The cold email engine that hit green on every check and broke the law anyway

The problem

The weekly deliverability monitor for my lead-generation system checked SPF, DKIM and DMARC, scanned blocklists, and tracked the bounce rate, returning a GREEN, YELLOW or RED verdict. It never checked whether the email itself gave the recipient a way to say stop.

CAN-SPAM and CASL both require a working opt-out and a physical postal address in every commercial email. Nothing in the send path put either into a message before it went out, and nothing would have stopped a send if they were missing.

What it cost

Fifty-nine real people got a cold email from me over eleven days with no opt-out line and no postal address in it. That is the entire claim — no regulatory contact, no complaint that I know of. But no one complaining is not the same as being compliant, and at the time I had no way to tell which one was true.

What I did

On 13 September 2026, the same day I found the gap, I moved the requirement into the onboarding contract instead of a template. Client onboarding now collects a postal address and writes only the name of the .env variable holding it. The validation script fails a client config without that variable set, and the send skill checks it before drafting or sending anything: no address, no email, LinkedIn drafts only.

Every email now ends with a compliance footer, verified in the pre-send checklist before anything goes out.

The idea worth stealing

The obvious fix is a footer pasted into a template. That covers the next email, not the next client, because the requirement still lives only in someone's memory. The actual fix made the send path refuse to run without the one fact that makes sending legal.

A dashboard that reads GREEN on deliverability was never built to tell you whether you're allowed to send. Measure the thing that actually matters, not the thing that's easy to measure.