---
title: "Acceptable Use Policy (AUP)"
description: "An acceptable use policy (AUP) defines what is and isn't allowed when using a computer system, network, or email service."
url: "https://mailmum.io/glossary/acceptable-use-policy-aup/"
---

# Acceptable Use Policy (AUP)

An acceptable use policy (AUP) is the document that defines what a provider's
customers, or an organisation's users, are and are not allowed to do with a
system, network or email service. For anyone operating mail infrastructure it is
the rule set that gives an [abuse desk](https://mailmum.io/glossary/abuse-desk/) the authority to
act on a complaint.

Without one, every abuse case turns into a negotiation. With one, suspending a
compromised account or terminating a customer who sends spam is simply the
enforcement of a term they already agreed to.

## Who publishes an AUP, and for whom?

Two distinct documents both get called an AUP, and confusing them is a common
source of trouble:

* **A provider AUP** binds the customers of an
  [ISP](https://mailmum.io/glossary/internet-service-provider-isp/),
  [ESP](https://mailmum.io/glossary/email-service-provider-esp/) or hosting company. It is part of
  the contract, and it is what a blocklist operator or a peer's abuse desk will
  look for when judging whether a provider takes abuse seriously.
* **A corporate AUP** binds an organisation's own employees in their use of
  company systems. It is an internal policy document, enforced through HR
  processes rather than account termination.

The rest of this page is about the provider variant, because that is the one
that affects deliverability.

## What belongs in an AUP for an email service?

The clauses that actually get used in enforcement are narrower and more
technical than general prohibitions:

* **Consent requirements.** How recipients must have opted in, how long consent
  remains valid, and what proof the customer must be able to produce on request.
* **Prohibited sending practices.** Purchased or harvested lists, forged headers
  and envelope senders, open relays and open proxies, and sending through the
  service on behalf of an unrelated third party.
* **Complaint and bounce thresholds.** Concrete numbers — for example, a
  complaint rate above 0.1 % or a hard [bounce](https://mailmum.io/glossary/bounce-message/) rate
  above 5 % triggers review. Numbers are what make a policy enforceable; "must
  not send excessive email" is not.
* **Content prohibitions.** Phishing, malware, and whatever categories the
  provider chooses not to carry.
* **Security obligations.** Keeping credentials confidential, securing web forms
  against injection, and reporting a suspected compromise.
* **Consequences and process.** What happens at each escalation step: warning,
  rate limit, suspension, termination. Whether there is a cure period, and who
  decides.
* **Where to report violations,** and the response time to expect.

## Example: an AUP extract for a mail service

```txt
Acceptable Use Policy - Mail Service

1. Consent
   You may send commercial email only to recipients who have given
   verifiable consent. You must retain, and produce on request, the
   date, time, IP address and form used to collect that consent.

2. Prohibited practices
   You may not send to purchased, rented or harvested address lists;
   forge or obscure the envelope sender, the From: header or any
   Received: header; or relay mail on behalf of a third party who is
   not a customer of this service.

3. Thresholds
   Sustained complaint rates above 0.1 %, or hard bounce rates above
   5 % measured over any 24-hour period, will result in your account
   being rate-limited pending review.

4. Security
   You are responsible for all mail sent using your credentials. You
   must report a suspected compromise to security@example.net without
   undue delay.

5. Enforcement
   Violations may result in warning, rate limiting, suspension or
   termination of service. We reserve the right to suspend immediately,
   without prior notice, where continued sending would place our IP
   ranges at risk.

6. Reporting
   Report violations to abuse@example.net. We acknowledge reports
   within one business day, and phishing or malware reports within
   24 hours.
```

## Where should an AUP be published?

Somewhere a stranger can find it without an account. That means a stable, public
URL, linked from the terms of service and from the provider's contact or legal
page — not a PDF behind a customer login.

The reason is practical rather than legal. When a blocklist operator or a peer's
abuse desk evaluates a network, a published AUP together with a working `abuse@`
address is the evidence that the network is managed at all. A provider with
neither is easier to list wholesale than to argue with.

## How does an AUP relate to blacklisting?

Blocklist operators do not enforce your AUP, and having one does not exempt you
from listing. What it changes is the speed of your response when something goes
wrong: an AUP with defined thresholds and a defined escalation path lets you
suspend an abusive customer within hours, which is usually the difference
between a single-IP listing and one that spreads across a whole range. See
[IP blacklisting](https://mailmum.io/glossary/ip-blacklisting/) for how that escalation works.