Define reasons and scope

Do not use one unexplained boolean. Record whether the non-send decision came from unsubscribe, complaint, permanent recipient failure, legal/privacy request, abuse, or an operator action. Attach scope: one list, all marketing for a brand, one transactional workflow where appropriate, or a wider safety block.

A marketing unsubscribe should not normally block an essential security notification, while a complaint should not be ignored because a campaign uses a different provider. Define those boundaries with product and legal owners before implementation.

Store the minimum durable evidence

Use a normalized lookup value or keyed digest where the system can enforce suppression without exposing addresses broadly. Keep the original encrypted only if necessary for provider synchronization. Record reason, source, effective time, scope, notice/list version, and non-sensitive audit reference. Never export the list as a source of “inactive leads.”

Protect access as sensitive personal/operational data. Suppression may need to outlive ordinary contact deletion so the organization does not re-import and contact the person again; document that retention and how privacy requests interact with it rather than deleting blindly.

Enforce before dispatch

Every sending path should check the central decision before queueing, not only when a campaign is created. Recheck long-running queued jobs before provider submission. Make updates idempotent and monotonic where possible so an older import cannot overwrite a newer unsubscribe.

Synchronize provider-native suppression/complaint events back to the central system and push central decisions to all applicable providers. Monitor lag, failures, and account/region coverage. Use event IDs and timestamps to resolve duplicates without logging full addresses.

Test user-visible removal

Implement RFC 8058 one-click unsubscribe where current provider requirements apply, plus a clear body link. Authenticate webhook/callback sources and protect endpoints from cross-list tampering. Confirm the requested scope immediately and do not require login for a basic list unsubscribe.

Verify with regression cases

Test unsubscribe during an active campaign, provider webhook retry, duplicate contacts, address case policy, complaint after unsubscribe, re-subscribe with fresh explicit consent, and provider outage. The invariant is simple: an applicable suppression prevents dispatch everywhere. A healthy list is not one where suppressed rows disappeared; it is one where the non-send decision remains dependable.