Email deliverability is deceptively complex. For most people it just works. You write an email, send it and it arrives at the other end. A lot goes on between when you click send and when it is accepted at the other end.
What goes on between clients/mail servers – and mail server/mail server – is complicated enough but people also need to make sure when they get there they don't end up in the SPAM folder.
Ensuring Email Deliverability
– SPF, DKIM & DMARC
There is so much SPAM email being sent that almost every email sent goes through more than one SPAM check on it's journey between sender and receiver.
Different places do different kinds of checks. Often when email is sent from your computer or phone it goes up to an external outgoing mail server to be sent. Even at that early stage some checks might be done – your mail client might do SPAM score checking and the mail server should certainly require authentication for outgoing mail.
When it leaves your server it bounces through routers and switches, different hosts and relays, before arriving at the receiving mail server. Checks may be done in the process of its transfer.
When the end server receives the message it will probably do more checks before putting it into the mailbox of the receiver. In the end the receiver might even do additional checks in the mail client.
Securing Your Outgoing Mail
There are a handful of accepted standards to help make sure mail you send gets to where it needs to be and that it stays out of the SPAM folder. They also help prevent anyone sending mail and spoofing your address or pretending to be you.
Mail Missing In Transit
Mail from known bad hosts, IP ranges and domains are often terminated en-route.
You want this to happen. You should not be sending mail from any known bad addresses.
The most commonly used method to ensure the host sending outgoing mail is authorised to send for that domain is called SPF.
SPF – Sender Prefered From
At the DNS server you can add some records that inform others which hosts and IPs you want to allow mail to be sent from. You also set default actions to take when messages fail SPF check.
Not everyone treats SPF records with the respect they deserve. It's because a lot of SPF records are actually misconfigured. Trusting a system which many obviously have misconfigured would not be great for everyone.
The next common way to secure your outgoing mail is DKIM.
DKIM – DomainKeys Identified Mail
DKIM is a method to cryptographically sign a message, either as the origin or an authorised intermediary host. Receivers can use the key to confirm the signature of the message and that it's authorised and untampered.
Since DKIM requires key generation and is underpinned by a more complex set of sub-systems it is often treated with much more authority than SPF.
The final piece of the trio is DMARC.
DMARC – Domain-based Message Authentication, Reporting & Conformance
Some mail hosts will use SPF or DKIM for to validate a message. Some hosts don't. And many treat failures differently.
DMARC allows you to instruct mail servers who listen exactly what you want to happen to messages that fail those SPF or DKIM checks.
You can set a policy of:
- do nothing
- quarantine (goes to spam)
- or reject
As well as the percentage of mails to apply the policy to (this helps during initial testing and when any changes are made).
What it also does is allow a method for mail receivers to easily contact you and report results of the mail they have processed for you. They will report sending IPs and results from SPF/DKIM as well as what they done with the message in the end.
That information is extremely useful to anyone managing an outgoing mail server and can be used to spot problems with sending (or fake senders) very quickly.
When You Want Mail To Be Terminated In Transit
If mail is received and you have not authorised it then you want it to be terminated before it gets into anyone's mailbox. At the very least you will want it to go to SPAM.
Mail failing authorisation is probably using a spoofed from address or is otherwise illegitimate.
SPF, DKIM and DMARC combined helps to stop any mail you did not authorise to send from ending up in front of the user. That prevents server algorithms picking up on cues from the user when they delete without opening or throw messages into spam folders.
When Termination In Transit Is A Problem
I'm going to say that you always want unauthenticated mail to be terminated. No exceptions. The problem is that very often other sites spoof your email for a legitimate reason.
Say you fill in a form online and add your email address, often that notification is sent to a site owner via email with your address as the FROM address.
Those messages will fail your checks (actually sometimes they might not and instead be allowed through but treated as a soft failure).
It's a common practice but I'm going to say it right now. It's just plain wrong. You should never be sending mail with a FROM address that you are not explicitly allowed to send for.
The proper configuration is this, please use it:
- FROM: [server address]
- TO: [receiver address]
- REPLYTO: [form filler address]
Deliverability for Senders with SPF, DKIM and DMARC is Dramatically Improved
No matter what you are sending mail for: it could be personal mail or business mail; follow ups, outreach messages or newsletters. No matter the purpose of the mail it's always better when it arrives at it's destination.
Using these systems helps to build domain trust from receivers and shows you have taken steps to secure your mail. Deliverability of mail that's taken step to ensure it arrives is generally better than mail sent with no thoughts about that.
The only messages you do not want to arrive are SPAM messages you have not authorised. These systems allow you to publish policies instructing receiving servers that you do not want that unauthorised mail to arrive.
Terminating mail that is questionable before users see it also means that cues used by email providers to spot messages users consider as SPAM are never shown on your messages. This increases the domain trust even more.