# CAN-SPAM, GDPR and sender authentication rules

*Marketing Cloud Engagement Administrator Study Guide · Digital Marketing Proficiency · Last updated October 16, 2026 · https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator/digital-marketing-proficiency/can-spam-gdpr-and-sender-authentication-rules*

The CAN-SPAM content and unsubscribe rules, when GDPR applies, how to order mixed transactional and commercial content, why purchased lists break the anti-spam policy, and how SPF, DKIM, DMARC and the Google, Yahoo and Microsoft bulk-sender rules fit together.

- Certification: Salesforce Marketing Cloud Engagement Administrator
- Exam section: Digital Marketing Proficiency
- Study guide: https://www.certifyforce.com/study-guide/marketing-cloud-engagement-administrator

**Official exam objective:**

> Describe governance and compliance in relation to digital marketing.

## What the exam expects

- List the six CAN-SPAM guidelines for a commercial email, including the 10-day and 30-day unsubscribe windows and the single-page opt-out.
- Decide whether GDPR applies to a sender from where its subscribers live, not where the company sits.
- Structure a message that mixes transactional and commercial content.
- Explain why a purchased list is a compliance problem, not just a data-quality one.
- Separate SPF, DKIM and DMARC, fix a DMARC failure on a private domain, and name what the 2024 bulk-sender rules require.
- Key terms: **CAN-SPAM** (the U.S. federal law regulating commercial email); **GDPR** (the EU privacy law covering processing of EU individuals' data); **affirmative consent** (an explicit opt-in); **DMARC** (the policy that tells receivers what to do with mail that fails authentication); **identifier alignment** (the authenticated domain matches the From domain).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| CAN-SPAM unsubscribe deadline | Process an unsubscribe within 10 days | [Legal Email Compliance Guidelines](https://trailhead.salesforce.com/content/learn/modules/mr-email-marketing-strategies/mr-ems-follow-legal-compliance-guidelines) |
| Opt-out mechanism lifetime | Works for at least 30 days after the mailing | [Legal Email Compliance Guidelines](https://trailhead.salesforce.com/content/learn/modules/mr-email-marketing-strategies/mr-ems-follow-legal-compliance-guidelines) |
| Opt-out effort | No login, no more than a single page | [Legal Email Compliance Guidelines](https://trailhead.salesforce.com/content/learn/modules/mr-email-marketing-strategies/mr-ems-follow-legal-compliance-guidelines) |
| Postal address | Required somewhere in every commercial email | [Legal Email Compliance Guidelines](https://trailhead.salesforce.com/content/learn/modules/mr-email-marketing-strategies/mr-ems-follow-legal-compliance-guidelines) |
| GDPR scope | Any organization processing EU individuals' data, with or without EU presence | [Commercial Email Regulation Considerations](https://help.salesforce.com/s/articleView?id=sales.emailadmin_considerations_email_regs.htm&language=en_US&type=5) |
| Mixed messages | Non-promotional subject; transactional content above commercial content | [Commercial Email Regulation Considerations](https://help.salesforce.com/s/articleView?id=sales.emailadmin_considerations_email_regs.htm&language=en_US&type=5) |
| Purchased lists | Anti-spam policy requires explicit consent; buying data violates the contract | [Deliverability FAQ](https://help.salesforce.com/s/articleView?id=005389036&language=en_US&type=1) |
| DMARC failure on a private domain | Ask Support to enable multi bounce domain so From and bounce domains match | [Deliverability FAQ](https://help.salesforce.com/s/articleView?id=005389036&language=en_US&type=1) |
| 2024 bulk-sender rules | Domain authentication, list-unsubscribe header, limited complaints | [Deliverability FAQ](https://help.salesforce.com/s/articleView?id=005389036&language=en_US&type=1) |
| New DMARC policy | Start in monitoring mode, then the strictest policy | [Authentication](https://help.salesforce.com/s/articleView?id=mktg.mc_es_bulk_sender_guidelines.htm&type=5) |

## Check yourself

- Why does a company with no EU offices still have to follow GDPR for some subscribers?
- When an email mixes a receipt with a promotion, what goes first?
- Why can't the admin import a purchased list even if every address is valid?
- Which three elements do the 2024 Google, Yahoo and Microsoft bulk-sender rules include?

## Sources

- [Legal Email Compliance Guidelines](https://trailhead.salesforce.com/content/learn/modules/mr-email-marketing-strategies/mr-ems-follow-legal-compliance-guidelines)
- [Commercial Email Regulation Considerations](https://help.salesforce.com/s/articleView?id=sales.emailadmin_considerations_email_regs.htm&language=en_US&type=5)
- [Deliverability Frequently Asked Questions](https://help.salesforce.com/s/articleView?id=005389036&language=en_US&type=1)
- [Authentication](https://help.salesforce.com/s/articleView?id=mktg.mc_es_bulk_sender_guidelines.htm&type=5)
- [Sending Reputation and Warming](https://help.salesforce.com/s/articleView?id=mktg.mc_es_ip_address_warming.htm&type=5)
- [Bulk Sender Guidelines for Marketing Cloud Engagement: Addendum](https://help.salesforce.com/s/articleView?id=000795011&language=en_US&type=1)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Marketing Cloud Engagement Administrator pack (USD $19): https://www.certifyforce.com/practice-exams