Smart List Building for Email Marketing: A Canadian Guide

There is a piece of email marketing advice that appears in almost every list-building guide on the internet, and in Canada it is illegal.

The advice is to email people to ask whether they would like to hear from you. Send a friendly note to the contacts in your address book, the business cards in your desk drawer, the addresses from that trade show, and invite them to subscribe. It sounds courteous. It sounds like the responsible alternative to just adding them.

Under Canada's Anti-Spam Legislation, a message asking for consent to send commercial messages is itself a commercial electronic message. The CRTC states this directly in its guidance: a message containing a request for express consent is a CEM under CASL, and therefore is not a method through which express consent can be obtained. You need consent before you can ask for consent. The permission email is the violation.

This is the single clearest illustration of why most list-building content is unsafe reading for a Canadian business. The overwhelming majority of it is written against the American CAN-SPAM Act, which is an opt-out regime: you may email people until they ask you to stop. CASL is an opt-in regime: you may not email people until they have agreed. Those are not two versions of the same rule with different paperwork. They are opposites, and a tactic that is entirely lawful in Illinois can carry a penalty of up to ten million dollars in Canada.

The second thing most list-building advice ignores is that having a list and being able to reach it are now separate problems. Since February 2024 for Google and Yahoo, and May 2025 for Microsoft, the major mailbox providers have enforced technical authentication requirements on bulk senders. Fail them and your messages are rejected at the SMTP level. Not filtered into a spam folder where a diligent subscriber might find them. Rejected. The mail never arrives in any form.

So this article covers list building as it actually works for a Canadian small business in 2026: what consent legally requires, what records you need to prove it, which acquisition tactics are both lawful and effective here, and what has to be true of your infrastructure for any of it to reach an inbox. Some of that last part lives in DNS records managed at your web host, which is not where this conversation usually goes but is where a surprising amount of email marketing succeeds or fails.

Why most list-building advice does not apply in Canada

The gap between the two regimes is worth laying out properly, because a lot of Canadian businesses are following American playbooks without realising the foundation is different.

	CASL (Canada)	CAN-SPAM (United States)
Default position	Consent required before sending	Sending permitted until the recipient opts out
Consent model	Opt-in (express or narrow implied)	Opt-out
Burden of proof	On the sender, who must prove consent	On the complainant, broadly
B2B messages	Fully covered; work addresses are not exempt	Covered, but with a lighter practical burden
Purchased or rented lists	Cannot satisfy the consent requirement	Not prohibited outright
Unsubscribe deadline	Within 10 business days	Within 10 business days
Maximum penalties	Up to $1M (individual) / $10M (business) per violation	Statutory penalties per message, generally lower
Applies to foreign senders	Yes, if the recipient is in Canada	Yes, if the recipient is in the US

CASL came into force on 1 July 2014. It is enforced primarily by the CRTC, with the Competition Bureau and the Office of the Privacy Commissioner also holding responsibilities. It applies based on where the recipient is, not where the sender is, so a business in Toronto and a business in Texas face the same obligations when mailing a Canadian.

One point of relief worth knowing: CASL originally included a private right of action that would have let individuals sue for violations, with statutory damages, and it was widely expected to produce class actions. It was scheduled to come into force on 1 July 2017 and was suspended indefinitely by Order in Council days beforehand, following concerns from businesses, charities, and the non-profit sector. That suspension has held. It reduces your exposure meaningfully, but it does not change your obligations, and CRTC enforcement has continued throughout.

CASL, explained properly

This section is the foundation for everything that follows. It is worth reading carefully once rather than skimming.

What counts as a commercial electronic message

A CEM is any electronic message that encourages participation in commercial activity. That is a wide definition and deliberately so. It captures newsletters with a product mention, promotional offers, event invitations, "we've launched something new" announcements, and most of what a small business would think of as marketing. It covers email, text messages, and messages sent through social platforms.

It does not capture messages that are purely transactional or relationship-based: an order confirmation, a shipping notice, a warranty update, a response to a direct inquiry, an invoice. These are exempt from the consent requirement, though some still carry identification obligations. The dividing line is whether the message is encouraging commercial activity or servicing an existing one.

The practical trap is the hybrid. A shipping confirmation with a "you might also like" product block at the bottom has stopped being purely transactional. Keep your transactional mail clean if you want to rely on the exemption.

Express consent means the person clearly agreed to receive commercial messages from you, either in writing or orally. The defining characteristic is that the recipient took a proactive action to indicate it. In practice this means an opt-in mechanism: they ticked an unchecked box, they filled in a subscription form, they said yes.

Express consent does not expire. It lasts until the person withdraws it.

What does not qualify:

A pre-checked box. The action must be the recipient's. A box they had to untick to decline is not a proactive action.
Consent bundled into terms and conditions. Agreeing to your terms in order to buy something is not the same as agreeing to receive marketing. Consent to receive CEMs must be sought separately and be separately refusable.
Consent inferred from a business card. Someone handing you a card has not opted in. It may, in narrow circumstances, support implied consent, which is a different and weaker basis.
Consent obtained by email. As covered above, the request is itself a CEM.
Vague consent. The request has to identify who is asking, what they are asking to send, and how the person can unsubscribe later. "Sign up for updates" with no further information is thin.

A compliant request for express consent needs to state, clearly: the purpose for which consent is sought, the name of the person or business seeking it (and on whose behalf, if different), a mailing address plus one other contact method, and a statement that consent can be withdrawn.

Implied consent exists, but it is far more limited than most people assume and almost all of it expires. The main bases:

An existing business relationship. The person purchased from you, entered into a written contract with you, or made a similar commercial arrangement, within the two years before the message is sent. The clock runs from the most recent qualifying transaction, so ongoing activity keeps it alive.
An inquiry. The person made an inquiry or application to you within the six months before the message. Note the asymmetry: an inquiry buys you six months, a purchase buys you two years.
An existing non-business relationship, such as membership of a club or association, or a donation to a registered charity or political party, within the same kind of window.
Conspicuous publication. The person's address is published conspicuously, without a statement that they do not want unsolicited commercial messages, and your message is relevant to their role or business. This is the basis people stretch furthest, and it requires genuine relevance to their professional function.
Disclosure by the recipient. They gave you the address directly without indicating they did not want messages, and again the message must be relevant to their role.

Implied consent is a defensible basis when it genuinely applies. It is a poor foundation for a list, because it decays. A list built on implied consent shrinks every day whether you notice or not, and there is no lawful way to email the expiring contacts to ask them to re-subscribe.

Identification and unsubscribe

Every CEM must identify the sender: the name of the person or business sending it, the name of anyone it is sent on behalf of if different, a mailing address, and either a phone number, email address, or web address. The contact information must remain valid for at least 60 days after the message is sent.

Every CEM must also carry an unsubscribe mechanism. The CRTC's requirement is that it be "readily performed" — accessible without difficulty or delay, simple, quick, and free to use. A link to a page where the recipient can unsubscribe is the standard compliant approach. The mechanism must remain operational for at least 60 days, and unsubscribe requests must be actioned within 10 business days.

There is a wrinkle worth flagging here that catches Canadian senders out. CASL gives you ten business days. Google and Yahoo, as a condition of bulk delivery, expect opt-outs to be honoured within roughly two days. The platform requirement is stricter than the law. If you are configuring your process to the legal minimum, you are configuring it to fail the deliverability requirement.

The burden of proof sits on you

This is the operational heart of CASL and the part most under-served in general guidance.

If the CRTC asks whether you had consent to send a message, you have to prove that you did. The recipient does not have to prove they did not consent. There is no presumption in your favour. The CRTC has issued guidance, in Information Bulletin CRTC 2012-548, on what a request for consent should contain and on tracking and recording consent in ways that make it easier to prove.

Which means your consent records are not administrative housekeeping. They are your defence. A list of email addresses with no accompanying evidence of how each one was obtained is, from an enforcement perspective, a list you cannot lawfully mail.

Penalties and enforcement

Administrative monetary penalties run up to $1 million for an individual and $10 million for a business, per violation. Officers and directors can be personally liable.

Actual enforcement has been more modest than those ceilings suggest, but it is real and it is not confined to obvious spammers. Published CRTC actions include a notice of violation carrying a $1.1 million proposed penalty for consent failures combined with a non-functioning unsubscribe mechanism, later settled at $200,000; a $75,000 penalty against an individual who sent over 670,000 emails without consent; and penalties against advertising companies for facilitating violations by their own customers. Total enforcement has exceeded $1.75 million.

Two patterns are worth noticing in that record. First, a broken unsubscribe link is treated as a violation in its own right, not a technicality. Second, liability can attach to a business for what a partner or agency does on its behalf. If you outsource email to a digital marketing agency in Canada or anywhere else, their compliance failures are your exposure. Check what your contract says about it.

The single most useful CASL habit

If you take one operational thing from this section: capture the evidence at the moment of consent, automatically, and never rely on reconstructing it later.

For every subscriber, store:

The email address, obviously.
A timestamp of when consent was given.
The exact wording that was displayed to them when they consented. Not a description of it — the actual text. This matters because your form copy changes over time and you need to know what a given person agreed to.
The URL or physical location where consent was collected.
The method — web form, in person, verbally, at point of sale.
The IP address for online signups.
The double opt-in confirmation timestamp, if you use one.
The consent basis — express, or which implied category and when its clock started.

Most reputable email platforms capture some of this. Very few capture the exact wording shown, and almost none do it automatically when you edit a form. Version your form copy and keep a record of which version was live when. It is ten minutes of setup and it is the difference between having a defence and having a spreadsheet.

Keep these records for as long as you have a relationship with the person, and for a reasonable period after. CASL sets no explicit minimum retention period, so the practical standard is to keep them as long as you might need to rely on them.

List-building tactics that are lawful and effective in Canada

With the legal frame established, here is what actually works. Everything below is compatible with express consent properly obtained.

On-site capture, done with some thought

Your website is the highest-quality acquisition channel you have, because someone typing their address into your form is performing exactly the proactive action CASL requires, and you control the wording.

What matters:

Placement over volume. A single well-placed form on a page with relevant intent outperforms five forms scattered everywhere. Good positions: the end of a genuinely useful article, a resources or guides page, a pricing page for people not ready to buy, and a footer for the people who go looking.
Field count. Email alone converts best. Every additional field costs you subscribers. First name is usually worth the cost because it enables personalisation. Phone number, company size, and job title are usually not, unless you have a specific segmentation plan that will actually be used.
Honest expectations. State what you will send and how often, and then do that. "A monthly note on Canadian hosting and site performance" sets a contract. "Sign up for updates" sets nothing, and vague expectations produce spam complaints later, which is a deliverability problem as well as a courtesy problem.
Exit-intent and scroll-triggered popups work, and are not inherently non-compliant, but they need the same clear wording and unchecked consent as anything else. A popup that captures an address through a pre-checked box has captured nothing usable.

Double opt-in: not required, but do it anyway

CASL does not require double opt-in. Single opt-in with proper records can constitute valid express consent.

Use double opt-in regardless, for three reasons that have nothing to do with the letter of the law:

It produces stronger evidence. A confirmed click from the recipient's own inbox is far better proof than a form submission alone, and it demonstrates the address genuinely belongs to the person who submitted it.
It protects you from malicious and mistyped signups. Someone entering a competitor's address, or a typo landing on a spam trap, is a real deliverability risk. Confirmation filters both.
It substantially improves engagement metrics, which is now a delivery factor. A smaller confirmed list outperforms a larger unconfirmed one at the inbox.

The confirmation email is worth a note. It is a transactional message confirming a request the person just made, not a promotional one, and it should be kept clean of marketing content so it stays that way.

Point of sale and in person

For businesses with a physical location or face-to-face contact, this is often the most underused channel.

Ask directly. A staff member asking whether someone would like the monthly offers email, and typing the address in themselves, produces high-quality consent. Record who collected it and when.
Paper signup forms work if the wording on the form meets the express consent requirements. Keep the physical forms, or scan them. That paper is your record.
Tablet or POS capture is cleaner because it timestamps automatically. Make sure the consent wording is on screen, not just in a staff member's verbal description.
Do not auto-add customers to marketing because they bought something. A purchase gives you implied consent for two years, which is a lawful basis for relevant commercial messages, but it is not express consent and it expires. Ask at the counter and convert it into something durable.

Events, trade shows, and business cards

This is where well-intentioned businesses most often go wrong.

Someone handing you a business card has not given express consent. Depending on circumstances it may support implied consent, and if their address is conspicuously published without a no-unsolicited-messages statement and your message is relevant to their role, that is a defensible basis. But it is narrow, and it is not a licence to add them to a general newsletter.

The clean approach at an event: have a signup sheet or tablet with proper consent wording, separate from your card collection. Ask people who want your emails to sign up for your emails. Two piles: contacts you may follow up with individually, and subscribers who have opted in.

And to be explicit about the tempting shortcut: you may not email the card pile to ask if they want to subscribe.

Gated content, webinars, and lead magnets

Offering something valuable in exchange for an address is legitimate and effective, provided the consent to receive ongoing marketing is separate from the download itself.

The distinction is worth getting right. Someone giving you their address to receive a checklist has consented to receive that checklist. Whether they have consented to your ongoing newsletter depends on whether you asked, separately and clearly, and whether they agreed. A single unchecked box beneath the download form — "also send me the monthly newsletter" — resolves it cleanly. Bundling the two, so that downloading automatically subscribes them, does not.

Lead magnets that actually work for Canadian small businesses tend to be specific and immediately useful rather than broad:

Business type	Lead magnet that earns an address
Trades and home services	Seasonal maintenance checklist specific to the local climate — a Prairie winter checklist is not an Ontario one
Professional services	A plain-language explainer of a process clients find opaque, with realistic timelines and costs
Retail and e-commerce	First-order discount, or a sizing and fit guide that reduces returns
Restaurants and hospitality	Advance access to seasonal menus or event bookings, which is genuinely scarce and therefore valuable
B2B and SaaS	A template, calculator, or benchmark document the buyer can use in their own internal argument
Nonprofits	An impact report or a briefing on the issue, not a donation ask dressed as content

The test for a lead magnet is whether someone would pay a small amount for it. If not, it will collect addresses from people who do not want your emails, which harms your engagement metrics and therefore your delivery.

Referrals

CASL includes a narrow exemption for third-party referrals: in limited circumstances, someone with an existing relationship with you can refer a contact, and you may send a single message on the strength of it. The conditions are specific, the message must disclose the referral and identify who made it, and it permits one message only.

Treat it as a genuinely narrow provision rather than a growth channel. It exists to permit a normal business courtesy, not to enable a referral engine.

What not to do, plainly

Do not buy or rent lists. A purchased list cannot satisfy CASL's consent requirement, because the consent was not given to you. It also destroys your sender reputation, because purchased lists are full of dead addresses and spam traps. There is no version of this that works.
Do not scrape addresses from websites or LinkedIn. Conspicuous publication is a much narrower basis than "the address was findable."
Do not use email appending services, which take a name and produce a probable address. No consent, no relationship, and frequently wrong.
Do not pre-check consent boxes.
Do not bundle marketing consent into your terms of service or checkout flow.
Do not re-import a list you previously cleaned. Those addresses were removed for a reason, and re-adding an unsubscribed contact is a violation.
Do not assume B2B is exempt. It is not. Work addresses are covered.

Form design, briefly

Conversion and compliance point the same direction here, which is convenient.

A form that converts well is short, clearly labelled, states what will happen, and asks for consent unambiguously. A form that is compliant is short enough that the consent language is actually read, clearly labelled so the person knows what they are agreeing to, and asks for consent unambiguously. The same form satisfies both.

Two practical notes:

Serve your forms over HTTPS. A signup form on a plain HTTP page is collecting personal information over an unencrypted connection, browsers will flag it, and it is a poor look for a business asking to be trusted with data. If HTTPS is only partially enforced across your site, an SSL certificate with proper server-level redirection resolves it quickly.

Test the whole path, not just the form. The form submits, the confirmation email arrives, the confirmation link works, the subscriber lands in the right list with the right tags, and the welcome sequence fires. Broken confirmation emails are common and silent — the subscriber assumes it did not work and you assume they never finished.

This is the failure mode nobody writes about, and it is responsible for a great many lists that are non-compliant without anyone having done anything wrong.

Most small businesses do not have one source of subscribers. They have a website form, an e-commerce platform, a booking system, a point-of-sale system, a CRM, and possibly a contact form that dumps to a shared inbox. Several of those sync to the email platform, often through a connector nobody has looked at since it was set up.

The problem is that consent metadata rarely survives the journey. A subscriber who opted in through a properly worded form on your website arrives in your email platform as an email address and a first name. The timestamp is the sync time, not the consent time. The form URL is gone. The wording they agreed to was never transmitted. The consent basis is unrecorded, so an express-consent subscriber is now indistinguishable from a customer auto-added by the e-commerce connector under implied consent.

You have not lost the consent. You have lost the ability to prove it, which under CASL amounts to much the same thing.

Worse, integrations frequently add people nobody intended to add. A common pattern: an e-commerce connector configured to sync all customers to the main marketing list, because that was the default when someone installed it. Every purchaser is now receiving marketing whether they asked or not. That is implied consent at best, expiring at two years, being treated as a permanent subscription.

What to do about it:

Map every path into your list. Write down each source, what triggers the addition, and which list or tag it lands in. Most businesses discover at least one path they had forgotten about.
Check the default behaviour of every connector. Specifically, whether it adds contacts to a marketing list automatically and whether it respects an opt-in field.
Pass consent metadata through as custom fields. Most platforms allow it; most integrations do not do it unless configured. At minimum: consent timestamp, source, and basis.
Enforce suppression globally. An unsubscribe in one list must suppress across all of them, including anyone added later by an integration. This is where re-adding an unsubscribed contact usually happens, and it is a violation regardless of intent.
Audit the contact form path. A contact form is an inquiry, which gives you six months of implied consent for relevant messages. It is not a newsletter signup. If your form pipes submissions into your marketing list, that is a problem.

The broader point: consent is a property of a moment, and moments are what integrations are worst at preserving. Any process that moves subscribers between systems needs to carry the evidence with them, or the evidence effectively ceases to exist.

The welcome sequence, which is where the list starts paying

List building is usually discussed as though the work ends at the signup. It does not. The highest-return thing you build after the form is the sequence that runs immediately afterwards, for a reason that is partly commercial and partly technical.

Commercially, the moment of subscription is the point of peak interest. Someone has just decided they want to hear from you. If the next thing they receive is silence until your next monthly newsletter three weeks later, that interest has decayed and they may not remember signing up — which, when your newsletter eventually lands, produces a spam complaint rather than a read.

Technically, early engagement is what establishes your relationship with the mailbox provider for that recipient. A subscriber who opens and clicks in their first few days teaches Gmail that your mail is wanted. One who never engages teaches it the opposite, and that signal is difficult to reverse later.

A workable structure for a small business:

Immediately: deliver what was promised. The checklist, the discount code, the guide. If they signed up for a lead magnet and it does not arrive within seconds, you have created a support problem and a trust problem simultaneously.
Day one or two: set the expectation you stated on the form. Confirm what you will send and how often. Introduce who you are in a sentence or two, not a company history.
Day four or five: send something useful with no ask attached. This is the message that establishes whether the subscription was worth making.
Around day seven to ten: make a relevant, proportionate offer. By this point you have earned the right to ask for something.

Two things to avoid. Do not front-load the sequence with sales messages, because the complaint rate on an aggressive welcome series is high and complaints are now a delivery input rather than merely a courtesy metric. And do not let the sequence run without ever ending — a welcome sequence has a defined length, after which the subscriber joins your regular cadence.

Deliverability: the part that decides whether any of this matters

You can build a perfectly consented list and still reach nobody. This section is the technical half of list building, and it has changed more in the last two years than in the previous ten.

What changed, and when

Google and Yahoo announced coordinated requirements for bulk senders in October 2023, with enforcement beginning February 2024. Microsoft followed for Outlook, with enforcement from May 2025.

The requirements themselves are not exotic. What changed is the consequence of failing them. Messages that fail the authentication requirements are rejected at the SMTP level — Google returns 550-series errors, Microsoft returns 550 5.7.515 — rather than being delivered to a spam folder. The message does not arrive anywhere. Your subscriber does not have the option of finding it in junk.

The requirements, as they actually stand

For every sender, regardless of volume:

SPF (Sender Policy Framework), a DNS record listing which servers are authorised to send mail for your domain.
DKIM (DomainKeys Identified Mail), a cryptographic signature on outgoing mail that proves it came from an authorised sender and was not altered in transit.
Valid forward and reverse DNS, meaning your sending IP resolves to a hostname and that hostname resolves back to the IP. Missing reverse DNS, or a PTR record, is a common and quietly fatal problem.
Valid MX records for the domain.
TLS for the connection.

Additionally, for bulk senders, defined as anyone sending 5,000 or more messages a day to that provider's users:

DMARC (Domain-based Message Authentication, Reporting and Conformance), published as a DNS record. A policy of p=none is the accepted minimum.
Domain alignment, meaning DMARC passes through either SPF or DKIM aligned with the visible From address.
One-click unsubscribe implemented per RFC 8058, using the List-Unsubscribe and List-Unsubscribe-Post headers, alongside a visible unsubscribe link in the message body. This applies to marketing mail, not to transactional messages.
A spam complaint rate below 0.10% as reported in Google Postmaster Tools, and never reaching 0.30%.

Three details that catch people out:

The bulk classification does not reverse. Once a domain crosses 5,000 messages a day to Gmail, it is classified as a bulk sender, and Google's classification persists even if volume subsequently drops. You do not get to stop meeting the requirements because you had a quiet quarter.

Yahoo's complaint-rate calculation is stricter than Google's. Google measures complaints against total delivered messages. Yahoo measures against inbox-delivered messages only, excluding those that landed in spam. If a portion of your mail is already going to spam, Yahoo's denominator is smaller and your effective complaint rate is higher for the same number of complaints.

`p=none` is a floor, not a destination. A DMARC policy of p=none satisfies the requirement but only monitors — it does not stop anyone spoofing your domain. Once your legitimate mail is passing cleanly, move to p=quarantine and then p=reject. Do this in stages, watching your DMARC reports, because moving straight to reject with a misconfigured SPF or DKIM will silently destroy your own delivery.

Where these records actually live

This is the part that connects list building back to your hosting, and it is the reason so many small businesses have authentication problems without knowing it.

SPF, DKIM, and DMARC are all DNS records for your domain, managed wherever your DNS is hosted, which for most small businesses is their web host or registrar. They are not settings inside your email marketing platform, although the platform tells you what values to publish. Someone has to actually add them to DNS, and if nobody owned that step, they were never added.

Reverse DNS is set on the sending IP address, which means it is controlled by whoever operates that server. On shared hosting you generally cannot set it yourself; on a VPS or dedicated server you can, or your provider can set it for you.

The practical audit, then:

Requirement	Who it applies to	How to check	Where it is configured
SPF	All senders	Query the TXT record for your domain; confirm one SPF record only, and that it includes every service that sends as you	DNS, at your host or registrar
DKIM	All senders	Check the selector TXT record your provider specifies; send a test to a Gmail address and inspect the headers	DNS, using values from your email platform
DMARC	Bulk senders; recommended for all	Query the TXT record at _dmarc.yourdomain.ca	DNS
Alignment	Bulk senders	Read your DMARC aggregate reports, or inspect a test message's authentication results	Depends which of SPF/DKIM you align
Reverse DNS (PTR)	All senders	Reverse-lookup your sending IP and confirm it resolves to a hostname that resolves back	Server or hosting provider; you cannot usually set this on shared hosting
MX records	All domains	Query MX for your domain	DNS
One-click unsubscribe	Bulk marketing mail	Inspect message headers for List-Unsubscribe-Post	Email marketing platform
Spam complaint rate	Bulk senders	Google Postmaster Tools; Microsoft SNDS; Yahoo's Complaint Feedback Loop	Not configurable — it is an outcome

A very common failure worth checking specifically: multiple SPF records. A domain may only have one. Businesses that have added a new email service over the years, each time publishing the SPF record its documentation supplied, frequently end up with two or three. The result is an SPF permanent error, which fails authentication as surely as having none. The fix is merging them into a single record with all the necessary include: statements.

Do not send bulk marketing through your web hosting mail server

This deserves stating plainly, because it is a tempting shortcut and it goes badly.

Your hosting account almost certainly includes email. It is genuinely useful for your domain mailboxes and for transactional messages from your site. It is the wrong tool for sending a marketing campaign to a few thousand subscribers, for reasons that are structural rather than a matter of provider quality:

Shared IP reputation. On shared hosting your mail leaves from an IP shared with other accounts. Their sending behaviour affects your delivery, and yours affects theirs. Neither of you controls the outcome.
Rate limits. Hosting providers cap outbound mail per hour to prevent abuse. A campaign that exceeds the cap gets throttled or queued, arriving in fragments over many hours, which itself looks like spam behaviour.
No feedback loops. You cannot see your Yahoo complaint data or your Gmail postmaster metrics for mail sent through a shared host's infrastructure in the way you can through a dedicated sending service.
No warming, no segmentation, no suppression management. The compliance and hygiene tooling that keeps a list healthy simply is not there.
A single bad campaign affects everything. If your marketing send damages the reputation of the IP, your order confirmations and password resets stop arriving too.

The sensible split for a small business:

Marketing mail goes through a dedicated email service provider, ideally on a subdomain used only for sending (mail.yourdomain.ca or similar), so that any reputation damage is contained and does not affect your primary domain's mail.

Domain mailboxes and transactional mail stay with your hosting, with SPF, DKIM, and DMARC properly published, which is where business email hosting on Canadian servers does its job well. For sites with higher transactional volume, or where you need control over reverse DNS and outbound configuration, VPS hosting with dedicated resources gives you the isolation that shared environments cannot.

Getting this split right also removes the most common cause of "our emails stopped arriving" — a marketing send that poisoned the well for everything else.

IP and domain warming

If you are starting to send from a new domain or subdomain, ramp up gradually. Mailbox providers assess new sending sources cautiously, and a domain with no history that suddenly sends ten thousand messages looks exactly like a compromised account.

A reasonable pattern is to begin with a few hundred messages a day to your most engaged subscribers, roughly double every few days while watching bounce and complaint rates, and hold or back off if either rises. Starting with your most engaged contacts is not just cautious — the positive engagement signals from people who genuinely want your mail are what build the reputation that carries the rest.

List hygiene, and the point where law and deliverability converge

Hygiene is the least glamorous part of list building and the one that most determines whether a list keeps working. It is also where CASL and deliverability turn out to want the same thing, which is unusual and useful.

Bounce handling

Hard bounces mean the address does not exist. Remove them immediately, after one occurrence. Continuing to send to non-existent addresses is one of the clearest negative signals you can produce, and it suggests to a mailbox provider that you did not obtain the address from the person who owns it.

Soft bounces are temporary: a full mailbox, a server problem, a greylisting delay. Retry, but set a threshold. Three to five consecutive soft bounces should move an address to suppression.

Most email platforms handle this automatically. Verify that yours does, and that suppression is actually enforced rather than merely recorded.

Sunsetting inactive subscribers

Removing people who never open your email feels like throwing away assets. It is the opposite.

Mailbox providers weight engagement heavily. A list where a large proportion of recipients never open anything drags down delivery for the recipients who do. Cutting a disengaged segment routinely improves inbox placement for the rest, which means your active subscribers hear from you more reliably.

A workable sunset policy: after roughly six months with no opens or clicks, move the subscriber to a low-frequency segment. After twelve months of continued silence, suppress them.

The re-engagement trap

Here is a genuine legal trap that general email marketing advice will walk you straight into.

The standard advice for a disengaged subscriber is to send a re-engagement campaign: "we've noticed you haven't opened our emails, would you like to stay subscribed?"

If that person's consent was express, this is fine. Express consent does not expire, they have not withdrawn it, and a re-engagement message is a CEM you are permitted to send.

If that person was on your list under implied consent and the clock has run out, it is not fine. Their two years from purchase, or six months from inquiry, have elapsed. You no longer have a basis to send them a commercial message, and a re-engagement email is a commercial message. The message asking them to re-confirm is itself the violation, for exactly the same reason the permission email discussed at the start of this article is.

This is why the consent basis needs to be a stored field on every subscriber record and not something you infer later. Your re-engagement automation needs to be able to distinguish between the two groups, and it can only do that if the data is there.

Where the two disciplines align

Notice what has happened across this section. CASL's implied consent clocks say: stop mailing this person after two years of no qualifying activity. Deliverability best practice says: stop mailing this person after twelve months of no engagement.

Both are telling you to remove the same people. If you build a hygiene process around the stricter of the two triggers, you satisfy the legal requirement and improve your inbox placement with one mechanism. That is a rare piece of genuine alignment, and it is the reason a properly maintained Canadian list often outperforms a larger, looser one.

Suppression lists are permanent

When someone unsubscribes, their address goes on a suppression list and stays there. Not deleted — suppressed. If you delete the record, nothing stops the address being re-added later through an import or an integration, and mailing an unsubscribed contact is a violation.

Keep the suppression list, keep it enforced across every list and every integration, and never make an exception for a "special announcement."

Privacy: PIPEDA, and Quebec

Your subscriber list is a database of personal information, which brings it under Canadian privacy law separately from CASL. The two regimes overlap but are not the same, and consent to receive email is not the same thing as consent to collect and use personal information.

PIPEDA governs how private-sector organisations collect, use, and disclose personal information in commercial activity, where a substantially similar provincial law does not apply. In practice for a list:

Purpose limitation. Collect for a stated purpose and use it for that purpose. If you collected addresses for a newsletter and then use them for a different programme, or share them with a partner, that is a new purpose requiring fresh consideration.
Have a privacy policy that actually describes what you do with subscriber data, and link to it from your signup form.
Retention limits. Do not keep personal information longer than necessary for the purpose. This sits in slight tension with CASL's requirement to keep consent records, and the resolution is to keep the consent evidence you need while not retaining unnecessary profile data indefinitely.
A subscriber can ask what personal information you hold about them, and you must be able to answer.
Protect it appropriately. A list stored in an unsecured spreadsheet on a laptop is a safeguards problem.

Quebec's Law 25 applies if you have subscribers in Quebec and imposes additional obligations, including designating a person responsible for privacy, mandatory confidentiality-incident reporting, privacy impact assessments in certain circumstances, and a right to data portability. Its consent standards are stricter than PIPEDA's in several respects. If you have a meaningful Quebec subscriber base, this deserves specific attention rather than being folded into a general PIPEDA approach.

Where your list physically lives matters for two reasons. Cross-border transfer for processing is permitted under PIPEDA, but it requires transparency, and you remain accountable for information transferred to a third party for processing. Separately, for businesses serving Canadian healthcare, legal, financial, education, or public-sector clients, data residency is frequently a procurement requirement rather than a preference. Keeping subscriber data and site data on Canadian infrastructure — for 4GoodHosting, that means Canadian data centres in Vancouver and Toronto — removes a question from those conversations before it is asked.

Six Canadian businesses, and what list building actually looks like

Generic advice fails because the right approach varies enormously. Six realistic scenarios.

A restaurant in Vancouver

Where the list comes from: the counter and the reservation system, overwhelmingly. Website signups are a minor channel for a restaurant.

What works: advance access to seasonal menus, event bookings, and holiday sittings — genuinely scarce things people want to be told about first. A tablet at the point of sale with clear consent wording, and staff who actually ask.

The trap: auto-adding everyone who books a table. A reservation creates implied consent for two years, which is a lawful basis for relevant messages, but converting it to express consent at the point of booking is a two-second addition to the confirmation flow and gives you something that does not expire.

A plumbing company in Calgary

Where the list comes from: completed jobs, and a seasonal maintenance checklist on the website.

What works: genuinely local seasonal content. A pre-freeze checklist in October for Calgary is useful in a way that generic advice is not, and it earns an address because it will actually be used.

Deliverability note: low volume, well below the 5,000-a-day bulk threshold, so the additional bulk requirements do not apply. SPF, DKIM, reverse DNS, and TLS still do. This is the business type most likely to have never published a DKIM record and to be quietly losing a portion of its mail.

An accounting firm in Toronto

Where the list comes from: client relationships and content downloads.

What works: plain-language explainers on deadlines and changes, which have a natural annual rhythm and high open rates because they are genuinely time-sensitive.

The compliance point: professional services accumulate a lot of implied consent from inquiries, and the six-month clock on an inquiry is short. Prospects who asked about services in the spring cannot be mailed in the winter without express consent. Ask for it during the enquiry, not afterwards.

An online store shipping across Canada

Where the list comes from: checkout, and a first-order discount.

What works: the discount is effective, but the consent has to be unbundled from the purchase. A separate unchecked box at checkout.

Deliverability note: this is the business type most likely to cross the bulk sender threshold, and most likely to be conflating marketing and transactional mail. Order confirmations and abandoned-cart sequences are different categories with different rules. Keep the sending infrastructure separated so that a promotional campaign cannot take down your order confirmations.

A B2B software company

Where the list comes from: gated content, webinars, and trials.

What works: templates, calculators, and benchmark documents — material a buyer can take into an internal conversation.

The compliance point: the assumption that B2B is exempt is common and wrong. Work addresses are fully covered by CASL. Conspicuous publication is narrower than "we found it on their website." A trial signup is an inquiry, and the clock is six months.

A registered charity in Halifax

Where the list comes from: donors, volunteers, and event attendees.

The distinctive point: CASL contains an exemption for messages sent by a registered charity where the primary purpose is raising funds. That is a real and meaningful carve-out, but it is narrower than "charities are exempt" — it turns on the message's primary purpose, and a charity's non-fundraising commercial messages do not automatically qualify. Worth confirming with counsel rather than assuming.

Existing non-business relationships from donations also create implied consent, which gives charities a broader base than most commercial senders. PIPEDA still applies to the data.

Metrics: what to watch, and what to ignore

List size is a vanity metric. A list of 8,000 addresses where 400 people open anything is worth less than a list of 900 where 400 do, and it delivers worse, because engagement rate drives inbox placement.

Open rate has been substantially unreliable since 2021. Apple's Mail Privacy Protection pre-fetches tracking pixels for users who enable it, registering opens that did not happen. If a large share of your subscribers use Apple Mail, your open rate is inflated by an unknown amount. It is not useless — trends within a consistent audience still tell you something — but it should not be your primary measure, and year-over-year comparisons across the 2021 boundary are not meaningful.

What to actually watch:

Click rate, which requires a deliberate action and is not affected by pixel pre-fetching.
Spam complaint rate, from Google Postmaster Tools and Microsoft SNDS. This is a delivery input, not just a courtesy metric — treat 0.10% as your ceiling.
Bounce rate, split hard and soft, which tells you about acquisition quality.
Authentication pass rate, from your DMARC reports. If this is not 100% for your legitimate mail, something is misconfigured.
List growth net of unsubscribes and suppressions. Gross additions flatter you.
Revenue or enquiries attributable to email, which is the only metric that answers whether the channel is working.

Ten mistakes that cost Canadian businesses money

Emailing people to ask for permission. The request is itself a commercial electronic message. This is the most common serious CASL error.
Following US advice unchecked. CAN-SPAM is opt-out; CASL is opt-in. The playbooks are not interchangeable.
Keeping addresses without keeping evidence. The burden of proof is on you. A list without consent records is a list you cannot defend.
Bundling marketing consent into checkout or terms. Consent must be separately given and separately refusable.
Never publishing DKIM. Extremely common in small businesses, and it silently costs you a portion of every send.
Having two or three SPF records. A domain may have one. Multiple records produce a permanent error that fails authentication outright.
Sending campaigns through shared hosting mail. Shared IP reputation, rate limits, no feedback loops, and a bad campaign takes your transactional mail with it.
Configuring unsubscribe to CASL's ten business days. Gmail and Yahoo expect roughly two. The legal minimum fails the platform requirement.
Running re-engagement campaigns against expired implied consent. The re-engagement email is the violation.
Treating list size as the goal. It is the metric most likely to make every other number worse.

A fourteen-point audit you can run this week

Consent and records

Pick ten subscribers at random. For each, can you produce the date, method, and exact wording they consented to? If not, your records are the priority.
Check every signup form for pre-checked boxes and for consent bundled with anything else.
Confirm your forms state who is sending, what will be sent, and that consent can be withdrawn, and that a mailing address plus one other contact method is available.
Add a stored consent-basis field to your subscriber records — express, or which implied category and when the clock started — if one does not exist.
Confirm your unsubscribe link works. Actually click it, from a real message, and verify the address is suppressed.
Reduce your unsubscribe processing target from ten business days to two.

Authentication

Query your domain's TXT records and confirm exactly one SPF record, including every service that sends as you.
Confirm DKIM is published and signing. Send a test to a Gmail address and inspect the authentication results in the message headers.
Query yourdomain.ca. If nothing is published and you send in any volume, publish p=none and start reading the reports.
Reverse-lookup your sending IP and confirm it resolves to a hostname that resolves back.

Infrastructure and hygiene

Confirm marketing mail and transactional mail leave by separate paths, ideally with marketing on a dedicated sending subdomain.
Enrol in Google Postmaster Tools and Microsoft SNDS if you have not. You cannot manage a complaint rate you cannot see.
Confirm hard bounces are suppressed after one occurrence and that suppression is enforced across every list and integration.
Serve every signup form over HTTPS, with server-level redirection from HTTP.

Items 7 through 10 take about twenty minutes and are the ones most likely to reveal something broken.

Where this is heading

Some cautious forecasting, marked as such.

Authentication requirements will tighten, not relax. The trajectory from 2023 to now has been consistently in one direction, and the reasonable expectation is that DMARC enforcement policies stronger than p=none become the practical baseline rather than the recommendation. Getting to p=quarantine or p=reject now is preparation rather than perfectionism.

Engagement will matter more and volume less. Every change in the last three years has increased the weight placed on whether recipients actually want the mail. This favours smaller, well-consented lists, which happens to favour the Canadian regulatory position.

Open-rate measurement will keep degrading. Privacy protections that break pixel tracking are spreading, not receding. Build your reporting on clicks and outcomes now.

Canadian privacy law is in motion. Federal privacy reform has been attempted repeatedly and Quebec's Law 25 has already raised the bar provincially. The direction is toward stricter consent and more subject rights. A business that documents consent properly today is positioned for whatever arrives.

CASL itself is unlikely to loosen. The suspended private right of action was the pressure valve, and it remains suspended. The consent framework has been stable since 2014 and there is no serious movement toward an opt-out model.

FAQ

Can I email people to ask if they want to join my mailing list?

No. Under CASL, a message asking for consent to send commercial electronic messages is itself a commercial electronic message, so it requires consent you do not yet have. The CRTC states this explicitly. Consent must be collected through a channel other than email — a web form, in person, verbally, or at point of sale.

Is single opt-in legal in Canada?

Yes. CASL does not require double opt-in, and single opt-in with proper records can constitute valid express consent. Double opt-in is still worth using, because a confirmed click from the recipient's own inbox is much stronger evidence, it filters mistyped and malicious signups, and it improves the engagement metrics that now drive inbox placement.

How long does consent last under CASL?

Express consent does not expire; it lasts until the person withdraws it. Implied consent expires: two years from a purchase or written contract, six months from an inquiry or application. The clock runs from the most recent qualifying activity, so ongoing business keeps implied consent alive.

Does CASL apply to B2B email?

Yes. Work email addresses are fully covered and there is no general business-to-business exemption. The main carve-out is for registered charities where the primary purpose of the message is fundraising. Implied consent through conspicuous publication may apply to a professional address, but it requires the message to be genuinely relevant to that person's role and requires the address to be published without a statement declining unsolicited messages.

What records do I need to prove consent?

The burden of proof sits on the sender, so store, per subscriber: the timestamp, the method of collection, the URL or location where it was collected, the IP address for online signups, the exact wording displayed at the time, the double opt-in confirmation if used, and the consent basis. The exact wording is the item most often missed, because form copy changes over time and you need to know which version a given person saw. Version your form copy and record which version was live when.

What are the penalties for getting CASL wrong?

Administrative monetary penalties run up to $1 million for an individual and $10 million for a business per violation, and officers and directors can be personally liable. Actual enforcement has been more moderate — a $1.1 million proposed penalty settled at $200,000, a $75,000 penalty against an individual who sent over 670,000 messages without consent — but total CRTC enforcement exceeds $1.75 million, and a non-functioning unsubscribe link has been treated as a violation in its own right.

Can I send my email campaigns through my web hosting account?

You can, but you should not for marketing mail. Shared hosting sends from an IP shared with other accounts, so their sending behaviour affects your delivery. Hosting providers cap outbound volume, which fragments campaigns. You get no access to sender feedback loops, and a single damaging campaign harms the reputation your order confirmations and password resets depend on. Use a dedicated email service provider for marketing, ideally on a separate sending subdomain, and keep your hosting for domain mailboxes and transactional mail with proper authentication published.

What is the difference between SPF, DKIM, and DMARC?

SPF is a DNS record listing which servers may send mail for your domain. DKIM adds a cryptographic signature to each message proving it came from an authorised sender and was not altered. DMARC is a DNS policy telling receiving servers what to do when a message fails SPF or DKIM, and it enables reporting back to you. All three are DNS records for your domain, published wherever your DNS is managed — usually your web host or registrar — not settings inside your email platform.

Do the bulk sender requirements apply to my small business?

The additional bulk requirements — DMARC, domain alignment, RFC 8058 one-click unsubscribe, and complaint-rate thresholds — apply at 5,000 or more messages a day to a given provider's users. Most small businesses are well below that. But SPF, DKIM, valid reverse DNS, MX records, and TLS apply to every sender at any volume, and all three providers recommend DMARC regardless. Note also that Gmail's bulk classification does not reverse once triggered, even if your volume later drops.

Why did my emails suddenly stop being delivered?

The most common causes, in rough order: authentication was never fully configured and enforcement caught up with you; you have more than one SPF record, producing a permanent error; your complaint rate crossed a threshold; you sent to a stale segment and generated bounces and complaints; or a marketing campaign through shared hosting damaged an IP reputation your other mail depends on. Since 2024, authentication failures result in outright rejection rather than spam-folder delivery, so a message that "went to spam" and one that never arrived are different diagnoses.

Should I delete subscribers who never open my emails?

Yes, on a schedule. Mailbox providers weight engagement heavily, and a large disengaged segment degrades delivery for the subscribers who do want your mail. A workable policy is to reduce frequency after six months of no opens or clicks and suppress after twelve. Note the legal wrinkle: a re-engagement campaign is fine for subscribers with express consent, but if their consent was implied and the clock has expired, the re-engagement email is itself a violation.

Can I use a purchased email list if the vendor says it is opt-in?

No. CASL requires consent given to you, for messages from you. Consent given to a list vendor does not transfer. Purchased lists are also reliably full of dead addresses and spam traps, which damages sender reputation quickly and is difficult to recover from.

Key Takeaways

Emailing people to ask for permission is a CASL violation. The consent request is itself a commercial electronic message. This is the most common serious error Canadian businesses make.
CASL is opt-in; CAN-SPAM is opt-out. Most list-building advice online is written for the American regime and does not transfer.
The burden of proof is on the sender. Store the timestamp, method, location, IP, consent basis, and the exact wording each subscriber agreed to.
Express consent does not expire. Implied consent does — two years from a purchase, six months from an inquiry.
Since February 2024 for Google and Yahoo, and May 2025 for Microsoft, authentication failures cause SMTP rejection, not spam-folder delivery. The message does not arrive at all.
SPF, DKIM, and DMARC are DNS records at your host, not settings in your email platform. Multiple SPF records are a common and silently fatal error.
Do not send marketing campaigns through shared hosting mail. Separate marketing from transactional so one cannot damage the other.
Gmail and Yahoo expect unsubscribes honoured in about two days; CASL allows ten business days. The platform requirement is stricter than the law.
CASL's consent clocks and deliverability sunsetting want you to remove the same people. One hygiene process satisfies both.
List size is a vanity metric, and open rate has been unreliable since Apple Mail Privacy Protection began pre-fetching tracking pixels in 2021.

Conclusion

The reason list building is harder in Canada than the internet suggests is that two separate systems now have to be satisfied, and most advice addresses neither.

The first is legal. CASL has been in force since 2014 and it works on the opposite principle to the American law that most guidance is written for. Consent comes before contact, implied consent is narrow and expires, and the obligation to prove consent sits with you rather than with the person complaining. None of that is unmanageable, but it does mean the tactics circulating in general list-building content have to be checked rather than copied. The permission email that opens this article is the clearest example: a courteous, sensible-sounding step that happens to be the violation.

The second is technical, and it is newer. Having a consented list and being able to reach it stopped being the same thing when the major mailbox providers began rejecting unauthenticated mail outright. SPF, DKIM, DMARC, and reverse DNS are not marketing concerns and they are not configured in your email platform. They are DNS and server settings, they live with your hosting, and in a great many small businesses nobody ever owned the step of publishing them.

What is encouraging is how much the two systems agree. Both reward genuine consent over volume. Both want disengaged contacts removed on a schedule. Both punish the shortcuts — bought lists, bundled consent, mailing people who never asked — in ways that compound. A list built properly under Canadian rules is a list that performs better at the inbox, not one handicapped by compliance.

Which makes the practical order of work reasonably clear. Fix the authentication, because a list you cannot reach has no value. Fix the consent records, because a list you cannot defend is a liability. Then grow it, slowly, from people who actually asked.

Start with the twenty-minute check.

Query your SPF record, confirm DKIM is signing, look up whether anything is published at _dmarc.yourdomain.ca, and reverse-lookup your sending IP. Most Canadian small businesses find at least one of those broken, and a broken one means you are already losing mail you paid to send. It costs nothing to look.

If something is wrong, or you would rather someone else looked:

On the infrastructure side, 4GoodHosting manages the DNS layer where authentication actually lives, and can help get SPF consolidated, DKIM published, and DMARC configured properly for your domain. Business email hosting on Canadian servers keeps your domain mailboxes and transactional mail on infrastructure in Vancouver and Toronto rather than offshore, which matters both for response times and for clients who ask where their data sits. If you need control over outbound configuration and reverse DNS, VPS hosting with dedicated resources gives you isolation a shared environment cannot. And if your signup forms are not yet served over HTTPS across the whole site, an SSL certificate with proper server-level redirection closes that in an afternoon.

On the marketing side, our online marketing and SEO services team works with Canadian businesses on the acquisition side of this — form and lead-magnet design that converts without creating consent problems, and the audit work to establish whether your existing list is actually defensible. We do this as a service rather than handing you a checklist, because the consent-records question in particular is easier to fix with someone looking at your actual setup.

Either way, run the fourteen-point audit above first. The authentication items alone are usually enough to change what arrives in an inbox next week.

Want a second pair of eyes on your current setup? Get in touch and we will go through it with you.

Table of Contents