Suppression list: definition and practice

Definition

A suppression list records who should not be contacted under a defined communication scope. Reasons can include an opt-out, a client instruction, an existing relationship, a delivery issue, or a campaign-specific exclusion. Scope matters: an individual address, a business, a domain, and a channel are different units and should not be treated as interchangeable without a clear rule.

Suppression is an operational decision record, not just a column in one exported spreadsheet. It needs to remain effective when records are deduplicated, lists are refreshed, or another service prepares outreach. A new source for the same company does not create fresh permission. Preserve the reason, date, applicable scope, and relationship to the resolved identity so the instruction survives ordinary data maintenance.

In origination work

Check suppression before preparing contact and again at the actual handoff to the sending workflow. Keep research eligibility separate: a business may remain useful to a market map while being excluded from outreach. Where instructions are ambiguous, hold contact within the affected scope until the operational question is resolved. Docket's client approval of targets and messaging is an additional requirement, so an absent suppression entry should never be treated as affirmative approval to contact a business or a particular recipient.

What belongs on the list

A suppression list is the set of addresses, domains and numbers to which a sender must not send. It normally includes people who have opted out, addresses that bounced permanently, people who complained, contacts that a client has excluded (current customers, partners, competitors, people in active conversations), and anyone covered by a legal restriction. It must be checked before every send, across every system that sends.

Legal rules attach to some entries. In the United States, the federal commercial email law requires senders to honour an opt-out request within ten business days and prohibits sending to an address after that, and its opt-out mechanism must remain functional for a period after the message. The statute also sets requirements on sender identification and accurate headers. Canada, the European Union and the United Kingdom apply consent-based regimes with their own rules, and California's privacy law gives residents rights about the sale and sharing of personal information.

Operating it properly

Store entries in a way that survives data refreshes. A common failure is re-importing a purchased or rebuilt list that contains addresses previously suppressed. Match on a normalised address and, for opt-outs from a domain, on the domain. Keep the reason, date and source for each entry, and never delete an opt-out to "clean" the data; keeping the record is what lets you honour the request.

Mailbox providers now ask bulk senders to support one-click unsubscribe, defined in a published IETF standard, using headers defined in an earlier document on list mail. Support for these makes it easier for recipients to leave, and a suppression system should process such requests automatically, quickly and across all lists.

Phone and other channels

Different channels carry different registers. In the United States, the National Do Not Call Registry applies to telemarketing calls, and the telephone consumer protection law restricts certain calls and texts, with rules enforced by the FCC. These registers must be scrubbed against before calling, in addition to the sender's internal list. Business-to-business calls have particular treatment, so the applicable rule should be confirmed for each case.

Outreach is optional in this service and requires client approval of messaging and targets. The suppression list is therefore also a client control: it records who must not be contacted on the client's behalf, and the client's own do-not-contact decisions should be added to it at the outset, with the date and the name of the person who approved.

Deduplication — Identifying and consolidating repeated records while preserving evidence, history, and genuinely distinct entities.
Sender authentication (SPF, DKIM, DMARC) — Email standards that help receivers assess sending-domain authorisation, signatures, and alignment with the visible sender domain.
Target list — A defined collection of candidate businesses to research or approach against a stated acquisition mandate.

Sources and further reading

CAN-SPAM Act: A Compliance Guide for Business, U.S. Federal Trade Commission. The seven rules, in plain language, from the regulator that enforces them.
15 U.S.C. 7704: Other protections for users of commercial electronic mail, Legal Information Institute, Cornell Law School. Includes the statutory opt-out obligations that a suppression list exists to honour.
Canada's Anti-Spam Legislation, Government of Canada. Consent-based rather than opt-out, with implied consent categories that matter for B2B prospecting.
GDPR Article 6 — Lawfulness of processing, EUR-Lex / Regulation (EU) 2016/679. Including legitimate interests, the basis most B2B outreach in Europe relies on, and the balancing test it requires.
Direct marketing and privacy and electronic communications, UK Information Commissioner's Office. The clearest regulator guidance in English on when a corporate subscriber may be emailed without prior consent.
California Consumer Privacy Act (CCPA), California Office of the Attorney General. Rights of access and deletion that attach to business contact data held about Californians.
National Do Not Call Registry, U.S. Federal Trade Commission. Applies to telemarketing; business-to-business calling is treated differently, which is a distinction worth getting right in writing.
RFC 8058: Signaling One-Click Functionality for List Email Headers, IETF (2017). The one-click unsubscribe mechanism mailbox providers now ask bulk senders to support.

To apply these distinctions to your own acquisition criteria, discuss your research brief or inspect the demo platform.