Tools and providers
Part of Choosing email software from the workflow up, with the buying gates kept apart
Email software implementation: rehearse incidents, rollback and exit first
Before real addresses go in, rehearse four email software incidents, define rollback by version and prove the exit with a restorable portable set.
Email software implementation is ready for real addresses only when the team has rehearsed failure. That means incidents played out on synthetic data, a rollback defined by version and an exit proved by restoring a portable set. A working demonstration shows none of these.
This England-focused procedure uses UK regulator and government sources checked on 5 September 2026. It is not a platform-specific configuration recipe and makes no compliance, security or delivery promise.
What to take away
- Rehearse four incidents on invented addresses before any live send.
- Time the route from detection to the person authorised to pause.
- Define rollback by versionaudience query, template, automation, integration and domain settings.
- Restoring a backup must never reactivate a blocked contact.
- Prove exit by restoring a portable set that carries permission history, suppressions and audit material.
The release record that rollback depends on
Rollback by version only works if each version is written down. Keep a release record for each message stream: purpose, final classification, eligible population, source of addresses, exclusions, owner, legal evidence, sender identity, tracking choice and stop rule.
Release record fields
- Purpose and final classification
- Eligible population and exclusions
- Source of addresses
- Owner and legal evidence
- Sender identity and tracking choice
- Stop rule
Version the data map as well. It covers collection, CRM, integration, email platform, analytics, warehouse, support access, exports, backups and deletion, with a meaning and a system of record for every field.
Four incidents to rehearse
Run each incident on invented addresses on controlled domains, never on copied customer records. The NCSC says practising response plans ensures staff know how to respond during an incident and can highlight problems in the planned response.
| Incident | What to simulate | What the rehearsal must show |
|---|---|---|
| Over-broad audience | A query that returns more people than approved | Who notices and who may pause |
| Broken suppression sync | A suppression that fails to reach the sender | Whether the blocked fixture stays blocked |
| Unavailable integration | A source or destination that stops responding | Which sends wait and who is told |
| Suspected credential misuse | An account that may be in the wrong hands | How access is isolated and logs kept |
Time the route from detection to the person authorised to pause. A rehearsal with no stopwatch cannot show whether the route is fast enough.
What to do once an incident is detected
Capture logs, isolate access, preserve the facts and run the controller's legal assessment. The order matters because a quick fix that overwrites logs removes the evidence the legal assessment needs.
The NCSC's secure SaaS guidance places customer configuration and recovery inside the operating model.
Write each outcome into the release record, with the name of whoever paused the work and who approved restart.
Defining rollback by version
Define rollback for five things: the audience query, the template, the automation, the integration and the domain settings. Each needs a named previous version that can be put back, and a person who may do it.
Restart only when the failed control and the dependent controls have been rerun, the evidence is attached and named owners approve.
Check that the rollback path does not undo suppression. Manual upload, automation, API sync and backup restoration must not silently reactivate the blocked fixture. The ICO's preference guidance explains the role of suppression information, so this is the test to run before any restore.
Access that keeps a rehearsal honest
Separate template editing, population approval, sending, export, integration administration and billing. Give test users only the permissions they need, then remove one user and inspect the resulting access and logs.
Rotate test credentials and keep secrets out of campaign copy and shared files. A rollback that depends on a shared password is not a rollback anyone can audit.
Staging the sending domain
Configure SPF, DKIM and DMARC in a controlled sequence so that each change can be reversed on its own. The NCSC explains that DMARC also generates reports which show how your email is being handled, which gives the rehearsal something to read.
Authentication success is a technical result, not proof of consent or inbox placement. Keep the domain settings in the rollback list and record the date of each change.
Proving the exit
Export contact fields, source and permission history, suppressions, templates, configuration and audit material. Restore the agreed portable set to a safe test location and reconcile counts and field meanings, exclusions and dates.
A downloaded archive is not a successful exit if it omits the evidence needed to operate safely.
Before live data enters, qualified UK privacy, PECR, security, accessibility and commercial reviewers sign their separate decisions. The quality checks on suppression, claims and rollback then apply again before release.
Stop if any mandatory evidence is missing, even when the product demonstration appears successful. The selection checklist sets out the go, hold or stop decision this rehearsal feeds.
Before you act
- Write a release record and a versioned data map for each stream.
- Rehearse an over-broad audience, a broken suppression sync, an unavailable integration and credential misuse.
- Time the route from detection to the person authorised to pause.
- Define rollback by version and confirm it does not reactivate a blocked contact.
- Stage SPF, DKIM and DMARC changes so each can be reversed.
- Prove the exit by restoring the portable set and reconciling counts.
Common questions
Why rehearse incidents before real addresses go in?
Because the failures that matter are the ones a demonstration does not show. Playing them out on synthetic data shows who notices, who pauses and who approves restart before any real recipient is affected.
What does rollback by version cover?
The audience query, template, automation, integration and domain settings. Restart only when the failed control and dependent controls have been rerun, evidence is attached and named owners approve.
How do you prove a successful exit from the email platform?
Export contact fields, source and permission history, suppressions, templates, configuration and audit material. Restore the agreed portable set to a safe test location and reconcile counts, field meanings, exclusions and dates. A downloaded archive is not a successful exit if it omits the evidence needed to operate safely.
