Cold Email Infrastructure for Canada

Canada's Anti-Spam Legislation (CASL), in force since July 1, 2014, is commonly described as the strictest anti-spam law in the G7, stricter than CAN-SPAM, often stricter than GDPR on the electronic messaging piece. CASL applies to any commercial electronic message (CEM) sent to, from, or accessed from a computer system in Canada. Unlike CAN-SPAM's opt-out model, CASL is an opt-in law: you need consent before you send, with a handful of narrow exemptions that cold senders must fit inside.

The Canadian Radio-television and Telecommunications Commission (CRTC) enforces CASL and can issue administrative monetary penalties up to CAD $10 million per violation for a corporation. The Competition Bureau and Office of the Privacy Commissioner have overlapping jurisdiction. The private right of action was paused indefinitely in 2017, so class actions are not a current risk, but CRTC investigations and settlements are routine.

The practical implication for cold senders: you cannot legally blast a scraped list of Canadian recipients. You can, however, legally cold-email Canadian businesses under specific exemptions, and thousands of North American B2B teams do so every day. The infrastructure side of the problem is the same as the US, real mailboxes, US/North American IPs, proper warmup, but the legal side requires more care than any other major English-speaking market.

InboxKit pricing reflects Professional, Agency, and Enterprise tiers plus warmup and InfraGuard add-ons.

CASL section 6 prohibits sending a commercial electronic message without consent. The sender has the burden of proving consent existed at the time of sending. There are three ways a cold email to a Canadian recipient can be legal:

1. Express consent. The recipient actively opted in via a clear, informed consent mechanism, signing a form, checking an un-pre-ticked box, clicking a confirmation email. Express consent has no expiry. This is the gold standard and the only safe path for marketing to consumers in Canada. Cold outbound rarely has express consent, by definition.

• Existing business relationship (EBR), the recipient has purchased from you, accepted a contract, or inquired about your products within the last 2 years. Not useful for first-touch cold email.
• Conspicuously published business address, the recipient has published their email address in a way that is not accompanied by a statement declining unsolicited commercial messages, and the message is relevant to their business role. This is the exemption that B2B cold email hangs on.

The 'conspicuously published' exemption is narrower than most senders think. The recipient must have published the address themselves (a corporate website, a LinkedIn profile, a conference attendee list, a professional directory). The address must relate to their business, not personal. The message must be relevant to the recipient's role, pitching a marketing tool to a CFO is not relevant. The sender must not have been told 'do not send unsolicited email' anywhere on the page where the address was published.

3. Exemptions in section 6(5) and (6). A handful of carve-outs apply to: messages to an organization's employee about their role (internal), family/personal relationships, messages responding to a request, legal and regulatory notices. These rarely apply to cold outbound.

• Sender's name and legal entity (if different)
• Sender's physical mailing address
• One other contact mechanism (phone, email, URL)
• An unsubscribe mechanism that must be honored within 10 business days
• The unsubscribe must be free and must not require the recipient to submit information beyond their email address

This is not a CAN-SPAM footer, it's a CASL footer, and it has to appear in every CEM.

This is the one section most Canadian cold-email programs rely on, so it's worth getting right. CRTC has published several bulletins clarifying section 10(9)(b), and the pattern that survives enforcement is:

The address is public on an official business source. The recipient's @company.ca address appearing on the company's Team page, LinkedIn profile with a public email, conference attendee list, industry association member directory, or regulator-published professional register.

The public source has no 'no solicitation' statement. If the page that publishes the address says 'we do not accept unsolicited marketing email' anywhere, the exemption is defeated for that address.

The message is relevant to the published role. Pitching a B2B SaaS tool to a VP of Operations with the address published on the company's leadership page is relevant. Pitching the same tool to an accounts-payable clerk whose address is in a public invoice template is not.

The sender can document how the address was discovered. Keeping a record of the source URL, the scrape/capture date, and the role-relevance justification is critical. CRTC can compel records, and the burden is on the sender to prove the exemption applied at the time of sending.

• Pull contacts from LinkedIn Sales Navigator searches with 'public email' visible
• Scrape corporate Team/About/Leadership pages with a tool that preserves the source URL
• Cross-reference with Canada's publicly-available business registries (e.g. ic.gc.ca Federal Corporations)
• Do not buy lists from a data broker, the chain of provenance almost never survives a CASL audit
• Maintain a suppression list keyed by email that survives mailbox rotation and outreach campaign resets

The conservative read: if you can't point at the public source URL and defend why the pitch is relevant to the role, don't send.

Canada's inbox mix is North American, similar to the US but with a larger share of ISP-branded webmail, because Canadian broadband subscribers often still use mailboxes from their telco.

The data-residency conversation matters less than people assume. CASL does not require Canadian recipient data to stay in Canada, and major Canadian enterprises routinely use US-hosted Google Workspace and Microsoft 365 tenants. Privacy laws like PIPEDA and Quebec's Law 25 do impose cross-border transfer disclosures, but those apply to the controller of the recipient data, not to the cold sender's choice of sending IP location. US IPs deliver fine to Canadian recipients.

Quebec is a special case. Law 25 (formerly Bill 64) adds French-language requirements for any commercial communication with Quebec residents. A cold email sent in English to a Quebec recipient at their work address is generally fine for CASL purposes, but if the recipient is a consumer, Quebec's Consumer Protection Act and Law 25 add overlapping obligations. Practical rule: treat Quebec B2B cold email the same way you treat the rest of Canada under CASL, and have a French translation ready if the recipient replies in French.

• 2-3 .ca domains for Canada-native outreach (Canadian recipients open .ca addresses at noticeably higher rates)
• 3-5 .com or .io domains for pan-North-American outreach
• Register .ca domains through a Canadian Internet Registration Authority (CIRA) certified registrar
• Meet CIRA's Canadian presence requirement (a CA registrant or authorized agent)
• Spread across at least two registrars

• Google Workspace default (Canadian B2B is Gmail-heavy)
• Microsoft 365 at 30-40% ratio to reach enterprise and bilingual-French recipients
• Per-mailbox volumes ramp slowly: 20/day week 1 → 40/day week 2 → 60/day week 3 → 80+/day after week 4
• Isolated warmup for 14-28 days before first cold touch

• SPF: v=spf1 include:_spf.google.com ~all (or Microsoft equivalent)
• DKIM: two selectors published
• DMARC: start at p=none, tighten to quarantine after 30 days of clean reports
• MX: matches your mailbox provider

• Legal entity name of sender
• Physical mailing address (Canadian or foreign. CASL accepts both)
• Phone or URL as a second contact
• Unsubscribe link that works with a single click and does not require login
• Unsubscribe must be honored within 10 business days (CRTC treats slower as non-compliance)

InboxKit's isolated warmup network and InfraGuard monitoring give Canadian senders early warning on domain reputation issues before they compound into CRTC-visible problems.

Canadian cold email volume planning is the same Gmail+Microsoft 365 math as US outbound, with two extra rules.

Rule 1: Keep unsubscribe-rate per campaign under 2%. CRTC does not publish a hard threshold, but audit patterns suggest campaigns with higher unsubscribe rates are flagged for investigation because the bureau interprets high unsubscribes as a signal that consent was weak.

Rule 2: Keep complaint rate under 0.1%. Canadian recipients can forward spam to the Spam Reporting Centre which feeds complaints directly to CRTC and the Competition Bureau. Sustained complaints are the most reliable predictor of investigation.

• Week 1: 10-20/day per mailbox, warmup network only
• Week 2: 20-40/day per mailbox, 5-10 real cold touches to engaged contacts
• Week 3: 40-60/day per mailbox, 70/30 warmup-to-cold
• Week 4+: 60-100/day per mailbox, 30/70 warmup-to-cold

• ~50 active mailboxes at 60/day each
• ~15 domains at ~3-4 mailboxes each
• InboxKit Agency ($99/mo, 30 slots) + 20 extra mailboxes at $3.25 = $164/mo
• Warmup add-on: 50 × $3 = $150/mo
• InfraGuard: ~$15/mo for 15 domains
• Total: ~$329/month for 3,000 Canadian cold emails/day: roughly CAD $0.005 per sent message at today's FX.

CRTC investigations start from complaints and escalate via records requests. A Canadian cold email program that survives one looks boring on paper:

• Email address
• Source URL where the address was conspicuously published
• Capture date
• Role relevance justification (one-liner)
• Whether the source page had a no-solicitation notice (should always be 'no')
• Send history (campaign IDs, dates, opened/replied/unsubscribed flags)
• Unsubscribe date if applicable

• Sender legal entity on the footer
• Physical address used
• Unsubscribe mechanism tested and working
• Copy of the message body
• Sending domain(s) used

• Training log for anyone on the team who sends or supervises cold email
• CASL compliance policy document
• Suppression list integrity check (proves unsubscribes were honored)

InboxKit's per-mailbox activity logs give you the send history piece automatically. The legal and list-provenance records you build yourself.

• [ ] Register 5-10 domains (mix of .ca, .com, .co)
• [ ] Meet CIRA Canadian presence requirement for .ca domains
• [ ] Provision Google Workspace mailboxes (65%) + Microsoft 365 mailboxes (35%)
• [ ] Automated DNS via InboxKit + Cloudflare
• [ ] Enable isolated warmup on every mailbox
• [ ] Enable InfraGuard on every domain

• [ ] Document CASL compliance policy
• [ ] Build list from conspicuously-published sources only
• [ ] Retain source URL + role relevance per contact
• [ ] Test unsubscribe flow end-to-end
• [ ] Confirm the CASL footer is present on every sending template

• [ ] Start sequences at 40-60/day per mailbox
• [ ] First-touch plain text, clear sender identity, relevant pitch, simple unsubscribe
• [ ] Monitor complaint rate, throttle any campaign above 0.15%
• [ ] Weekly review across Gmail, Microsoft 365, and ISP-branded recipients
• [ ] Quarterly suppression list audit

• Any CRTC correspondence or Spam Reporting Centre forward
• Google Postmaster domain reputation drops to Medium
• Complaint rate above 0.2%
• Unsubscribe rate per campaign above 3%