Acceptable Use Policy (AUP)

An acceptable use policy (AUP) is the document that defines what a provider’s customers, or an organisation’s users, are and are not allowed to do with a system, network or email service. For anyone operating mail infrastructure it is the rule set that gives an abuse desk the authority to act on a complaint.

Without one, every abuse case turns into a negotiation. With one, suspending a compromised account or terminating a customer who sends spam is simply the enforcement of a term they already agreed to.

Who publishes an AUP, and for whom?

Two distinct documents both get called an AUP, and confusing them is a common source of trouble:

• A provider AUP binds the customers of an ISP, ESP or hosting company. It is part of the contract, and it is what a blocklist operator or a peer’s abuse desk will look for when judging whether a provider takes abuse seriously.
• A corporate AUP binds an organisation’s own employees in their use of company systems. It is an internal policy document, enforced through HR processes rather than account termination.

The rest of this page is about the provider variant, because that is the one that affects deliverability.

What belongs in an AUP for an email service?

The clauses that actually get used in enforcement are narrower and more technical than general prohibitions:

• Consent requirements. How recipients must have opted in, how long consent remains valid, and what proof the customer must be able to produce on request.
• Prohibited sending practices. Purchased or harvested lists, forged headers and envelope senders, open relays and open proxies, and sending through the service on behalf of an unrelated third party.
• Complaint and bounce thresholds. Concrete numbers — for example, a complaint rate above 0.1 % or a hard bounce rate above 5 % triggers review. Numbers are what make a policy enforceable; “must not send excessive email” is not.
• Content prohibitions. Phishing, malware, and whatever categories the provider chooses not to carry.
• Security obligations. Keeping credentials confidential, securing web forms against injection, and reporting a suspected compromise.
• Consequences and process. What happens at each escalation step: warning, rate limit, suspension, termination. Whether there is a cure period, and who decides.
• Where to report violations, and the response time to expect.

Example: an AUP extract for a mail service

Acceptable Use Policy - Mail Service

1. Consent
   You may send commercial email only to recipients who have given
   verifiable consent. You must retain, and produce on request, the
   date, time, IP address and form used to collect that consent.

2. Prohibited practices
   You may not send to purchased, rented or harvested address lists;
   forge or obscure the envelope sender, the From: header or any
   Received: header; or relay mail on behalf of a third party who is
   not a customer of this service.

3. Thresholds
   Sustained complaint rates above 0.1 %, or hard bounce rates above
   5 % measured over any 24-hour period, will result in your account
   being rate-limited pending review.

4. Security
   You are responsible for all mail sent using your credentials. You
   must report a suspected compromise to security@example.net without
   undue delay.

5. Enforcement
   Violations may result in warning, rate limiting, suspension or
   termination of service. We reserve the right to suspend immediately,
   without prior notice, where continued sending would place our IP
   ranges at risk.

6. Reporting
   Report violations to abuse@example.net. We acknowledge reports
   within one business day, and phishing or malware reports within
   24 hours.

Where should an AUP be published?

Somewhere a stranger can find it without an account. That means a stable, public URL, linked from the terms of service and from the provider’s contact or legal page — not a PDF behind a customer login.

The reason is practical rather than legal. When a blocklist operator or a peer’s abuse desk evaluates a network, a published AUP together with a working abuse@ address is the evidence that the network is managed at all. A provider with neither is easier to list wholesale than to argue with.

How does an AUP relate to blacklisting?

Blocklist operators do not enforce your AUP, and having one does not exempt you from listing. What it changes is the speed of your response when something goes wrong: an AUP with defined thresholds and a defined escalation path lets you suspend an abusive customer within hours, which is usually the difference between a single-IP listing and one that spreads across a whole range. See IP blacklisting for how that escalation works.