Under one possible protocol, you'd generate and give Spotify a special key that they'd need to send you along with any of their message to you. (Spotify would

Under one possible protocol, you'd generate and give Spotify a special key that they'd need to send you along with any of their message to you. (Spotify would include a field in their account-creation process and existing-account settings where you could specify such a key.) You'd either manually look for that key in any message you received from Spotify or (ideally) you'd set up your email client/service to reject any emails from Spotify unless they also include the special key you gave them. (Maybe such keys could be placed in a custom X-header specified by this protocol.) If this were a common and popular protocol, it'd be easy to generate per-service-and-per-account keys, provide them to a service, and set them up for whitelisting in your email client/service.