E-mail deliverability: steps to take

What can you do to make sure email gets through?

You’ve read about how the business critical function of email is no longer reliable. You have also read about how email services are making the delivery of email impossible to know. So, what can you do?

The good news is that there are some things that you can do. The bad news is that they may not be enough, and sometimes they aren’t possible without explicit support from your email service provider. Before I get into the details, though, let me give you the technical structure of modern email.

Today’s Internet-base email system continues to rely on the venerable Simple Mail Transfer Protocol (SMTP) first introduced in RFC 821 by Jon Postel in August, 1982. While it has been augmented over the years, the basic structure of SMTP remains as it always was, based on an inherent trust between Internet services which has been completely broken by the overwhelming volume of unsolicited email (aka “spam“) on the Internet today. The fundamental problem is that SMTP does not provide for the authentication of the sender of a given email, so the recipient server doesn’t know with any accuracy who is sending the message. As a result, it must make a series of guesses to determine suitability for delivery. Those guesses are fraught with risk both that they will miss unsolicited email and that they will mark valid email as spam. This combination of problem has led us to the deliverability problems we see today.

There are a few things that you want to do to increase your chances of having email delivered. The first is obvious: Obey the rules. Don’t send unsolicited bulk email. If you manage a mailing list, make sure that people opt-in. Double opt-in (where the requestors receive an email to verify their request) are the most secure. Beyond that, though, make sure your system is configured in a way that gives you the best chance for delivery, including configuring SPF and DKIM.

SPF

Sender Policy Framework (SPF) provides a method for any domain owner to identify the IP addresses from which email may be sent for their domain. Using DNS TXT records, SPF lists all IP addresses and/or hostnames from which email may be originated. While not completely secure due to ways that DNS plain text answers can be manipulated, it is a good first line of offense for deliverability.

DKIM

DomainKeys Identified Mail (DKIM) is a more advanced method using cryptographic authentication to identify the originator and (optionally) intermediaries in the transit of an email message. Although around as a proposed Internet standard since 2005, its use is still sporadic, creating difficulties for both senders and receivers. For example, the design of DKIM is such that the sending mail server must support it and append the sender’s key to the outgoing email. Shared email systems such as those offered by Google, Yahoo!, AOL, and others must provide the DKIM header content (a digital signature based on the contents of the message) that will be authenticated by the recipient server against the senders DNS-published public key. This service is not universally available, although it is a much more robust mechanism for authenticating senders than is SPF.

As you look for email service providers or speak with your service provider about deliverability, DKIM should be near the top of your list for services that you require from them.

In my next post, I’ll dig deeper into the world of certified email delivery and the challenges of unraveling deliverability issues.

Stephen Hultquist is a contributing editor to InfoWorld Test Center and an on-demand CIO for emerging and other fast-moving companies.