How to Run a Re-Permission Email Campaign Before a Winback

A re-permission email campaign is the safest first move when your team inherits a neglected email list. Before a winback offer tries to recover revenue, it should establish a more fundamental answer: do these people still recognize, want, and safely receive your email?

That distinction came through clearly in a recent r/Emailmarketing discussion started by u/GabbyFromKlaviyo. The post described a business that mailed a 2,000-contact list after roughly two years of silence, then spent months trying to restore its sending reputation. The thread’s bluntest reply was simply to cancel the send; other commenters took a more nuanced position, arguing that recovery can be possible but that a two-year lapse changes the risk calculation substantially. (reddit.com)

The useful lesson is not that every inactive segment is untouchable. It is that marketers often confuse a winback campaign with a list reactivation plan. A winback is a revenue program aimed at known, reachable customers who have recently lapsed. A re-permission campaign is a risk-management program for people whose consent, recognition, address quality, and engagement signals have gone cold.

For creators, ecommerce teams, SaaS founders, and lifecycle marketers, that order matters. Sending a compelling discount to the wrong audience can be more expensive than deleting the segment. Here is how to decide whether an old list deserves a second chance—and how to run a controlled reactivation process if it does.

Why a winback email is not the right first email after a long silence

A conventional winback campaign assumes a functioning relationship. The recipient knows the brand, remembers signing up or buying, and has merely stopped purchasing or engaging on the expected timeline. The job of the email is to restore relevance: a replenishment reminder, a new product, a loyalty benefit, useful content, or a limited-time offer.

A list that has received no marketing email for one or two years is different. The sender is no longer working with a normal lapse in purchasing behavior. They are working with uncertainty across several layers:

• Permission uncertainty: Can the business document how and when each address opted in?
• Recognition uncertainty: Will the recipient recognize the sender, product, and reason for contact?
• Mailbox uncertainty: Is the address still actively used, abandoned, forwarded, or otherwise risky?
• Reputation uncertainty: Will the initial send create a spike in spam complaints, bounces, or low engagement?
• Data uncertainty: Is the supposed customer history accurate enough to personalize an offer responsibly?

A winback message tends to put the commercial ask first: come back, shop now, renew, save 20%. That is logical when the relationship is warm enough to support it. On a dormant file, the first job is to earn the right to make that ask again.

This is why the Reddit poster’s proposed sequence is strategically sound: start with recency to control risk, use a re-permission message to identify the people who still want contact, and only then build a fuller reactivation flow around responders. The community disagreement was largely about where the line should be drawn. Some participants saw two years of silence as a practical stop sign; others accepted cautious outreach as an option. Both perspectives lead to the same operational rule: do not mistake careful batching for proof that an old list is healthy. (reddit.com)

The deliverability math behind a cold-list send

The danger in a neglected list is not limited to hard bounces. Spam complaints are often the more immediate signal because they tell mailbox providers that people did receive the message and actively rejected it.

Google’s sender guidance says senders should keep spam rates below 0.1% and avoid ever reaching 0.3% or above. Gmail also defines a bulk sender as a sender delivering close to 5,000 or more messages to personal Gmail accounts in a 24-hour period, aggregated at the primary-domain level. (support.google.com) Yahoo likewise instructs senders to keep spam rates below 0.3%, notes that its rate is calculated using mail delivered to the inbox, and says it continuously evaluates mail from domains with elevated complaint rates. (senders.yahooinc.com)

The number sounds small until it is turned into actual people. At a 0.3% complaint rate:

• A 2,000-recipient send reaches the threshold with six complaints.
• A 5,000-recipient send reaches it with 15 complaints.
• A 20,000-recipient send reaches it with 60 complaints.

Those figures are not a safe allowance or a target. They are a warning boundary. A marketer cannot see every reputation input used by Gmail, Yahoo, Microsoft, or other providers, and complaint data may not capture every negative signal. Low opens, spam-folder placement, deleting without reading, bounces, authentication failures, and weak historical reputation can all compound the problem.

That makes a large cold-list send structurally different from a normal campaign. Its failure mode is asymmetric. The upside may be a handful of recovered orders; the downside can be weaker inbox placement for future welcome emails, receipts, product announcements, abandoned-cart messages, and other programs that serve active customers.

In other words, the question is not merely, “Can this list generate revenue?” It is, “Does expected revenue exceed the potential cost of harming email delivery for the customers who are already engaged?”

Consent records come before segmentation

Before choosing a first batch, audit the origin of the data. A contact should not enter a re-permission email campaign simply because it exists in a CRM export or a legacy email platform.

Build a simple provenance table for the dormant audience. At minimum, capture the email address, acquisition source, opt-in timestamp, opt-in language or form version, last marketing send, last engagement, last purchase, unsubscribe status, bounce history, and any relevant geography. The goal is not bureaucratic perfection. It is to separate defensible, first-party relationships from records that are merely present in a database.

What counts as a defensible starting segment

The best candidates generally have several of these traits:

1. They opted in directly through a signup form, checkout, account creation flow, event registration, or another documented first-party process.
2. Their opt-in was clearly for promotional or recurring marketing communications—not just transactional messages such as receipts or password resets.
3. Their address has no previous hard bounce, unsubscribe, suppression status, or known complaint signal.
4. They had meaningful activity before the lapse, such as a purchase, site account, webinar attendance, course enrollment, or repeated email engagement.
5. The brand can plainly explain why it is writing to them now.

The weakest candidates are imported lists with unclear provenance, addresses collected through a partner without clear permission language, old leads from purchased databases, and contacts who were only ever sent a transactional email. Those records are not a reactivation opportunity; they are a compliance and reputation liability.

In the United States, CAN-SPAM does not turn every old subscriber into an unlawful recipient, but it does impose requirements on commercial email, including accurate headers and subject lines, a valid postal address, a functioning opt-out mechanism, and honoring opt-out requests. The FTC also makes clear that responsibility can extend to companies whose products are promoted, not only the vendor pressing send. (ftc.gov)

That legal baseline should not be confused with a deliverability strategy. A send can meet minimum CAN-SPAM requirements and still be unwanted, complaint-prone, and poorly delivered. The practical standard for reactivation is higher: mail people only when you can credibly say they asked to hear from you and would reasonably recognize the relationship.

Clean the list, but do not confuse validation with permission

List validation is useful, especially after a long mailing gap. It can help identify malformed addresses, invalid domains, obvious role accounts, and addresses that should not be attempted. If your platform supports it, run the batch through an email address verification workflow before planning the send.

But validation is not a permission reset button. An address can be syntactically valid, accept mail, and still be a terrible recipient for marketing email. It may belong to someone who has forgotten your company, an inbox that is no longer actively monitored, or an address with an adverse history you cannot see from a verification result.

That distinction is especially important when marketers discuss spam traps. The original Reddit post warned that neglected addresses can become traps or otherwise cause unexpected trouble because they may accept mail rather than generate a normal hard bounce. The broad operational point is correct: accepting an email at SMTP time does not prove the address is safe, engaged, or wanted. (reddit.com)

A practical pre-send hygiene sequence

Use a layered process rather than one cleaning tool:

1. Remove existing suppressions. Exclude unsubscribes, prior complaints, hard bounces, do-not-contact flags, and legal suppression records before anything else.
2. Deduplicate and normalize. Eliminate duplicates and reconcile multiple profiles belonging to the same person where appropriate.
3. Validate address quality. Flag malformed addresses, invalid domains, and clearly risky records for exclusion.
4. Review source quality. Remove contacts with missing consent provenance, questionable imports, scraped data, or ambiguous acquisition paths.
5. Exclude the coldest records. If the only evidence is an old lead capture with no purchase, no engagement, and no recent interaction, do not make it your test audience.
6. Preserve an audit trail. Keep the reasoning, segment definition, source fields, and send date. This makes future decisions much easier than relying on tribal knowledge.

The aim is not to rescue every historical contact. It is to protect the active portion of your program from the least defensible portion of your database.

How to choose the first re-permission cohort

The original discussion makes a crucial distinction: recency selects who receives the first email; purchase history shapes what you say once they respond. That is a much better framework than immediately sorting by lifetime value.

A customer who spent $500 three years ago may be commercially attractive, but that does not mean they are the safest recipient today. Someone who engaged more recently—even if they spent less—may be more likely to recognize the brand and less likely to complain.

Start with a small cohort that has the strongest combined evidence of prior consent and recent relevance. Depending on the business, that may mean people who purchased 12 to 18 months ago, clicked an email 9 to 15 months ago, logged into an account, used a product feature, attended an event, or made a support request. The exact windows are not universal; a mattress company, subscription software product, media newsletter, and replenishable skincare brand have very different buying cycles.

A simple scorecard for prioritization

Rather than pretending there is one perfect segmentation rule, score the signals you have:

Do not over-rely on opens. Apple Mail Privacy Protection and other factors have made open data less definitive as an individual-level behavioral signal. Clicks, purchases, replies, logged-in product activity, and site behavior are usually stronger indicators when available.

For a first re-permission test, start smaller than your instincts suggest. A few hundred high-confidence records can reveal whether the message, sender identity, and audience are viable. The point is not to create a statistically perfect campaign at the expense of reputation. The point is to establish whether there is enough positive signal to continue.

What a re-permission email campaign should actually say

A re-permission email should not hide the fact that the relationship has gone quiet. The most effective tone is direct, recognizable, and low-pressure.

The recipient should be able to answer three questions in seconds:

• Who is sending this?
• Why am I receiving it?
• What happens if I do nothing?

A clear structure looks like this:

1. Recognize the gap. Acknowledge that it has been a while instead of pretending this is a normal weekly newsletter.
2. Restore context. Remind the person how they may know you: previous order, account, download, event, or subscription.
3. State the value of staying subscribed. Mention product updates, useful resources, member benefits, replenishment reminders, or occasional offers—not vague promises of exciting news.
4. Provide a positive confirmation action. Use one primary button such as “Keep sending me updates” or “Yes, stay subscribed.”
5. Make leaving easy. Include a visible unsubscribe route and, where appropriate, a preference center.
6. Set a consequence for inaction. Explain that non-responders will be removed from marketing mail after a stated period.

Example re-permission copy

Subject: Still want updates from Northstar Coffee?

Preheader: Confirm your preferences and keep receiving brewing guides, releases, and offers.

Body:

Hi Maya—it's been a while since we last emailed. You previously bought from or signed up for updates from Northstar Coffee, and we want to make sure our emails are still useful to you.

If you would like brewing tips, new-roast announcements, and occasional subscriber offers, confirm below. If not, you do not need to do anything—we will stop promotional emails after 14 days.

Button: Keep me subscribed

This approach is intentionally not a discount-first blast. A discount can be added later for people who actively reconfirm. Leading with a large incentive may attract clicks, but it can also mask whether the audience wants the relationship or merely wants a coupon.

The sender identity also matters. Use a recognizable From name, a sending domain aligned with the brand, and a reply-to address that can receive replies. A mysterious sub-brand or a new domain is a poor choice for a list that already has a recognition problem.

Authentication and unsubscribe mechanics are part of the campaign

Reactivation is a bad time to discover that your technical setup is incomplete. Google’s current sender guidance requires authentication and emphasizes avoiding unsolicited mail and making unsubscribing easy for bulk senders. Google also provides Postmaster Tools data for spam rate, reputation, authentication, and delivery errors. (support.google.com)

Yahoo’s guidance calls for easy unsubscribe support, including a functioning List-Unsubscribe header, a clearly visible body unsubscribe link, and timely honoring of unsubscribes. It specifically recommends the POST-based one-click method defined in RFC 8058. (senders.yahooinc.com)

At a minimum, check these items before the first batch:

• SPF and DKIM are configured and passing.
• DMARC alignment is in place and monitored, especially if sending at volume.
• The From domain matches the brand the recipient knows.
• Marketing mail includes List-Unsubscribe and one-click unsubscribe support where required or supported.
• The email body has a visible unsubscribe route.
• Your suppression list syncs reliably across the CRM, ESP, customer support system, and any secondary sending tool.
• Bounce processing is functioning, and permanent bounces are removed.
• You can review delivery and complaint signals by mailbox provider.

If your sending stack needs work, use the email API reference and setup guides to review implementation details before increasing volume. Authentication will not make unwanted email welcome, but missing authentication can make a carefully planned re-permission effort fail for avoidable reasons.

This has become more important as inbox providers make subscription management easier for recipients. Gmail has introduced a Manage Subscriptions view that lets people review frequent senders and unsubscribe directly; Yahoo similarly maintains a Subscription Hub tied to easy opt-out support. The direction is clear: mailbox interfaces increasingly reduce the friction of rejecting unwanted recurring mail. (blog.google)

Measure the right signals during the test

A re-permission campaign is not successful because it produces a respectable open rate. It is successful when it identifies a smaller, safer audience that can receive future campaigns without harming the broader program.

Track results at the cohort and mailbox-provider level. Compare the first test group with your normal engaged audience, not with generic email benchmarks from a report. A 20% open rate may sound acceptable, but it can coexist with complaints or weak placement that make the program unsafe to scale.

Primary signals to monitor

• Spam complaint rate: Treat this as a hard guardrail, not a metric to optimize later.
• Hard bounce rate: An elevated rate means your file and data governance need more work.
• Unsubscribe rate: Often healthier than complaints; make unsubscribing easy enough that recipients choose it.
• Positive confirmation rate: The core output of the program—explicit opt-ins, preference updates, replies, or subsequent meaningful engagement.
• Click-to-confirm rate: More useful than a passive open for proving interest.
• Inbox placement and reputation trends: Review Gmail Postmaster Tools and provider-specific feedback where available.
• Revenue after confirmation: Attribute purchases separately for reconfirmed contacts rather than claiming revenue from everyone who merely received the email.

Set stop conditions before sending. For example, pause expansion if complaints rise above your internal ceiling, if hard bounces exceed a predefined limit, if the sending domain’s reputation deteriorates, or if confirmation volume is too low to justify continuing. The exact thresholds should reflect your list size, normal sending patterns, and provider data, but they should be agreed before the test—not rationalized after a bad result.

A useful reporting model separates three populations: confirmed active, silently inactive, and explicitly opted out. The first group gets the new reactivation flow. The second is suppressed from promotional mail after the re-permission window. The third receives no further marketing email and is retained only as necessary for suppression compliance.

When should you skip re-permission and suppress the list?

Sometimes the correct reactivation strategy is no reactivation at all. The more a list’s source, permission, or identity has changed, the less defensible an outreach test becomes.

Suppress or retire a segment when:

• You cannot establish where the addresses came from.
• The business has been acquired, rebranded dramatically, or moved into a different category, making recognition unlikely.
• The last contact was years ago and there is no meaningful activity since then.
• The contacts were imported from another vendor or partner without direct permission for your brand.
• Previous sending created high complaints, high bounces, or obvious inbox-placement problems.
• The expected business value is small compared with the risk to active programs.
• The segment is in a jurisdiction with consent standards that require more specific legal review.

This is where the skeptical Reddit comments deserve attention. A large legacy list can feel like an asset because it has a visible number attached to it. But list size is not reach. If 5,000 dormant records produce 25 orders but reduce deliverability for a 100,000-person engaged list, the apparent win can be a net loss.

Deleting or permanently suppressing a list is not necessarily waste. It can be a deliberate decision to preserve trust with current subscribers and maintain a clean measurement environment for the channel.

The reactivation flow begins after confirmation—not before

Once a recipient explicitly confirms they want mail, the campaign can transition into a conventional winback or nurture sequence. That is when purchase history, product affinity, and customer lifetime value become more useful.

Shopify’s overview of winback campaigns emphasizes using email, SMS, and advertising to bring lapsed customers back. Those tools can be effective, but they work best after the marketer has defined who is actually eligible for renewed contact and what lapse means for the product category. (shopify.com)

A three-message post-confirmation flow

Email 1: Confirmation and preference capture

Thank the person for staying. Restate what they will receive, offer a frequency choice if possible, and invite them to select relevant product categories or content interests. This improves future targeting and gives the subscriber a sense of control.

Email 2: Personalized value reminder

Use past behavior carefully. For a buyer, show relevant categories, accessories, replenishment logic, or updated versions of what they bought. For a lead, share the strongest educational asset or product use case connected to their original signup source.

Email 3: Commercial re-entry point

Now introduce the offer: loyalty credit, free shipping, trial extension, bundle, consultation, or timely product launch. Avoid training recipients to expect a discount merely for ignoring the brand; the right incentive depends on margin and the reason they lapsed.

The sequence should be shorter and calmer than an aggressive promotional flow. A reconfirmed subscriber may be open to hearing from you, but they have not necessarily returned to the same level of purchase intent they had years ago.

A 30-day rollout plan for an old email list

A safe process does not need to drag on forever. It does need clear stages and decision points.

Days 1–7: Audit and prepare

Inventory list sources, suppressions, consent records, previous campaign performance, and technical setup. Validate the highest-confidence segment, confirm authentication, review unsubscribe handling, and write the re-permission message. Establish a baseline for normal reputation and complaint performance before the test.

Days 8–14: Send the first controlled batch

Send only to the best-supported cohort. Monitor delivery, bounces, complaints, unsubscribes, clicks, replies, and provider-level reputation. Do not send a second batch simply because the calendar says it is time; expand only if the first result stays inside your pre-agreed guardrails.

Days 15–21: Process responses and suppress non-responders

Move confirmers into a dedicated active segment. Let the stated response period expire for non-responders, then suppress them from future promotional mail. Make sure opt-outs and bounces propagate to every system that can initiate a send.

Days 22–30: Start the true winback program

Deliver the first personalized reactivation sequence to confirmed contacts. Measure incremental revenue, not just clicks. Review whether expanding to the next-most-recent cohort is justified or whether the response quality indicates that the reactivation boundary should remain narrow.

The key is that each stage earns the next. This approach is slower than blasting the database, but it produces a cleaner active audience and protects the deliverability foundation on which every future campaign depends.

Conclusion: permission is the first winback conversion

The central question from the Reddit discussion—whether to send a re-permission email before going straight to a winback—has a practical answer: for a genuinely cold list, re-permission should usually come first.

That does not mean every old contact deserves a revival attempt. It means the business should separate people it can credibly contact from records it merely possesses. Audit consent, clean the data, begin with recent and recognizable segments, authenticate correctly, offer an easy exit, and expand only when positive signals justify it.

A smaller list of people who intentionally chose to hear from you is more valuable than a large legacy export that threatens your sender reputation. In email marketing, the first conversion in a winback program is often not a purchase. It is renewed permission.

FAQ

What is a re-permission email campaign?

A re-permission email campaign asks inactive or long-unmailed contacts to explicitly confirm that they still want marketing messages. It is commonly used before a winback sequence when consent quality and recipient recognition are uncertain.

How long is too long before sending a winback email?

There is no universal cutoff because purchase cycles differ. But once a list has gone silent for a year or more—especially two years—treat it as a reactivation and deliverability project, not a routine winback segment. Start with the most recent, best-documented contacts or suppress the weakest records.

Should a re-permission email include a discount?

Usually not in the first message. Lead with clarity and a straightforward confirmation action. After someone reconfirms, use purchase history and product affinity to decide whether an offer is commercially sensible.

What happens to people who do not reply to a re-permission email?

Tell them in advance what will happen, then suppress them from promotional email when the response window ends. Keeping non-responders on a marketing list defeats the purpose of the campaign.

Does email verification make an old list safe to send?

No. Verification can identify obvious address-quality problems, but it cannot prove that a person remembers your brand, still wants marketing email, or will not report the message as spam. Permission and recipient recognition remain essential.