What to include in emails to make them acceptable to email servers?

Question

I need to send some automated emails from a program I'm working on. This is a new feature. I'm generating the emails, but they get filtered by most of the email servers that I send tests to. Only one server I am using accepts the emails and it allows a lot of spam through. I need to find what headers or authentication or whatever I need to add to make the emails acceptable to major servers.

I've tried searching the internet for questions about sending automated emails, but the lead responses are all from companies that are willing to send the emails for me, or that are recommending what the body should look like.

How do I authenticate the email so that it doesn't get flagged or filtered as spam?

Answer 1

You're inquiring about email deliverability, which is a big business exactly because it's so hard to get right.

Anti-spam systems key on anything and everything they can to determine what is and is not safe, and it's a cat-and-mouse game with innovations happening on both spam and anti-spam fronts. Rule-abiding bulk email senders tend to get caught in the middle since that's the noise that spammers try to hide in.

First, cover your basics:

• DMARC, DKIM, and SPF
• FCrDNS in sync (HELO, PTR, no CNAME)
• Warm up your sending IP addresses and domains – don't pop up with high volume out of nowhere, ensure your mail relays are known
• Monitor your sending IP addresses for presence on DNSBLs (aka blocklists, blacklists)
• Try to get your sending IP addresses on allowlists (whitelists) like DNSWL.org
• Have special handling to auto-unsubscribe recipients of bounced messages

Learn more at the M³AAWG Sender Best Common Practices paper, authored by a group that coordinates between responsible bulk senders, anti-spam vendors, and bulk receivers

If that's insufficient (which is likely), you need professional help, e.g. from a Email Service Provider.

Answer 2

There is no magic data you can add to your mail to get the mail delivered.

But you can do many things wrong to have the mail not delivered. These include

• sending obviously spam
• sending unwanted mail so that recipients complain, which might result in the IP getting blacklisted for some time
• sending too much mail within a short time
• originating the SMTP connection from a black-listed IP address or from an IP address with a bad reputation. This can easily happen if you've got a new server from a hosting provider. Also, most major providers don't accept mail originating from consumer IP addresses, i.e. cable, DSL etc accounts.
• bad EHLO/HELO in SMTP not reflecting the real server
• messed up setup for DNS reverse lookup
• no MX entry for the sender domain
• discrepancy between sender from SMTP envelope and sender from mail header
• claiming a sender domain which does not belong to you and which is protected by SPF, DKIM, DMARC
• not retrying mail delivery on temporary errors (i.e. greylisting)

but the lead responses are all from companies that are willing to send the emails for me

There are specialized providers which have a good reputation (and are eager to keep it) for sending large amounts of mail while keeping spam mails out. They also work together with major mail providers so that these don't block the mail.

Answer 3

I found https://mail-tester.com (thanks to @schroeder) for testing emails. It found several basic things wrong because I was sending the emails from my development server in my home office and not from a server inside the company VPN. The major things that mail-tester identified were all related to that:

a. My home IP address is on the zen.spamhaus.org PBL because it is meant to be an end-user IP, not a mail server.
b. my IP is not permitted by the SPF for either my corporation or my ISP. I tried both the company email and the one from the ISP.
c. I'm using localhost.localdomain which doesn't have an A record.

About the only thing I can actually do from home (other than acquiring a domain) to improve my score is to include a text-only version of my HTML message. The rest can only be fixed by testing from a corporate server.

I appreciate the input. I'm sure users doing things more extensively will find these answers useful.

The application is just sending some internal reports by email to users who opted in. As long as the basic construction is right I don't expect the users will report the emails as spam.