How to define a suppression policy by risk score?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
A suppression policy by risk score is a set of rules that determines when an address moves from active sending to suppressed, based on how it's classified and how it behaves over time. The alternative is making these decisions ad hoc, which means inconsistency at scale and addresses slipping through that shouldn't.
Here's a practical way to structure it:
Tier 1: Immediate suppression (no review needed)
- Invalid or hard-bounced addresses: suppress after first confirmed failure
- Spam trap or toxic classification: suppress immediately on identification
- Unsubscribes: suppress immediately and permanently
- Spam complainers: suppress immediately and permanently
Tier 2: Suppress after pattern (monitor first)
- Soft bounce on 3+ consecutive sends with no successful delivery: suppress
- Catch-all address with zero engagement over 6 months: suppress
- Unknown or unverifiable address that hard bounces: suppress
Tier 3: Review before suppressing
- Long-term non-engager (no opens in 12+ months): run a re-engagement campaign first, suppress if no response after 1-2 attempts
- Borderline source risk (co-registration, trade show list): watch for 3 campaigns, suppress if no engagement and bounce rate from this segment is rising
What makes a policy effective is specificity. "Remove unengaged subscribers" isn't a policy. "Suppress subscribers with zero clicks in 180 days after three attempts of a re-engagement sequence" is a policy. The more specific the trigger, the more consistently it can be applied, and the less room there is for manual decisions that get inconsistently made under time pressure.
Most ESPs don't give you native tools to implement all of this. You often need a combination of validation results, engagement data from your ESP, and a spreadsheet or CRM field tracking the suppression tier. If you're at a scale where this matters and you're doing it manually, that's usually when it's worth looking at automated validation and hygiene tools to handle the classification layer.
Now if you'd like help thinking through the right thresholds for your situation, reach out and we'll work through it with you.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.