Email deliverability, defined.

A DNS TXT record listing which servers are permitted to send mail for a domain. The receiving server compares the connecting server against that list and records a pass or fail.

Why it matters SPF checks the envelope sender, not the From address a reader sees, so it can pass for a message whose visible sender is forged. It also breaks on forwarding, because the forwarding server is not on the original domain’s list.

A cryptographic signature added to a message header, verifiable against a public key published in DNS under a selector. It proves the signing domain accepted responsibility for the message and that the signed parts were not altered in transit.

Why it matters Unlike SPF, a DKIM signature survives forwarding, which is why a message with both is far more robust than a message with SPF alone.

A DNS policy record that tells receivers what to do with mail claiming to be from a domain when it fails authentication — none, quarantine, or reject — and where to send aggregate reports.

Why it matters DMARC is what turns SPF and DKIM from advisory signals into an enforceable policy. A domain publishing p=none is monitoring, not protecting.

The requirement that the domain authenticated by SPF or DKIM match the domain in the visible From header. Relaxed alignment accepts an organisational-domain match such as mail.example.com against example.com; strict alignment requires the domains to be identical.

Why it matters This is where most misconfigurations hide. Microsoft 365 signs with the tenant’s onmicrosoft.com domain until custom DKIM is enabled, so DKIM passes while failing to align with a vanity From domain — and DMARC then rests on SPF alone.

A set of headers that records the authentication results a message had when it arrived at an intermediary, so a later receiver can see that it passed before being forwarded or modified.

Why it matters ARC exists to rescue legitimate mail that mailing lists and forwarders break. Support is real but uneven, so it is a mitigation rather than a fix.

A standard for publishing a brand logo in DNS so participating mailbox providers can display it beside authenticated messages. It requires DMARC at enforcement, and several providers additionally require a Verified Mark Certificate.

Why it matters BIMI is a reward for having authentication correct, not a way to improve deliverability. It changes nothing about whether mail is accepted.

A policy, published over HTTPS and advertised in DNS, by which a domain declares that sending servers should require TLS and a valid certificate when delivering to it.

Why it matters SMTP’s opportunistic TLS can be stripped by an attacker in the path. MTA-STS closes that downgrade, and TLS-RPT reports when delivery fails because of it.

The address given in the SMTP MAIL FROM command, which is where delivery failures and most automatic responses are returned. It is part of the transport conversation and is not the From line a reader sees.

Why it matters A tool that routes replies using Reply-To will still miss bounces and out-of-office messages, because those go to the envelope sender instead.

The From field inside the message itself — the sender a mail client displays. It is independent of the envelope sender and is the identity DMARC alignment is measured against.

An optional header naming where replies should be addressed, overriding From in a mail client’s reply action. It is advisory: it steers human replies and nothing else.

Why it matters Automatic responders are specified to answer the envelope sender, so Reply-To does not capture out-of-office messages or bounces.

A convention of encoding the recipient’s identity into the envelope sender, so that each message has a unique return address and any bounce can be attributed to exactly one recipient without parsing it.

Why it matters VERP is a widely used convention rather than a standard. It is the usual way a sender knows which address bounced.

A DNS record naming the host that accepts mail for a domain, with a preference number indicating the order to try. Lower numbers are tried first.

Why it matters An MX record often names a security gateway rather than the mailbox host, so it identifies who filters the mail and not necessarily who stores it.

A mailbox configuration that accepts mail for every address at a domain, including addresses that do not exist.

Why it matters A catch-all domain cannot be verified by SMTP probing, because every address appears valid. Address-verification services usually flag these as accept-all rather than valid.

A header carrying one or more URIs — a mailto address, an HTTPS URL, or both — at which a recipient can unsubscribe. Mail clients surface it as a built-in unsubscribe control.

The mechanism defined by RFC 8058, in which a sender adds List-Unsubscribe-Post: List-Unsubscribe=One-Click alongside an HTTPS List-Unsubscribe URI, and the mail client performs an HTTP POST to that URI when the recipient clicks unsubscribe.

Why it matters The POST is essential. HTTP defines GET as a safe method that must not change state, and security gateways fetch every URL in an inbound message before the recipient sees it — so an unsubscribe that acts on GET will unsubscribe people who never clicked anything.

An HTTP method defined as read-only, meaning a client can issue it without expecting the server to change anything. GET and HEAD are safe; POST is not.

Why it matters Automated clients — crawlers, link scanners, mail-security gateways, link previewers — rely on this. Any state change behind a GET will eventually be triggered by a machine.

A record of addresses that must not be contacted again — unsubscribes, complaints and hard bounces — checked before every send.

Why it matters Suppression has to outlive any single campaign or list import. An unsubscribe honoured only within the campaign it happened in is not an unsubscribe.

A header marking a message as machine-generated. RFC 3834 requires automatic responders to set it, using auto-replied for an out-of-office message.

Why it matters It is the only standardised way to recognise an auto-reply. Precedence and X-Autoreply are common in the wild but are conventions, not specifications.

A mailbox provider’s internal assessment of a sending domain, built from recipient engagement, complaint rates, spam-trap hits and sending consistency.

Why it matters The exact inputs and weights are proprietary and unpublished at every major provider. Public advice about how to move it is largely inference, and should be read that way.

The proportion of delivered messages that recipients mark as spam. Google publishes a threshold for bulk senders in Postmaster Tools and states that senders should stay below it.

Why it matters It is measured against delivered mail, not against sent mail, so a small absolute number of complaints on a small send can still be a high rate.

A service by which a mailbox provider reports spam complaints back to the sender. Microsoft, Yahoo and several others operate one; Google provides aggregate rates through Postmaster Tools rather than per-message reports.

Two scores Microsoft Exchange Online stamps on inbound mail, exposed in the X-Forefront-Antispam-Report header. SCL rates the likelihood a message is spam; BCL rates how bulk-like it looks.

Why it matters Reading these on a message you sent to a mailbox you control is the fastest way to find out how Microsoft actually classified it, rather than guessing.

A filtering technique that temporarily rejects mail from an unrecognised sender with a 4xx code, on the basis that a legitimate server will retry and much bulk software will not.

Why it matters It delays first contact rather than blocking it. A delayed delivery is not a bounce and should not be treated as one.

Sending a campaign to a set of mailboxes you control across several providers, then reading where each message landed and what its authentication headers say.

Why it matters It is the only way to turn deliverability from theory into observation, because a sender is otherwise blind: quarantined mail produces no bounce and no complaint.

Raising sending volume gradually on a new domain or mailbox so that reputation is established before volume arrives.

Why it matters A ramp measured in calendar days rather than days actually sent is a common mistake: a mailbox connected weeks ago that has sent nothing has no reputation, and starting it at full volume is the exact pattern warm-up exists to avoid.

A shared IP sends mail for many customers of a provider and carries their combined reputation; a dedicated IP sends for one and carries only theirs.

Why it matters A dedicated IP is only an advantage at volumes high enough to establish a reputation on it. Below that, an unknown IP is worse than a well-behaved shared one.

In Microsoft Graph, a permission an application exercises as the signed-in user and only within what that user can already do. Mail.Send delegated allows sending as that one user.

Why it matters The contrast is an application permission, which acts without a user and typically reaches every mailbox in the tenant. That difference is why one needs a user’s consent and the other needs an administrator’s.

Approval granted by a Microsoft Entra administrator on behalf of a whole tenant, required for application permissions and for delegated permissions a tenant has chosen to restrict.

Why it matters A tenant configured to allow user consent only for verified publishers will block an unverified app outright, regardless of how narrow the scope is.

A Google OAuth scope that requires the app to pass Google’s verification before unrestricted use, but not a third-party security assessment. gmail.send is in this category.

A Google OAuth scope covering especially sensitive data, which additionally requires an independent security assessment by an authorised assessor. The Gmail read, modify, compose and full-access scopes are restricted.

Why it matters The assessment recurs annually and is paid for by the developer, so requesting a read scope an application does not need is an expensive habit.

A Microsoft process that associates an application registration with a verified Microsoft Partner Network account, producing a verified badge on the consent screen.

Why it matters It is what distinguishes an app a cautious tenant will allow from one it will not, and many organisations restrict user consent to verified publishers by policy.

An identifier from the IANA Time Zone Database, such as Europe/London, naming a region and its full history of offset and daylight-saving rules.

Why it matters A fixed UTC offset is not a time zone. Europe/London is +00:00 in January and +01:00 in July, so storing an offset instead of a zone name is wrong for half the year.

The range of local hours and days during which a campaign is permitted to send.

Why it matters The window that matters is the recipient’s, not the sender’s. A message inside the sender’s working hours can still arrive in the middle of the recipient’s night.