Email list cleaning: how to sunset inactive subscribers

Why email list cleaning matters#

The mailbox providers ask for this. Google’s sender guidelines suggest unsubscribing recipients who don’t open or read your messages, and periodically asking whether they want to stay.^[1] Yahoo asks senders to watch inactive recipients alongside bounces, and to send them a reconfirmation email from time to time.^[3]

What happens to a list nobody cleans#

• Placement drops. Yahoo: “Sending email to users who are not reading them, or who report them as spam, will harm your delivery metrics and reputation.”^[3]
• Complaints rise. People who forgot signing up press “report spam”. Gmail and Yahoo publish a 0.3% ceiling, and Google asks you to stay under 0.1% (what counts).
• Mailboxes close. A Yahoo mailbox nobody signs in to for 12 months “stops receiving new emails”.^[4] Google may delete a personal Google Account after two years without activity.^[5] Mail to either then bounces.
• Abandoned addresses become traps. In a 2023 Spamhaus article written with Validity, “Recycled spamtraps are email addresses that were once valid but are now no longer used”, and it names “no sunset policy, poor bounce management” as signs of a list “in disrepair”.^[6] A spam trap reads nothing, so it looks exactly like an inactive subscriber.

What hitting traps costs#

The same article warns of “the threat of having your IP blocked if an email hits multiple traps, multiple times”.^[6] Spamhaus’s blocklists page links a Reputation Checker for domains and IPs.^[7] On a shared sending service the IP isn’t yours but your From domain is, so check the domain.

How to define an inactive subscriber#

No mailbox provider publishes a number of days after which a subscriber counts as inactive. The definition is yours, and it follows from two things: which signals you can trust, and how often you send.

Use signals a person has to cause#

1. Activity outside email: a purchase, a booking (online, by phone or in person), a login, a reply. A mail client cannot fake these, and a purchase outranks any click.
2. Clicks: a tracked click means a link was followed, usually by a person. The exceptions are below.
3. Opens: the weakest signal since 2021, for the reason in the next section. Use them only to break a tie.

Discount clicks a scanner made#

Company security filters follow links to test them. M3AAWG tells senders watching opens and clicks that “Large spikes may indicate security appliances giving your mail extra scrutiny.”^[8] Traps rarely click: Spamhaus says of the pristine traps used in abuse investigations, “And yes, there could likely be a click”, but that they are “a small percentage overall”.^[6] The user agent below is the name of the browser or app that made the click.

A scanner often sits in front of a real reader at a company, so never remove anyone because of one. Just don’t let a scanner’s click keep them on the active list.

On a list of mostly company addresses, a gateway’s click can keep a dead address active for years. There, send everyone through the re-engagement flow once a year unless they replied, logged in or bought in that time, and count only stay clicks that pass the checks above.

Count the window in sends, not days#

Twenty sends is about five months of a weekly list: longer than a holiday or a busy season, so a real reader who skips a few issues still acts inside it. Ten would catch people on a long break; forty would keep dead addresses for most of a year.

The numbers on this page are our defaults, not published standards. The windows round up, so weekly and twice-weekly readers get at least 20 sends; monthly lists stop at a year. Addresses with no activity for two years or more skip the re-engagement and are opted out straight away: the longer an address sits unused, the likelier it is closed or has become a recycled trap, and two years matches the UK regulator’s advice that, if in doubt, you “consider refreshing consent every two years”.^[9]

Why opens can’t tell you who is inactive#

In June 2021 Apple announced Mail Privacy Protection, which “helps users prevent senders from knowing when they open an email, and masks their IP address”.^[10] Apple’s privacy page explains how: Mail “downloads remote content in the background by default — regardless of whether you engage with the email”.^[11] An open pixel is remote content, so it fires whether or not the person ever looked.

Your own share may be far lower, on a business list for example, so check the mail clients in your own open data before you lean on it. A subscriber whose Apple Mail preloads every email “opens” everything and reads nothing, so an open-based rule keeps them for ever, and a rule like “no opens in 90 days” quietly exempts much of your list. When the feature shipped, Litmus wrote that any segmentation “based on the last open date are near useless” and that this is “especially critical for purging unengaged contacts.”^[13]

Can you spot a proxy open?#

Only roughly. A 2021 test on the iOS 15 beta found a bare “Mozilla/5.0” user agent and proxy addresses.^[14] Apple says its relay passes “a generalized identity to the destination”.^[11] Apple can change both, so an open never keeps anyone active on its own. Google’s guideline still says “open”, though the same page says “Google doesn’t track open rates”: it means a person reading, which your open data can no longer show.^[1]

Segment your list by engagement#

These windows suit a weekly list.

Gmail reports complaints only as totals per Feedback-ID, never by recipient,^[2] so your Complained segment won’t hold Gmail users who reported you; the sunset is what catches them. When to drop an address that keeps bouncing is in hard bounce vs soft bounce.

Run a re-engagement campaign before you sunset#

A re-engagement (or win-back) campaign asks the inactive segment one question: do you still want this? It is Google’s periodic confirmation.^[1]

• Make staying one click. The “keep me subscribed” link is the signal you act on, so it must be a tracked link, not a reply you read by hand. If you have a page of your own, point the link at a Confirm button and count the press: a scanner follows links but rarely submits a form. Give everyone a week after email 3 before you sunset.
• Say what is happening in the subject. “Should we keep emailing you?” beats a discount dressed up as news, and CAN-SPAM requires a subject line that reflects the content.^[15] The other legal rules are in the marketing email guide.
• Send it slowly. This is mail to your least engaged addresses, where traps hide. Send the most recently active first, a tenth of the segment a day, so a jump in bounces or complaints shows on one batch and you can stop before the rest. If one mailbox provider’s numbers jump and the others don’t, pause that provider’s share and check your placement there first.
• Keep any discount for the last email. An offer in every win-back teaches people to go quiet and wait for one.
• Run one win-back, not two. If your shop platform already sends one, switch one of them off, or the same person gets two “we miss you” emails.

Reading the result#

Expect little revenue: these people weren’t buying from your emails anyway. Judge the flow by how many click to stay. Say 2,000 enter it and 160 click (8%): drop clicks that fail the scanner checks, if your data shows them, keep the rest, and opt out everyone else. If a large share clicks, your window was probably too short, or earlier newsletters were landing in spam so they never saw them. Check placement at each mailbox provider before you lengthen the window: a re-engagement email that lands where the newsletter didn’t is telling you about delivery, not interest.

Sunset: stop mailing the ones who don’t respond#

Anyone who finishes the flow without a click leaves your marketing mail.

1. Opt them out of marketing. Remove them from the topics or lists your campaigns go to, or mark the contact unsubscribed. Not suppression, and not deletion:
2. Record why. Store the date and the reason (“sunset after re-engagement”), so a later import cannot quietly put them back.

How much it removes, and what changes#

There is no published figure for how much of a list a first sunset removes. Your number is the size of your Inactive and Dormant segments, so count them before you start. The first sunset is the big one; after that, a rule that runs all the time moves a few people at a time. Your open and click rates rise straight away, because the same clicks are divided by fewer people, so track total clicks or orders per send as well. To see the effect on placement, watch your Gmail spam rate in Postmaster Tools for a month either side.

Doing it in Rasket#

Rasket’s segments can’t filter on opens or clicks. A segment is a filter on contact fields, your own properties and topics, or a plain list you add people to.^[25] So pick the route by who does the work:

• No developer: by hand, twice a year. It works at any size; over a few thousand contacts, a tool whose segments filter on clicks directly is less work and the better choice.
• A developer on the team: the webhook route, which also drops scanner clicks.

By hand, twice a year (any tool)#

1. Check Click tracking is on on your sending domain’s page. It is set per domain, and a domain added through the API starts with it off.^[19]
2. Find who is active. Each campaign’s report lists who clicked; in Rasket it is the Clicked tab. Go through the last six months of campaigns.^[21] Export your contacts to a spreadsheet from the Audience page and mark those people, plus anyone who bought or booked from your own records.
3. Make a Re-engage list. Import the unmarked rows back, choosing to update existing contacts and add them to an empty segment called Re-engage.
4. Send the three emails as campaigns to Re-engage, a week apart.
5. Opt out who didn’t click. A week after email 3, check the Clicked tab of all three emails, and import the rest again with an unsubscribed column set to true.

Selling through a store#

The Shopify app is not in the Shopify App Store yet. Once it is, a connected store sends each order to Rasket as an event that updates the customer’s last order date, and a ready-made Win-back flow writes to customers 90 days after their last order.^[26]

With a developer#

Take the email.clicked webhook. Its click object carries timestamp, link and userAgent, and its email_id joins it to the email.delivered event, whose created_at is the delivery time (the casing is the payload’s own).^[22] That makes “seconds after delivery” a subtraction (we drop clicks under a minute) and “every link at once” a group-by. Verify the webhook signature, skip event ids you have seen, keep the later of the stored and new click times, and hold a click whose delivered event hasn’t arrived yet. Write each real click to the contact, with logins and orders from your own app, and have a nightly job set lapsed, so the segment filters on lapsed and never needs editing.

curl -X PATCH "https://api.rasket.com/contacts/reader%2Bnews@example.com" \
  -H "Authorization: Bearer $RASKET_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"properties": {"last_click_at": "2026-10-17T09:30:00Z", "lapsed": false}}'

The request is the contacts API’s update call, which accepts an email address in place of the contact id.^[23]

In Rasket an unsubscribed contact gets no campaign while your app’s email still goes,^[23] a hand-added suppression blocks every email,^[20] and neither counts toward your plan’s contacts.^[24]

Opt-out records vs deletion, and GDPR erasure#

The UK Information Commissioner’s Office (ICO) says the right to object to direct marketing “is an absolute right”, but it “does not automatically mean that you need to erase the individual’s personal data”, and in most cases it is “preferable to suppress their details.”^[16] Suppression means “keeping just enough information about someone to ensure you respect their preferences in the future, so you must not keep more than you need”.^[17]

An erasure request needs an answer “without undue delay and at the latest within one month”.^[18] The suppression list is the exception: “Because we don’t consider that a suppression list is used for direct marketing purposes, there is no automatic right for people to have their information on such a list deleted.”^[17] So delete the profile and history, keep only the address on the suppression list, and tell the person what you kept and why. The ICO writes for UK law; check the regulator where your subscribers live.