures maximum deliverability and engagement.
{{unsubscribe_url}} for custom unsubscribe link placement (if omitted, the compliance footer adds it automatically){{first_name}} and {{company_name}} for better engagement{{first_name}}, {{last_name}}, {{email}}, {{company_name}}, {{phone}}, {{unsubscribe_url}} — these are replaced with real contact data at send time. If a variable has no value for a contact, it is replaced with an empty string.
Why a valid postal address is legally required in every commercial email.
The CAN-SPAM Act (United States) requires a valid physical postal address in every commercial email. This is not optional — it is federal law, and violations carry significant penalties.
| Accepted Format | Example |
|---|---|
| Street address | 123 Main Street, Suite 400, Austin, TX 78701 |
| PO Box | PO Box 4521, Austin, TX 78765 |
| Registered commercial mail receiving agency | PMB 218, 456 Oak Avenue, Austin, TX 78704 |
The FTC can impose fines of up to $50,120 per email that violates the CAN-SPAM Act. Kantivo enforces this requirement: CRM emails are blocked until a valid physical address is configured in Admin Portal → Settings → Email Compliance.
If you work from home, you can use a PO Box or a commercial mail receiving agency (like a UPS Store mailbox) instead of your home address. These are fully compliant alternatives.