What is a suppression list?

A list of people and companies your outreach must skip: customers, open deals, partners, and anyone who has asked not to be contacted. Every lead is checked against it before a message is queued.

Should I suppress the whole company if one person there is a customer?

Usually yes for cold outreach, because an account team should own that relationship. The exception is free-mail domains, which are not companies.

How quickly must I honour an opt-out?

Under CAN-SPAM in the US, within 10 business days. In the UK, the ICO describes the right to object to direct marketing as absolute, so stop as soon as you can. Gmail recommends handling unsubscribes within 48 hours.

Do I need a do-not-contact list for B2B email in the UK?

PECR does not require consent to email corporate subscribers, but the ICO says you must give a valid opt-out address and calls keeping a do-not-email list good practice and good business sense.

Stop pitching your own customers: CRM suppression done properly

The email nobody wants to send by accident

A customer who pays you every month gets a cold email from your SDR: "Have you considered a better way to handle X?" It happens constantly, because lead lists are built outside the CRM and nobody checks them against it. At best it is embarrassing. At worst it tells a customer your company does not know who they are, the month before renewal.

The fix is a suppression check: before any message is queued, compare the lead against everyone you should not cold-pitch.

Who goes on the list

Group	Why	Match by
Current customers	Obvious	Email and company domain
People at customer companies	Their account owner should handle it	Company domain
Open deals	A rep is already talking to them	Email and company domain
Recently lost deals	They just said no; give it time	Company domain, with an end date
Partners and resellers	Different relationship	Company domain
Anyone who opted out	Legal requirement in most places	Email, and their stated scope
Your own staff and investors	It happens more than you would think	Email and domain

Churned customers are a judgement call. Many teams win them back with a specific, honest message from someone they know. A generic cold sequence is the wrong tool.

Matching: email, domain, and the free-mail trap

There are two ways to match a lead against the list.

By email address. Exact, safe, but misses colleagues. If anna@acme.com is a customer, a cold email to ben@acme.com still goes out.
By company domain. Catches colleagues. Everyone at acme.com is skipped once Acme is a customer.

Use both, with one critical exception: never suppress a free-mail domain. If one customer signed up as dave.builder@gmail.com and your system suppresses by domain, every lead with a Gmail address is now suppressed. For anyone selling to small businesses or tradespeople, who often use free mail, that can silently wipe out most of your pipeline.

Keep a list of free-mail and ISP domains (gmail.com, outlook.com, hotmail.com, yahoo.com, icloud.com, and national ISPs where you sell) and match those addresses by exact email only.

Two more edge cases:

Subsidiaries and multiple domains. Acme might own acme.com, acme.co.uk and acmegroup.com. Add them all when an account is won.
Former customers' staff who moved. Someone who used you at their last company is a warm lead at the new one. Do not suppress them by their old domain. See job change signals.

A worked example

Say you have 2,000 new leads and a CRM with 150 customer companies, 40 open deals and 60 opted-out contacts. Illustrative numbers:

Exact email matches: 12 leads are existing contacts.
Domain matches on customer companies: another 35 leads are colleagues of customers.
Domain matches on open deals: 18 more.
Opt-outs by email: 4.
A customer on a free-mail domain would have suppressed 310 Gmail leads if matched by domain. Matched by exact email, it suppresses one.

Result: 69 leads removed correctly, and 309 kept that naive domain matching would have lost.

The legal side of opt-outs

The do-not-contact list is not only good manners.

United States. The FTC's CAN-SPAM guide says opt-out requests must be honoured within 10 business days, the opt-out mechanism must work for at least 30 days after you send, and the law makes no exception for business-to-business email. Each email in violation can cost up to $53,088.
United Kingdom. The ICO says PECR's email marketing consent rule does not apply to corporate subscribers, but you must not hide your identity and must give a valid address for opting out. It calls keeping a do-not-email list of businesses that object good practice and good business sense. Named employees' work emails are still personal data under UK GDPR, and the ICO describes the right to object to direct marketing as absolute. Sole traders are treated as individuals and need consent.
Gmail. For bulk senders, Gmail recommends processing unsubscribe requests within 48 hours.

This is a summary, not legal advice. If you send at volume across jurisdictions, get advice for yours.

Keeping it current

A suppression list built once is out of date in a week. The rules that keep it honest:

Sync from the CRM automatically, at least daily, not from an export.
Add a domain the day a deal opens, not the day it closes.
Add opt-outs the moment they arrive, from every channel (a LinkedIn "not interested" counts).
Check at queue time, not only at import. A lead imported last month may be a customer today.

More on the list itself at do-not-contact list.

How Sluice handles it

Sluice syncs with HubSpot both ways. Leads go into HubSpot with a note saying why they are a lead, and customers, open deals and customer companies come back and are never cold-pitched. A customer on free mail like Gmail suppresses only that person, not everyone on Gmail. A "no thanks" reply adds the person to the do-not-contact list, sequences stop on it, and nobody is opened with twice. HubSpot is the only CRM integration so far; Salesforce users would need to export and import. See pricing and follow-up sequences that stop.

Your next step

Export your customer and open-deal domains, run them against your current outbound list, and count the matches. If the number is above zero, put the check in front of every send.