Distribution list: the address nobody owns and everybody uses

Every company has a distribution list created for a project that ended in 2023, still receiving mail, still including two people who left and a contractor nobody remembers engaging. Lists are useful precisely because senders do not have to think about who is on them — which is also why they decay invisibly, and why the decay only becomes visible when something confidential reaches somebody it should not have.

What every distribution list needs

• A named owner, recorded somewhere other than the list itself.
• A stated purpose in one line, so a sender can tell whether this is the right audience.
• A membership basis — a role, a team, a project — rather than a set of individuals added by hand.
• A review date, because membership drifts faster than anything else in a directory.
• A decision about who may send to it. Open lists are fine for some purposes and a broadcast risk for others.

Derive membership, do not curate it

A list whose members were added individually is a snapshot of who was relevant on the day it was made. A list derived from something that changes — the team, the role, the project assignment — updates itself when people move, which is the only mechanism that survives contact with a reorganisation. Where derivation is genuinely impossible, the compensating control is a short review cycle and an owner who is asked rather than reminded.

Audit who can send to an all-company list before you audit who receives it. The receiving side causes embarrassment; the sending side is how a convincing phishing message reaches everybody at once with internal legitimacy.

Cleaning up the ones you have

1. List every list, with last-used date. The unused half can be removed with a single announcement.
2. Assign an owner to each survivor, by name. Unowned lists go on the removal pile by default.
3. Reconcile membership against current people and current suppliers, not against memory.
4. Remove external addresses from internal lists, or rename the list so senders know it reaches outside.
5. Set review dates and put them in the owner's calendar rather than in a policy.

When a list is the wrong tool

Three cases. If recipients need to reply to each other, you want a channel rather than an alias — threaded replies on a distribution list are how a hundred people watch two of them negotiate. If the audience is external, you want a mailing tool with consent records and unsubscribe handling, because a list has neither. And if the message is a status update that goes out weekly, you want a written update in a known place; a list guarantees delivery, not attention.

Ettex Contacts holds the register that makes this maintainable: lists with an owner, purpose, membership basis and review date, with external addresses marked as such. Where a list is really a contact segment that gets mailed, the consent and source fields matter more than the membership — which is the distinction a plain alias cannot make.