Acceptable Use Policy

Sending reputation is shared. Abuse from one sender degrades deliverability for everyone using similar infrastructure, and gets domains and IP ranges listed on blocklists that are slow to escape. This policy is enforced because it protects the people using the service properly.

This policy forms part of the Terms of Service.

You are responsible for complying with the law wherever your recipients are. That includes, at minimum:

• CAN-SPAM (United States): accurate headers and sender identity, no deceptive subject lines, a valid physical postal address, a working opt-out honoured within ten business days.
• GDPR (EU and UK): a lawful basis for processing recipient data, transparency about who you are and where their data came from, and honouring objection and erasure requests.
• CASL (Canada): express or implied consent before sending, clear sender identification, and a functioning unsubscribe mechanism.
• Any equivalent law applying to your recipients.

We are not your compliance department, and configuring authentication is not a substitute for having a lawful basis to contact someone.

Accounts are terminated for any of the following:

• Sending to purchased, scraped or rented contact lists.
• Ignoring unsubscribe requests, or making opt-out difficult or non-functional.
• Forged or misleading headers, sender names, reply-to addresses or subject lines.
• Phishing, credential harvesting, or impersonating a person, brand or institution.
• Malware, ransomware, or links to malicious content.
• Fraud of any kind, including advance-fee schemes, fake invoices and payment redirection.
• Promoting illegal goods or services.
• Harassment, threats, or content that targets people on the basis of a protected characteristic.
• Adult content, gambling, or regulated pharmaceuticals sent unsolicited.
• Reselling or transferring provisioned inboxes to a third party without telling us.
• Deliberately evading blocklists, filters or rate limits, including by rotating identities to disguise the same campaign.

• Respect the three-per-day per-inbox limit each mailbox is configured for.
• Warm inboxes gradually rather than starting at full volume.
• Verify addresses before sending; sustained hard bounces damage reputation quickly.
• Include a genuine, working unsubscribe mechanism and process opt-outs promptly.
• Keep a record of where your contact data came from and why you may contact them.
• Use dedicated domains for outbound rather than the domain your business mail depends on.

The DNS lookup tools are provided for checking domains you own or are responsible for. Do not use them for automated bulk reconnaissance, and do not attempt to bypass the rate limits. They are limited to keep the service available to everyone.

We investigate abuse reports and complaints from mailbox providers and blocklist operators. Depending on severity we may ask you to correct the behaviour, suspend sending, or terminate the account.

Serious abuse - phishing, fraud, malware - results in immediate termination without notice and without refund. We report unlawful activity to the relevant authorities where required.

To report mail sent from infrastructure we provisioned, email info@coldemailinboxes.io with the full message headers. Headers let us identify the sending domain; without them we usually cannot act.