Define what belongs on the list
Separate address-level opt-outs, invalid recipients, and temporary delivery failures. A transient error may call for a delayed retry rather than permanent suppression, while a clear unsubscribe or confirmed invalid mailbox should block future sends of the relevant type.
Decide whether suppression applies to one campaign, one message category, or all nonessential mail. Preserve required transactional communication only when the recipient relationship and applicable rules allow it.
Keep updates safe and auditable
Use a normalized address key and record source, timestamp, reason, and scope while limiting access to personal data. Make the check part of every sending path so alternate jobs cannot bypass it.
Provide a controlled process for correcting an address or honoring a new consent where appropriate. Review list growth and reasons, and test that unsubscribe and bounce events take effect before the next send.