# CAN-SPAM Readiness Checker for Commercial Email

> Assemble a reviewable CAN-SPAM evidence record for a supplied email draft. The tool distinguishes elements observed in the message from operational facts attested by the operator, applies different logic to commercial and transactional messages, and reports missing or unresolved evidence without presenting a legal-compliance percentage.

- **Canonical page:** [https://emailbump.com/tools/can-spam-readiness-checker](https://emailbump.com/tools/can-spam-readiness-checker)
- **Interactive tool:** [Open the CAN-SPAM readiness checker](https://emailbump.com/tools/can-spam-readiness-checker)
- **Category:** U.S. commercial email readiness
- **Updated:** July 2026
- **Privacy:** Message analysis and exports run locally in the browser
- **Legal boundary:** Informational evidence review; not legal advice or a compliance certificate

## The central principle

Compliance is a system, not a message score.

A browser can observe that supplied content contains:

- A From display name
- A syntactically plausible From address
- A subject line
- A specific postal-address string
- A link labeled as unsubscribe or opt-out
- Advertisement or promotional-identification language

It cannot establish that:

- Header and routing information is truthful
- The subject accurately reflects the complete offer
- A postal address is valid and current
- An unsubscribe link works
- The mechanism remains available for at least 30 days
- The process is free and procedurally simple
- Requests are honored within 10 business days
- Suppression reaches every sending workflow and vendor
- A suppressed address is protected from prohibited transfer
- A third-party sender is monitored
- Prior affirmative consent exists
- The selected primary-purpose classification is legally correct
- Other U.S. or international laws do not impose additional duties

The tool therefore uses two evidence classes:

1. **Message observations** from the fields and body supplied to the browser
2. **Operational attestations** explicitly selected by an accountable operator

Unknown facts stay unknown. A missing element is not converted into a low score, and a checked box is not converted into a legal conclusion.

## Source framework

The review is based principally on:

- The Federal Trade Commission's CAN-SPAM compliance guide
- 15 U.S.C. § 7704
- The CAN-SPAM Rule at 16 CFR Part 316

The tool does not replace the complete statute, rule, enforcement materials, current agency guidance, or advice from qualified counsel.

## What CAN-SPAM generally covers

The FTC explains that CAN-SPAM applies to commercial electronic mail messages, including messages whose primary purpose is the advertisement or promotion of a commercial product or service.

The name of the statute can be misleading in two ways.

First, the law is not limited to email commonly described as spam. An expected campaign to existing customers can still be a commercial message.

Second, it is not limited to bulk campaigns. The FTC states that the law makes no general exception for business-to-business commercial email.

The primary purpose of the message matters.

## Primary-purpose modes in the checker

### Commercial

Select commercial when advertising or promotion is the message's primary purpose.

The checker applies the configured review for:

- Accurate header and routing information
- Non-deceptive subject line
- Advertisement or solicitation identification when the affirmative-consent exception is not established
- Valid physical postal address
- Clear and conspicuous opt-out notice
- A qualifying opt-out mechanism
- Post-send mechanism availability
- Procedural simplicity
- Timely suppression
- Protection of suppressed addresses
- Third-party oversight

### Transactional

Transactional or relationship treatment is narrow.

The FTC identifies categories including messages whose primary purpose is:

1. Facilitating, completing, or confirming a commercial transaction the recipient already agreed to
2. Providing warranty, recall, safety, or security information about a product or service used or purchased by the recipient
3. Giving specified information about a subscription, membership, account, loan, or comparable ongoing commercial relationship
4. Providing information directly related to an employment relationship or benefit plan
5. Delivering goods, services, updates, or upgrades the recipient is entitled to receive under a transaction already agreed to

Selecting transactional in the tool does not prove that one of these categories applies.

The configured ledger still reviews header and routing accuracy, subject evidence, classification, and vendor oversight. It marks full commercial-message footer and opt-out elements as not applicable under the operator's classification.

The FTC guide says transactional or relationship messages remain subject to the prohibition on false or misleading routing information.

### Mixed

Select mixed when the message contains both commercial and transactional or relationship content.

The tool does not automatically grant transactional treatment. It keeps the full commercial-message requirements applicable and creates an unresolved primary-purpose item.

According to the FTC's explanation:

- If a reasonable recipient would interpret the subject as advertising or promotion, the message is commercial
- When the subject is not determinative, the placement of transactional or relationship content matters
- If transactional or relationship content does not appear mainly at the beginning, the message is commercial

A receipt placed below a large promotion does not automatically make the email transactional.

### Unsure

Select unsure when the team has not classified the message.

The checker conservatively keeps the commercial-message evidence review active and reports classification as unresolved.

## Message inputs

The interactive review accepts:

- Primary purpose
- Plain-text or HTML source mode
- From display name
- From email address
- Optional Reply-To address
- Subject line
- Complete message body or HTML
- Expected valid physical postal address
- Prior-affirmative-consent attestation

The expected postal address is compared with text extracted from the supplied body. The comparison normalizes case, whitespace, periods, and commas.

That comparison answers:

> Does this expected address string appear in the supplied source text?

It does not answer:

> Is this a legally valid and current physical postal address for the sender?

That second question requires a separate attestation and supporting business records.

## Sender and routing information

15 U.S.C. § 7704 prohibits materially false or misleading transmission information.

The FTC guide describes the relevant information as including:

- From
- To
- Reply-To
- Routing information
- Originating domain name
- Originating email address

The information must be accurate and identify the person or business that initiated the message.

The tool has two separate sender items.

### Sender identity supplied

This message observation requires:

- A non-empty From name
- A syntactically plausible From email address

It provides a review artifact. It does not verify domain control, authorization, routing, or truth.

### Header and routing accuracy

This is an operator attestation.

The reviewer should use the final compiled message and actual sending configuration. An editable mock From field cannot reveal:

- Return-Path
- Received path
- Envelope identities
- Provider rewriting
- Originating infrastructure
- Actual To field
- Hidden or generated headers

Use the [email header analyzer](https://emailbump.com/tools/email-header-analyzer.md) on a received test message for additional evidence.

## Reply-To is not treated as a fake standalone checkbox

Some checkers state that every CAN-SPAM message must contain a monitored Reply-To address as a separate universal requirement.

This tool does not make that claim.

Reply-To, when used, belongs in the accuracy review. A working monitored Reply-To can be important for recipients and can support a reply-email opt-out mechanism. But the statutory framework is better represented through:

- Accurate header and routing information
- A qualifying opt-out method
- Operational ability to receive and honor requests

The Reply-To input is therefore labeled optional evidence.

## Subject-line review

CAN-SPAM prohibits deceptive subject headings in commercial email.

The tool separates:

### Subject supplied

The browser can observe whether a subject is present and preserve the exact text.

It also flags reply or forward prefixes as context needing review, because a synthetic `Re:`, `FW:`, or `Fwd:` can create a false impression of an existing conversation.

### Subject accuracy attested

The operator must compare the subject with:

- Complete message content
- Offer
- Price
- Eligibility
- Deadline
- Availability
- Material conditions
- Recipient relationship
- Thread context
- Landing-page destination

A language model or regular expression cannot determine legal deception from the subject alone.

## Advertisement or solicitation identification

Commercial email generally must clearly and conspicuously identify itself as an advertisement or solicitation.

15 U.S.C. § 7704 contains an exception to that identification requirement when the recipient has given prior affirmative consent to receive the message.

The checker therefore evaluates two possible evidence paths:

1. Advertisement or promotional-identification language is observed in the message
2. The operator attests that prior affirmative consent applies

The local phrase observation recognizes language such as:

- Advertisement
- Advertising
- Promotional message
- This email is a promotion
- Sponsored

This is directional evidence. It does not determine clear and conspicuous presentation in the final rendering.

The affirmative-consent exception concerns advertisement identification. It does not remove every other obligation for commercial email, and members or subscribers retain the ability to opt out of marketing messages.

## Physical postal address

Commercial email must include a valid physical postal address of the sender.

The FTC guide explains that this can include:

- The sender's current street address
- A post office box registered with the U.S. Postal Service
- A private mailbox registered with a commercial mail receiving agency established under Postal Service regulations

The tool creates two independent items.

### Address text appears

The operator enters the expected address. The browser extracts visible text from plain text or HTML and checks whether the normalized address appears.

### Address is valid and current

The operator attests to validity.

The browser does not:

- Query postal registration records
- Verify occupancy
- Determine whether a private mailbox qualifies
- Confirm which legal entity is the sender
- Establish that the address is current on the send date

Teams should assign ownership for keeping the footer address current across templates, brands, workspaces, and vendors.

## Opt-out notice and mechanism

Commercial messages need a clear and conspicuous explanation of how the recipient can opt out of future commercial email from the sender.

The FTC says the message should provide:

- A return email address, or
- Another easy internet-based method

A preference menu can allow category-level choices, but recipients must have an option to stop all commercial messages from the sender.

The tool extracts:

- Plain-text HTTP and HTTPS URLs
- HTML anchors and href values
- Visible link labels

It recognizes opt-out evidence using terms such as:

- Unsubscribe
- Opt out
- Email preferences
- Stop receiving
- Stop email

The report preserves the label and URL.

## Presence does not prove conspicuousness

A tiny low-contrast link at the end of a long image can be technically present while remaining difficult for an ordinary recipient to recognize, read, and understand.

Conspicuousness depends on the compiled presentation, including:

- Font size
- Color contrast
- Placement
- Surrounding copy
- Link label
- Mobile layout
- Dark mode
- Image blocking
- Language
- Recipient expectation

The checker reports recognizable language in source. Teams must inspect rendered messages.

## Post-send opt-out operations

The FTC guide describes several operational duties that message HTML cannot prove.

The checker records them as attestations.

### Mechanism works for at least 30 days

The offered opt-out mechanism must be capable of receiving requests for at least 30 days after the message is sent.

A successful pre-send HTTP request would not prove future availability. For that reason, the tool does not fetch an unsubscribe URL and label the requirement passed.

Appropriate evidence can include:

- Synthetic monitoring
- Endpoint availability logs
- Reply-mailbox monitoring
- Incident alerts
- Retention records tied to send dates

### Process is free and simple

The FTC says honoring an opt-out cannot be conditioned on:

- A fee
- Personally identifying information beyond an email address
- A step beyond sending a reply email or visiting one webpage

Teams should test the production recipient path without privileged sessions or internal cookies.

### Requests are honored within 10 business days

The attestation covers actual suppression timing.

Review:

- Campaigns
- Journeys and automations
- Scheduled messages
- Retry queues
- CSV imports
- Audience syncs
- Sales tools
- Agency and affiliate systems
- Regional workspaces
- Legacy providers

A suppression row in one database is not enough if another sender can still launch commercial email.

### Suppressed addresses are protected

After a person opts out, the address generally cannot be sold or transferred, even as part of a mailing list, except as permitted for a company hired to help the sender comply.

Review:

- Data warehouse exports
- Reverse ETL
- Audience activation
- List rentals
- Partner sharing
- Analytics destinations
- Vendor subprocessors
- Data retention and deletion jobs

## Vendor and promoted-business responsibility

The FTC warns that a business cannot contract away its legal responsibility merely by hiring another company to send commercial email.

Depending on the facts, both:

- The company promoted in the message
- The company that sends the message

can face responsibility.

The vendor-oversight attestation should cover:

- Named control owners
- Contractual requirements
- Template review
- Audience provenance
- Suppression synchronization
- Launch approvals
- Monitoring
- Incident response
- Audit rights
- Offboarding

## Consent, list provenance, and address acquisition

CAN-SPAM is often described as an opt-out law. It does not generally impose the same universal prior-consent model associated with some other regimes.

That does not mean every acquisition practice is safe or lawful.

The statute includes aggravated violations involving practices such as:

- Address harvesting under described circumstances
- Dictionary attacks
- Automated creation of multiple accounts
- Unauthorized access to relay or retransmit messages

Other laws, contracts, platform policies, privacy notices, industry standards, and recipient jurisdictions can require consent or restrict use.

The checker does not include “the list was never purchased” or “every recipient opted in” as universal standalone CAN-SPAM message requirements. Instead, it explains that list provenance and applicable consent rules need their own legal and operational review.

## One-click unsubscribe and CAN-SPAM are related but distinct

Mailbox-provider bulk-sender rules and RFC 8058 one-click unsubscribe are important operational requirements.

They do not collapse into the CAN-SPAM body-notice analysis.

An email program can need:

- Clear body opt-out notice
- A qualifying recipient mechanism
- `List-Unsubscribe` header
- `List-Unsubscribe-Post: List-Unsubscribe=One-Click`
- Fast operational suppression

Use the [email header analyzer](https://emailbump.com/tools/email-header-analyzer.md) to inspect supplied headers. Do not assume a one-click header makes an unclear body footer compliant, or that a body link satisfies every mailbox-provider header requirement.

## Exact readiness logic

Every ledger item has:

- ID
- Category
- Title
- Status
- Evidence basis
- Applicability
- Evidence text
- Explanation
- Review action

Statuses are:

- **Observed:** Directly found in supplied message fields or source
- **Attested:** Explicitly confirmed by the operator
- **Missing:** Required evidence is absent or negatively attested
- **Needs review:** The operator selected not confirmed, or purpose classification remains unresolved
- **Not applicable:** The item is outside the configured classification

The page reports:

- Applicable-item count
- Message-observation count
- Attestation count
- Blocker count
- Unresolved count

It does not calculate a compliance percentage.

### Readiness blocked

Shown when at least one applicable item is missing or negatively attested.

### Evidence incomplete

Shown when there are no blockers but at least one applicable fact is unknown or classification-dependent.

### Evidence assembled

Shown when all configured applicable items are either observed or attested.

The final state says to proceed to:

- Qualified legal review
- Compiled-message QA
- Endpoint testing
- Production control verification

It does not say “compliant.”

## Built-in examples

### Prepared campaign

Includes:

- Commercial classification
- Recognizable sender
- Specific subject
- Promotional identification
- Postal address
- Unsubscribe link
- Affirmative operational attestations

It demonstrates an assembled evidence record, not a certified campaign.

### Missing evidence

Includes:

- Pressure-style display name
- Synthetic reply subject
- No postal address
- No unsubscribe mechanism
- Unknown attestations

It demonstrates blockers and unresolved facts.

### Receipt

Includes:

- Transactional classification
- Order-specific subject
- Receipt details at the beginning
- Sender and vendor attestations
- Commercial-footer elements marked not applicable under the selected classification

The example is not a universal classification rule. Promotions, subject framing, content order, and facts can change the result.

## HTML and text parsing

HTML mode uses the browser's DOM parser.

It extracts:

- Body text
- Anchor labels
- Anchor href values

It does not:

- Execute scripts
- Fetch images
- Follow redirects
- Submit forms
- Render like every email client
- Apply all CSS
- Validate MIME structure
- Inspect provider-generated headers

Plain-text mode extracts visible HTTP and HTTPS URLs.

## Exported JSON

The JSON handoff includes:

- Tool canonical URL
- Review timestamp
- Selected purpose
- Source mode
- From name
- From email
- Reply-To
- Subject
- Complete supplied body
- Expected postal address
- All attestations
- Plain-language summary
- Evidence coverage counts
- Address-match result
- Advertisement-language result
- Extracted opt-out links
- Complete requirement ledger
- Limitations
- Primary source URLs

Sensitive message content remains local unless the operator deliberately copies or exports it.

## Review workflow

### 1. Classify primary purpose

Start with the subject, lead content, recipient expectation, and statutory transactional categories.

### 2. Paste the compiled message

Use the final subject, From identity, and post-template HTML or text. Draft fragments create weaker evidence.

### 3. Supply the expected address

Use the exact current address the organization expects recipients to see.

### 4. Inspect message observations

Confirm sender, address, opt-out, and ad-identification evidence. Review final rendering separately.

### 5. Assign attestations

Do not let the copywriter guess about suppression infrastructure. Route each fact to the system or legal owner.

### 6. Resolve blockers

Update the artifact or operation. Preserve the before-and-after report when useful.

### 7. Test production behavior

Send a controlled message, follow the unsubscribe path, inspect headers, and confirm suppression across every sending source.

### 8. Obtain legal review

Review the actual sender, recipients, jurisdictions, claims, purpose, acquisition, consent, and operations.

## Important limitations

The tool cannot determine:

- Legal identity of the sender
- Material falsity
- Deceptive overall impression
- Postal validity
- Affirmative-consent validity
- Whether a message contains sexually oriented material subject to additional rules
- Address-harvesting or dictionary-attack facts
- Unauthorized-access facts
- Recipient location
- Sender location
- Choice of law
- Sector-specific regulation
- Contractual restrictions
- State-law claims that may remain available
- GDPR, PECR, CASL, or other international compliance
- Accessibility compliance
- Privacy-law compliance
- Deliverability
- Inbox placement

## Frequently asked questions

### Does CAN-SPAM apply only to unsolicited bulk email?

No. The FTC explains that commercial messages are covered and that the law is not limited to bulk email.

### Is business-to-business email exempt?

The FTC says there is no general B2B exception for commercial email.

### Does every transactional message need an unsubscribe link?

Transactional or relationship messages receive different treatment under CAN-SPAM, but classification is narrow. Mixed promotional content can make the message commercial.

### Do members and subscribers retain marketing opt-out rights?

Yes. A membership or subscription does not eliminate the right to opt out of marketing messages.

### Does CAN-SPAM require prior opt-in for every commercial message?

CAN-SPAM generally uses an opt-out structure, but other applicable laws and policies can require consent. Affirmative consent also affects the advertisement-identification provision.

### Is a Reply-To address mandatory?

Reply-To belongs in the accuracy review when used and can support a reply-based opt-out. This tool does not describe a conventional monitored Reply-To as a standalone universal statutory checkbox.

### Does an unsubscribe link prove readiness?

No. The notice must be clear, the mechanism must qualify, it must remain available, the process must avoid prohibited friction, and requests must be honored.

### Can recipients be required to log in?

The FTC says a sender cannot require a step beyond reply email or visiting one webpage as a condition of honoring the request. Have counsel review the actual production flow.

### How quickly must requests be honored?

The FTC guide says within 10 business days.

### How long must the mechanism work?

The FTC guide says it must be capable of processing requests for at least 30 days after the message is sent.

### Can a suppressed address be transferred?

The FTC guide says it generally cannot be sold or transferred, including as part of a mailing list, except to a company hired to help comply with the law.

### Is an ESP responsible for compliance?

Responsibility depends on the facts. The FTC warns that the promoted business and actual sender can both face responsibility and that duties cannot simply be contracted away.

### Does this tool provide legal advice?

No. It is an informational evidence organizer.

## Primary sources

- [Federal Trade Commission: CAN-SPAM Act compliance guide for business](https://www.ftc.gov/business-guidance/resources/can-spam-act-compliance-guide-business)
- [15 U.S.C. § 7704: Protections for users of commercial electronic mail](https://www.law.cornell.edu/uscode/text/15/7704)
- [Federal Trade Commission: CAN-SPAM Rule, 16 CFR Part 316](https://www.ftc.gov/legal-library/browse/rules/can-spam-rule)
- [15 U.S.C. § 7702: Definitions](https://www.law.cornell.edu/uscode/text/15/7702)

## Related tools and guidance

- [Email header analyzer](https://emailbump.com/tools/email-header-analyzer.md)
- [Spam-language and content risk reviewer](https://emailbump.com/tools/spam-trigger-word-checker.md)
- [Subject and preheader previewer](https://emailbump.com/tools/subject-line-previewer.md)
- [Email preheader generator](https://emailbump.com/tools/email-preheader-generator.md)
- [Email signature builder](https://emailbump.com/tools/email-signature-builder.md)
- [Transactional subject-line guide](https://emailbump.com/blog/transactional-email-subject-lines.md)
- [Reducing spam complaints](https://emailbump.com/blog/reduce-transactional-email-spam-complaints.md)
- [Designing an effective welcome email](https://emailbump.com/blog/design-effective-welcome-email.md)
- [Transactional versus marketing email](https://emailbump.com/blog/transactional-vs-marketing-email.md)
- [Deliverability documentation](https://emailbump.com/docs/deliverability.md)