What Mailato checks

Before anything is sent, every design goes through the Mailer's filter. A design that fails is refused and every reason is named; nothing is refused silently.

The filter runs twice. First on the design itself: a design that passes comes back with a preview and a token, and a design that fails comes back with every problem, each named. Then again at send time, on each recipient's own message once their personal fields are filled in; a message that fails then is not sent, and its reason is recorded.

This page describes the Mailer version 1.0.0 and its design rules, version 1.

The checks

A way to stop. The design carries the unsubscribe address as a placeholder, which the Mailer fills in for each recipient. A fixed address written into the design is refused when the design is checked, and a design without the placeholder is refused at send. The unsubscribe link needs its words, at check and at send; there is no default. At send, the Mailer adds the standard one-click unsubscribe headers, so mail apps can show their own unsubscribe button.
Only the people this send allows. Each send names the contact statuses it may go to, such as "subscribed". Any other recipient is refused before the message reaches the email provider.
At most once. Each message has one key. Sending the same key again is answered "already sent". If the email provider's answer is unclear, the message is marked "uncertain" and a person decides; it is never sent again by itself.
A subject, and clean headers. A message with no subject is never sent. Line breaks and hidden control characters are refused in the subject, in the unsubscribe address and in the unsubscribe headers.
A plain-text version. The Mailer makes a plain-text version of every design, with the same personal fields, and sends it beside the HTML. A message whose HTML or plain text is empty is never sent.
Every personal field filled. A personal field such as {{firstName}} with no value is refused. Each value is escaped where it lands in the email, so a contact's details can never become code.
Nothing that runs or loads. No scripts, forms, iframes, embedded objects, event handlers, outside stylesheets, CSS imports or automatic redirects. A link may use https, http or mailto, or be a phone link in one strict shape; anything else is refused. Images load from https only. Addresses that start with javascript: or data: are refused, disguised forms included.
One format per design. A design is either MJML, which the Mailer compiles itself, with no included files and no outside fonts, or HTML; not both.
Every organisation's brand and footer. Mailato will turn this check on for every organisation it connects, so every message carries a logo, one main button, a footer with the postal address and the unsubscribe link, a personal field and the brand colour. It catches honest mistakes; it is not a security check.

If it is refused, it says

Every refusal has a fixed name. The three a designer meets first, written here exactly as the Mailer returns them: validated_template_missing_unsubscribe_placeholder (a fixed unsubscribe address where the placeholder belongs), FORBIDDEN_SCRIPT (a script in the design) and MISSING_MERGE_VALUE (a personal field with no value).

What the filter does not check

Mailato checks the design, not the list.

The words. What the email says, and who approved it, is the organisation's own business.
Consent. Who may receive each kind of message is the organisation's decision, under the rule on the how sending works page.
Canada's anti-spam law (CASL): meeting it is the organisation's duty under the terms.
Whether the organisation's unsubscribe page answers a mail app's one-click request without asking the person anything. The organisation must make sure it does; the filter cannot test it for each message. Before an organisation's first send, Mailato will test that its unsubscribe page answers a mail app's one-click request without asking the person anything.

Questions about these checks: write to contact@mailato.com.

For AI agents: the contract is at https://www.mailato.com/manifest.jsonld