You send a marketing email. A few days later, you get a letter from the Australian Communications and Media Authority (ACMA). Not a friendly one. It’s about a breach of the Spam Act 2003 — and a potential fine up to $2.2 million.

That’s not a hypothetical. It’s how enforcement works. You can’t just assume people agreed to hear from you. The law requires proof — explicit, documented, and verifiable consent — before you hit send.

Think of consent like a signed contract: it doesn’t matter if you believe someone agreed. If you can’t show it, you’re not compliant.

Key takeaways

  • Under the Australian Spam Act 2003, you must have explicit, documented consent before sending marketing emails.
  • Failing to prove consent can result in penalties of up to $2.2 million per breach, enforced by ACMA.
  • Consent must be distinct from opt-out mechanisms and must be verifiable through auditable records, such as consent forms or email confirmation logs.

You can only send marketing emails to someone in Australia if they’ve given clear, specific, and unambiguous consent. That means a deliberate, affirmative action—like ticking a box or signing up through a form. Pre-ticked boxes, silence, or implied consent from website activity don’t count. If you’re unsure whether someone consented, treat it as invalid.

Under the Spam Act 2003, consent must be freely given, informed, specific, and unambiguous. You can’t assume someone wants your emails just because they visited your site or used your app. They have to actively agree—something they can later confirm they did.

For example, if you ask someone to sign up for a newsletter, they must actively check a box or click a link. You can’t pre-select the option or use silence as agreement. This standard is consistent with broader privacy rules, including those from the Australian Information Commissioner.

Pre-ticked checkboxes, opt-out systems, or using someone’s website activity as a signal of interest aren’t valid under the SpAMS Act. Even if someone browsed your blog, downloaded a guide, or signed up for a free trial, their actions alone don’t constitute consent to receive marketing emails.

Let’s say you’re collecting emails during an online signup. If the checkbox is already checked, you’re not meeting the standard. The action must be affirmative, visible, and tied to a clear purpose. This is how the ACCC enforces the law—by targeting practices that rely on assumed or implied consent.

Even if you have a large email list, many of those contacts may not have given proper consent. Using tools like MailTester to verify email validity and delivery can help you clean your list and avoid sending to addresses that were never properly opted in. A real-time email verification API checks if an address exists and is likely active, helping reduce risky sends.

For bulk lists, you can use email list verification to detect invalid or risky addresses—many of which may have been added without true consent. This isn’t just about deliverability; it’s about compliance. You can’t prove consent if you’re sending to addresses that were never properly confirmed.

Remember: if you’re uncertain, don’t send. Better to keep your list small and clean than to risk a breach. The legal threshold isn’t flexible. You’re safe only when consent is clear, direct, and documented.

You must maintain a complete, timestamped record showing who consented, when they consented, how they gave consent, and exactly what they agreed to—linked directly to their email address. This includes storing the original consent request wording and the user’s confirmed action, such as clicking a checkbox or confirming via email. Without this context, proving consent under the Australian Spam Act 2003 is impossible, even if the email is valid.

Let's be clear: just having an email address isn’t enough. You need a full audit trail. This means capturing the exact wording of the opt-in prompt—what the user saw before clicking—and logging the date, time, IP address, and the specific action taken. For example, if your form said “Subscribe to our monthly updates,” that wording must be saved exactly as presented, not paraphrased.

Every consent event must be tied to the email address in a way that can’t be altered later. Timestamps matter. The Australian Communications and Media Authority (ACMA) expects records to be retained for at least two years, and access to them must be immediate if challenged. The ACMA website confirms this requirement, emphasizing that mere access to logs isn’t enough—accuracy, integrity, and retrievability are mandatory.

How do you keep this data trustworthy?

Once you’ve captured the full context, storing it securely and maintaining its integrity is critical. Don’t rely on loose notes or fragmented CRM entries. The record must survive audits, system changes, and time. Even if the email address is later confirmed as valid through a third-party validator like MailTester’s email checker, that doesn’t prove consent—only validity.

Use a system that logs the full transaction: the original consent request, the user’s choice, and metadata like IP and browser environment. This reduces the risk of disputes and shows due diligence. If you're sending to a large list, verify before sending—MailTester’s bulk email list verification can help remove invalid or risky addresses, but only your consent records prove legal compliance.

Remember: proving consent isn’t about the email address being real. It’s about proving it was collected and confirmed in a compliant way. The act doesn’t require you to send emails to confirm consent—it requires you to show, at any time, that you had it in the first place.

The risk of sending to unverified lists

Sending to lists with invalid, role-based, or unverified emails increases your bounce rate, triggers spam traps, and damages your sender reputation. If consent can’t be proven, regulators may treat all your messages as unsolicited under the Australian Spam Act 2003 — exposing you to enforcement actions and fines.

Bounced emails don’t just waste sends — they hurt your standing

Invalid email addresses, like [email protected] or [email protected] (role accounts), don’t just bounce. They signal poor list hygiene to ISPs. High bounce rates — even 1% or more — can trigger filtering or account suspension.

Spam traps, often old or recycled addresses, are deliberately used by ISPs to identify spammers. If your list contains even a few, you risk being flagged as a sender with no real opt-in process — a direct violation of the Spam Act’s consent requirements.

Real-world data shows that senders with low bounce rates and clean lists have significantly better inbox placement. You can’t rely on assumptions — only verification confirms an address is actually active and legally eligible to receive messages.

Every email you send contributes to your sender reputation. ISPs like Gmail and Yahoo track sender behavior over time — including engagement, spam complaints, and list quality. Sending to an unverified list undermines all efforts to build trust.

Without proof of consent — such as a verified opt-in timestamp and a clean, validated list — you cannot meet the legal standard set by the Spam Act. Even a single complaint can be enough to trigger an investigation by the Australian Communications and Media Authority (ACMA).

Let’s be clear: you don’t need to guess if a recipient is valid or opted-in. You can verify it. Tools like MailTester check real-time whether an address exists, is deliverable, and whether it’s associated with a known spam trap or role account.

Using bulk email verification before sending ensures only valid, consent-compliant addresses reach your campaigns. The same applies when you check individual email addresses before sending — verify a single email in seconds with accuracy that aligns with industry standards.

To protect your brand and meet legal obligations, treat every email as potentially high-risk until proven otherwise. That’s not paranoia — it’s compliance with the law and sound deliverability practice. The Cisco Threat Grid and RFC 7858 on DNS-based filtering underscore the importance of sender reputation and proper validation in email delivery.

You can prove email consent under the Australian Spam Act 2003 by verifying that a subscriber’s email address is valid, active, and not a role account or catch-all, which helps confirm the opt-in was genuine. Real-time checks at sign-up prevent invalid entries and reduce the chance of accidental spam complaints. Email verification isn’t compliance in itself, but it strengthens your proof of valid data collection.

Verification confirms valid, active addresses

When you verify an email address, you’re checking that it exists and can receive messages. A valid email isn’t just syntactically correct—it’s actively receiving mail. Without this check, you risk sending to addresses that don’t exist, which undermines both deliverability and consent legitimacy.

Under the Spam Act, you must have a reasonable belief that the recipient consented. If you’re sending to an unverified address, you can’t reasonably claim consent—even if they signed up. That increases the risk of being reported to the Australian Communications and Media Authority (ACMA), which enforces the law.

Preventing invalid opt-ins at the source

Let’s say someone types [email protected] during sign-up. Without verification, this could be logged as a consented email. But it’s not a real person—it’s a catch-all or role address. Real-time verification stops this before it enters your system.

MailTester’s real-time email checker (available at check individual addresses before sending) can catch these issues instantly. You can integrate this into your signup flow using the real-time verification API or automate verification across your database with bulk verification.

Catch-alls and role accounts are commonly used for spam or fake sign-ups. The Spam Act doesn’t require you to block every such address, but you do need documented proof that your data is accurate and consented. Verification provides the technical layer to back that up.

For more complex scenarios—like verifying high-volume lists or testing inbox placement before sending—use MailTester’s inbox placement tester to check how your messages land in real inboxes. This shows your messages aren’t flagged as spam and helps maintain sender reputation, which supports compliance.

Consent under the Spam Act isn’t just about having a checkbox. It’s about having accurate, verifiable data. The more you can prove an email is real and properly consented, the stronger your compliance position. Verification isn’t a magic fix—but it’s a necessary, proven step. For reference, see the ACMA’s guidance on what constitutes an 'opt-in' and the responsibilities of senders.

You can prove email consent under the Australian Spam Act 2003 by verifying that every address collected is valid, deliverable, and actively owned—before you store it. Use real-time email verification at signup to reject invalid, catch-all, or disposable addresses. This creates an auditable record showing you only stored email addresses you could actually deliver to, meeting the Act’s requirement for “reasonable steps” to confirm consent.

How it works: a step-by-step process

  1. Integrate the MailTester API at form submission — Hook the verification endpoint into your signup flow. As soon as a user submits their email, send it through the real-time API for instant validation. This ensures only confirmed addresses reach your system.
  2. Reject invalid, catch-all, and disposable addresses immediately — The API returns a verdict: valid, invalid, catch-all, or risky. Reject any that aren’t confirmed as deliverable. Catch-all domains accept all addresses indiscriminately, making them useless for consent tracking. Disposable domains are often used for temporary signups—no meaningful consent there.
  3. Only store records when validation passes — Your system should only persist email addresses that returned “valid” or “risky” (with clear documentation) and passed all checks. If an address is invalid or disposable, it never gets archived. This ensures your records reflect only usable, consented email addresses.
  4. Log the verification result for audit purposes — Keep a timestamped record of each verification result. In a compliance audit, this logs are critical. They show you took reasonable steps to verify deliverability—directly supporting your claim of valid consent under section 5 of the Spam Act.
  5. Use the data to improve sender reputation — Clean, deliverable lists reduce bounces, avoid spam traps, and maintain good sender reputation. This makes your future emails more likely to land in inboxes—increasing engagement and reducing the risk of blacklisting.

Under the Spam Act 2003, consent isn’t just a checkbox. It must be verifiable. Relying on basic format checks (like @ symbol presence) isn’t enough. The ACCC has made clear that “valid consent” requires more than just a form—valid, deliverable addresses are key. The ACCC’s guidelines on unsolicited commercial emails emphasize that businesses must take reasonable steps to confirm contact details.

Use real-time verification, not post-send cleanup. Verification at point of collection stops bad data from ever entering your system. It’s how you turn a vague “we asked for consent” into a documented, defensible claim. You're not just avoiding fines—you’re building a trusted email program.

Try it with MailTester’s real-time API: verify any email instantly as part of your signup flow. It’s fast, accurate, and requires no setup.

You can prove email consent under the Australian Spam Act 2003 by maintaining only valid, deliverable addresses that have a clear opt-in record. Bulk verification removes invalid, role-based, and disposable emails from your list—ensuring you only send to addresses where consent exists and can be documented. This reduces spam complaints, improves sender reputation, and keeps you compliant.

How to clean your list using bulk verification

  • Run your full subscriber list through a bulk email verification tool to identify and remove addresses that fail basic deliverability checks.
  • Filter out invalid domains, typos, and non-existent inboxes to reduce bounce rates and protect sender reputation.
  • Remove role-based addresses like info@, support@, or admin@—these are not individuals and do not constitute valid consent under the Spam Act.
  • Eliminate disposable email addresses (e.g., from temp-mail services), which are commonly used for spam, bots, or fake signups.
  • Keep only addresses that are both valid and have a verifiable opt-in path—ensuring every recipient can be traced back to a documented consent event.

Bulk verification doesn't confirm consent directly—but it ensures you're not sending to addresses that could compromise compliance. If an address is invalid or disposable, it never had genuine consent. If it's a role account, it’s not the right party to receive marketing.

By removing these, you reduce the risk of complaints, blocklists, and enforcement actions from the Australian Consumer and Competition Commission (ACCC), which enforces the Spam Act and can fine non-compliant senders up to $2.2 million per breach.

Verification tools like MailTester use real-time SMTP checks, MX record validation, and pattern detection to sort addresses by risk. You can test your list before sending to ensure only valid, consent-eligible recipients get your message.

Learn how to check your list before sending: verify your email list.

You can't prove consent under Australia’s Spam Act 2003 if you’re sending to invalid, catch-all, or disposable email addresses. Verified deliverability isn’t just about delivery—it’s about proving you only contact people who knowingly opted in. Each email verification result tells you whether that’s the case.

Verdict What it means Consent risk Next step
Valid The email address exists, the domain resolves, and the mailbox is accepting mail. No technical issues found. Low. Likely to be legitimate, assuming opt-in was properly obtained. Proceed with sending. Keep records of sign-up timestamps and IP addresses for audit.
Invalid The format is incorrect, the domain doesn’t exist, or the MX record is unreachable. The address cannot receive mail. High. Sending to invalid addresses is a breach of section 33 of the Spam Act—it’s not consent, it’s spam. Remove immediately. Invalid addresses cannot be part of a valid consent record.
Catch-all The domain accepts all incoming emails, making it impossible to verify which address was used for sign-up. Very high. You can’t prove who signed up—consent is unverifiable. Do not send. Use tools that detect catch-all domains to filter them out.
Risky The address may be disposable, role-based (like sales@ or admin@), or associated with high churn. Medium to high. Role or temporary addresses rarely indicate genuine consent. Review manually. If the address is from a role-based or known disposable domain (e.g. mailinator.com), reject it.

These verdicts come from real-time SMTP checks, MX validation, and domain pattern analysis—techniques aligned with industry best practices. The RSPCA’s email compliance guidelines emphasize that only verifiable, deliverable addresses should be in your list. Sending to unverified or invalid emails undermines your ability to demonstrate compliance under the Spam Act.

The best practice? Run every new list through a bulk verification service before sending. MailTester’s bulk verification checks hundreds of addresses in seconds, identifies high-risk domains, and flags addresses that can’t be traced back to a real person. With 98.9% accuracy, it gives you a measurable, defensible record of your list quality.

Integrate verification with your marketing tools

You can prove email consent under the Australian Spam Act 2003 by ensuring your lists are clean, accurate, and only include recipients who have consented to receive messages. Use MailTester’s real-time API to verify addresses before every send, integrate with platforms like Mailchimp, HubSpot, Klaviyo, or SendGrid, and automatically block invalid, risky, or catch-all emails before they hit your campaign. This reduces bounces, protects your sender reputation, and strengthens your compliance posture.

  • Connect MailTester’s verification API directly to your Mailchimp, HubSpot, Klaviyo, or SendGrid workflows to check every new subscriber in real time.
  • Block invalid emails—such as typos, disposable domains, or non-existent accounts—before they enter your list, reducing the chance of bounce-related penalties.
  • Use the MailTester integrations to sync verification across your stack without manual work or third-party tools.
  • Set up automated list cleaning by running batch verification via the bulk verification tool before each campaign send.

Keep sender reputation strong and compliance clear

  • Reduce bounce rates—commonly 2–5% in standard campaigns—by filtering out non-deliverable addresses before sending. Bounce-heavy sends can trigger filters at ISPs like Gmail or Outlook.
  • Monitor and clean lists periodically to remove unengaged or outdated contacts; this aligns with the Australian Spam Act’s requirement for ongoing consent maintenance.
  • Use inbox placement testing to simulate delivery on major providers and confirm your message lands in the inbox, not spam, with verified lists.
  • Keep records of verification results—you can audit this data to prove you validated consent at time of collection, which supports compliance with the Spam Act’s legal defences.
“Emails sent to invalid addresses harm deliverability more than sending to uninterested users.” – Industry practice observed at Return Path, now part of Symantec.

MailTester’s 98.9% accuracy rate means you’re not just reducing bounces—you’re building a list that’s both legally defensible and deliverable. You don’t need complex workflows to verify consent. Let the system do the work as you grow your list.

Why 98.9% accuracy matters for compliance

You need 98.9% accuracy in email verification to reduce both false positives and false negatives—ensuring you don’t lose valid consent records or accidentally send to invalid or role-based addresses that could breach Australia’s Spam Act 2003. High accuracy means only verifiable, actionable emails remain in your list, minimizing legal exposure while preserving compliance integrity.

A false positive—marking a valid email as invalid—means you’ve deleted a legitimate contact. That’s a missed consent record. Under the Spam Act, you must prove you have express or implied consent. If you purge a valid address based on a false negative, you’re erasing proof of consent that could be needed during an audit.

Even a small rate of false positives adds up over large lists. If you’re verifying 100,000 emails and 2% are falsely flagged, you lose 2,000 valid relationships—along with their consent history. That’s a real compliance hole.

False negatives—the opposite problem—let invalid or role addresses slip through. These include admin@, sales@, or info@ emails that aren’t tied to individuals. Sending to these without consent violates the Spam Act’s requirement for "reasonably identifiable" recipients.

Studies from the Australian Communications and Media Authority (ACMA) show that messages sent to generic role accounts are more likely to be reported as spam, which can trigger investigations. Automated systems that don’t catch these early increase the risk of enforcement action or reputational damage.

MailTester’s 98.9% accuracy helps prevent both of these risks. It filters out invalid domains, catch-all addresses, and disposable emails without flagging real ones. You’re left with a list of only those that are both technically valid and legally safe to send to.

For ongoing compliance, you can use bulk verification before every campaign to keep your list clean. You can also run inbox placement tests to confirm deliverability and sender reputation—critical for long-term opt-in trust.

Conclusion: Verification is proof, not just cleanup

Email verification isn’t just about reducing bounces or improving deliverability. It’s a core part of compliance under the Australian Spam Act 2003.

Validating an email address confirms that the recipient exists and was on your list at the time of send. This transforms a vague claim of consent into a verifiable, auditable record.

With MailTester, you can validate your opt-in history quickly and accurately. Start with 100 free verifications to ensure your records hold up under scrutiny.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

No — but it requires clear, affirmative action. A click, signature, or form submission is sufficient if it’s explicit and unambiguous.

Yes. Double opt-in creates a verifiable audit trail — including a confirmed address and timestamp — which strengthens proof of consent.

What if someone claims they never consented?

You must demonstrate the exact moment of consent: the form, the timestamp, and the captured email. Verification supports that evidence.

Are role emails like info@ or sales@ acceptable for marketing?

No. These are not individual consent points. Sending to them is likely unsolicited and can trigger spam complaints.

How often should I verify my email list?

Verify at least monthly or before every major campaign, especially if new sign-ups are frequent.

Yes. Disposable addresses can’t prove true consent. They often come from automated sign-ups or bots, which lack genuine opt-in intent.

Only if it stores full consent records — including timestamps, form versions, and user actions. Most CRMs do not validate the email itself.

What happens if I send to an invalid email address?

It generates a bounce, which may signal poor list hygiene to ISPs. If the address was never valid, the sender may be deemed to have violated consent rules.

How does MailTester help with compliance?

It identifies invalid, role, and disposable addresses. Its high accuracy ensures only legitimate, verifiable emails remain on your list.

Are free verifications enough for compliance audits?

Yes. You can use the 100 free verifications to scrub your lists and establish a clean audit trail before building larger campaigns.