{"id":550,"date":"2025-02-25T16:27:13","date_gmt":"2025-02-25T15:27:13","guid":{"rendered":"https:\/\/zupertails.be\/wur\/?p=550"},"modified":"2025-02-25T16:27:13","modified_gmt":"2025-02-25T15:27:13","slug":"mails-bounce-or-get-flagged-as-spam-when-sending-to-google-yahoo-hotmail-apple","status":"publish","type":"post","link":"https:\/\/zupertails.be\/wur\/?p=550","title":{"rendered":"Mails bounce or get flagged as spam when sending to Google\/Yahoo\/Hotmail\/Apple"},"content":{"rendered":"<h2><b>Whoever holds the gold makes the rules<\/b><\/h2>\n<p>Late 2023, <strong>Google<\/strong> and <strong>Yahoo<\/strong> announced new guidelines for sending e-mails to their networks.<br \/>\nYes, you read it : &#8220;<span style=\"text-decoration: underline;\"><em>to<\/em><\/span>&#8220;, not &#8220;<span style=\"text-decoration: underline;\"><em>from<\/em><\/span>&#8220;.<br \/>\nIf you&#8217;re an e-mail user and recently got a notification that your mail was refused by Gmail, read on and find out what the reasons could be and how you &#8211; as an admin &#8211; can resolve these issues.<\/p>\n<p><img loading=\"lazy\" class=\"aligncenter wp-image-552 size-medium\" src=\"http:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/show-me-the-money-meme-300x166.png\" alt=\"Show me the money\" width=\"300\" height=\"166\" srcset=\"https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/show-me-the-money-meme-300x166.png 300w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/show-me-the-money-meme-1024x567.png 1024w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/show-me-the-money-meme-768x425.png 768w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/show-me-the-money-meme.png 1355w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/p>\n<h2>Regular mail versus bulk mail<\/h2>\n<p>&#8220;The big boys'&#8221; requirements differentiate between regular (coming from you or me) mail usage and bulk senders, such as mass mailer for commercial purposes.<\/p>\n<p>Having read the guidelines, I can narrow them down to the following&#8230;<\/p>\n<figure id=\"attachment_553\" aria-describedby=\"caption-attachment-553\" style=\"width: 300px\" class=\"wp-caption aligncenter\"><img loading=\"lazy\" class=\"size-medium wp-image-553\" src=\"http:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/Spam_c_Nick_Trachet_cmyk-300x274.webp\" alt=\"it's SPAM\" width=\"300\" height=\"274\" srcset=\"https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/Spam_c_Nick_Trachet_cmyk-300x274.webp 300w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/Spam_c_Nick_Trachet_cmyk.webp 600w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><figcaption id=\"caption-attachment-553\" class=\"wp-caption-text\">spam, bacon and eggs and spam<\/figcaption><\/figure>\n<p>Let&#8217;s start out with the requirements that are applicable to <span style=\"text-decoration: underline;\"><strong>all senders<\/strong><\/span> :<\/p>\n<ul>\n<li>Make sure that <strong><a href=\"https:\/\/www.barracuda.com\/support\/glossary\/domain-spoofing\">domain spoofing<\/a><\/strong> is practically impossible by implementing <strong><a href=\"https:\/\/zupertails.be\/wur\/?p=187\">SPF<\/a><\/strong> in a strict way (use the &#8220;-all&#8221; flag) and sign your mails with a <a href=\"https:\/\/zupertails.be\/wur\/?p=437\"><strong>DKIM<\/strong><\/a> key, where possible.<\/li>\n<li>Make sure that recipients do not flag your messages as SPAM, either manually or automatically.<br \/>\nNow, this sounds like quite a general guideline&#8230; Google stuck a number to this statement and will start flagging you as a &#8220;<em>spammer<\/em>&#8221; if more than 3 out of your 1000 (<strong>0,3 %)<\/strong> mails to their systems get marked as SPAM.<br \/>\nThat 0,3% doesn&#8217;t sound like a lot.<br \/>\n<strong>And it isn&#8217;t.<\/strong><br \/>\nThat&#8217;s why you as an IT implementer should make sure that your customer is not at any time sending out unsollicited mail. Ever.<br \/>\nActivation of MFA, using a separate mailing software for addressing your customers <em>en masse<\/em> and securing the customer&#8217;s domain are a NECESSITY. Protecting mail flow is no longer a matter of\u00a0 just username and password.<\/li>\n<\/ul>\n<p><a href=\"http:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/BPB_WPC8_0000_Main_Image_64e0.webp\"><img loading=\"lazy\" class=\"aligncenter size-medium wp-image-554\" src=\"http:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/BPB_WPC8_0000_Main_Image_64e0-300x300.webp\" alt=\"Bulk up\" width=\"300\" height=\"300\" srcset=\"https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/BPB_WPC8_0000_Main_Image_64e0-300x300.webp 300w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/BPB_WPC8_0000_Main_Image_64e0-1024x1024.webp 1024w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/BPB_WPC8_0000_Main_Image_64e0-150x150.webp 150w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/BPB_WPC8_0000_Main_Image_64e0-768x768.webp 768w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/BPB_WPC8_0000_Main_Image_64e0-1536x1536.webp 1536w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/BPB_WPC8_0000_Main_Image_64e0.webp 2000w\" sizes=\"(max-width: 300px) 100vw, 300px\" \/><\/a><\/p>\n<p><strong><span style=\"text-decoration: underline;\">Bulk senders<\/span> <\/strong>need to tighten the situation a bit more.<\/p>\n<p>Now, before we list what the requirements for bulk senders are, I have to make clear that being defined as a &#8220;bulk sender&#8221; is a very &#8220;grey zone&#8221; kind of moment.<br \/>\nIn official terms of Google, they define a &#8220;bulk sender&#8221; as an entity that sends 5000+ messages\/day.<br \/>\nWe&#8217;ve seen this number being interpreted by Google themselves as a much lower number in a few cases.<br \/>\nBasically it&#8217;s advised, to apply the requirements below for ALL your clients, as it&#8217;s best practice to tighten security as much as possible in every case.<br \/>\nThe grey zone interpretation style of Google&#8217;s own rules also suggests this in between the lines.<\/p>\n<ul>\n<li>Obligatory <strong>SPF <\/strong>and <strong>DKIM<\/strong> as stated above. If you&#8217;re using M365 as mail solution, there&#8217;s no reason not to set this up. It doesn&#8217;t cost anything extra and it&#8217;s a small effort that can count as a quick-fix.<\/li>\n<li>DMARC policy needs to be active.<br \/>\nA simple &#8220;<em>p=none<\/em>&#8221; policy is <strong>ABSOLUTELY NO LONGER<\/strong> a good thing.<br \/>\nThis post explains the reasons why you should in fact <strong>do something with those reports<\/strong>: <a href=\"https:\/\/www.nospamproxy.de\/en\/dmarc-policy-why-p-equals-none-is-a-bad-choice\/\"><strong>https:\/\/www.nospamproxy.de\/en\/dmarc-policy-why-p-equals-none-is-a-bad-choice\/<\/strong><\/a><\/li>\n<li>You&#8217;ve set up a DMARC record. Excellent!<br \/>\nNow actually <strong>make sure all your mail-sending clients (Outlook, CRM tools, printers, &#8230;) are conform<\/strong> with all the measures you&#8217;ve put in place.<br \/>\nHave a cloud-hosted CRM packet that sends over your domain name? Have it use either a M365 connector or add it&#8217;s fixed IP to the SPF record.<br \/>\nIf it has DKIM support, use it. Always.<\/li>\n<li>The number one bad guy in mass mailers that &#8216;ll get your domain flagged as &#8220;<a href=\"https:\/\/www.youtube.com\/watch?v=x6fB8KMUnz0&amp;ab_channel=JoanJett%26TheBlackhearts-Topic\">bad reputation<\/a>&#8221; is not having a <strong>one-click unsubscribe button\/link<\/strong> in mails that you receive after subscribing to them. (<strong><a href=\"https:\/\/datatracker.ietf.org\/doc\/html\/rfc8058\">RFC 8058<\/a><\/strong>)<br \/>\nA <strong>&#8220;List-Unsubscribe&#8221; header<\/strong> needs to be present in the mail headers , as well as a visible unsubscribe link in the message body.<br \/>\nThis link must not lead to a complex unsubscibe procedure with multiple questions, but must literally be &#8220;1 click&#8221;.<br \/>\nAnother self-proclaimed Google\/Yahoo standard in these grey zone rules, implies that the unsubscribe must be done within 2 days after request.<\/li>\n<\/ul>\n<p><img loading=\"lazy\" class=\"aligncenter size-full wp-image-555\" src=\"http:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/Pointer-Systems.jpg\" alt=\"Pointer Sisters\" width=\"250\" height=\"144\" \/><\/p>\n<h2>Some extra Pointers and tools<\/h2>\n<ul>\n<li>Make sure your &#8220;<strong>From<\/strong>&#8221; address and the from-header are the same. Especially the domain name in the address is the more important factor here. The term this applies to is called &#8220;<em>domain impersonation<\/em>&#8220;<\/li>\n<li>Where possible (<strong>not in a M365 case<\/strong>), try to add a valid <strong>reverse PTR<\/strong> DNS record that corresponds to your outgoing mail server name.<br \/>\nIn most cases, you have to address your internet provider in order for them to add a reverse PTR record as this applies to the fixed IP addresses given out by them.<br \/>\nReverse PTR records only make sense in cases where you actually send mail from a fixed IP.<br \/>\nAs an example : I have mail server running that announces &#8220;mail.zupertails.be&#8221; as DNS name in my headers, while having a fixed IP at the office, where the server resides.<br \/>\nMy ISP needs to add mail.zupertails.be as a reverse PTR record, linked to my fixed IP.<br \/>\nI&#8217;ll spare you the tech details, but trust me on this \ud83d\ude09<\/li>\n<li>Actually read the <strong>RUA and RUF reports<\/strong> that you set up in your <strong>DMARC<\/strong> record.<br \/>\nThey can help you understand (even when it&#8217;s already too late and your domain has been flagged as &#8220;bad&#8221;) how your mails end up in spam.<br \/>\n<strong><a href=\"https:\/\/mxtoolbox.com\/DmarcReportAnalyzer.aspx\">https:\/\/mxtoolbox.com\/DmarcReportAnalyzer.aspx<\/a><\/strong> can help you greatly in understanding these otherwise unreadable reports.<\/li>\n<li>There&#8217;s no quick-fix solution when your domain is flagged as &#8220;bad&#8221; or &#8220;spam&#8221;.<br \/>\nDomain reputation is partially an organic thing.<br \/>\nEvery email receiving provider handles the timeout period in its own way and has no concrete documentation for outsiders available on the details as how long your domain is flagged on their side.<br \/>\nYou can get extra information on the <strong>health of your domain<\/strong> and what&#8217;s causing it to suck on <a href=\"https:\/\/dnschecker.org\/domain-health-checker.php\"><strong>https:\/\/dnschecker.org\/domain-health-checker.php<\/strong><\/a><\/li>\n<li><strong>ARC headers<\/strong> are yet another way of verifying the legitimacy of your mail flow.<br \/>\n<a href=\"https:\/\/www.validity.com\/blog\/how-to-explain-authenticated-received-chain-arc-in-plain-english\/\"><strong>https:\/\/www.validity.com\/blog\/how-to-explain-authenticated-received-chain-arc-in-plain-english\/<\/strong><\/a><br \/>\nNot every sender or receiver for that matter checks on ARC headers or allows the implementation of it.<br \/>\nIf the link above is too much to read : ARC allows you to add a list of hosts, that allow the rewriting of mail headers, for instance in cases of mass mailing.<br \/>\nM365 supports ARC.<\/li>\n<li>Stating the obvious : always send your mails in <strong><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc5321.html\">RFC 5321<\/a><\/strong> and <strong><a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc5322.html\">RFC 5322<\/a><\/strong> format, that have their origins in 2008<\/li>\n<\/ul>\n<p><img loading=\"lazy\" class=\"aligncenter size-thumbnail wp-image-556\" src=\"http:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/cs7444_wooden-tools-pack-of-12_01_large-150x150.webp\" alt=\"Tools of the trade\" width=\"150\" height=\"150\" srcset=\"https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/cs7444_wooden-tools-pack-of-12_01_large-150x150.webp 150w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/cs7444_wooden-tools-pack-of-12_01_large-300x300.webp 300w, https:\/\/zupertails.be\/wur\/wp-content\/uploads\/2025\/02\/cs7444_wooden-tools-pack-of-12_01_large.webp 550w\" sizes=\"(max-width: 150px) 100vw, 150px\" \/><\/p>\n<p>Very funky and interesting tools that will help you on your way of becoming the ultimate mail flow troubleshooter :<\/p>\n<ul>\n<li>Gmail&#8217;s Postmaster tools : <a href=\"https:\/\/gmail.com\/postmaster\/\"><strong>https:\/\/gmail.com\/postmaster\/<\/strong><\/a><\/li>\n<li>MxToolbox has way more tools available than the one in their main menu : <a href=\"https:\/\/mxtoolbox.com\/NetworkTools.aspx\"><strong>https:\/\/mxtoolbox.com\/NetworkTools.aspx<\/strong><\/a><\/li>\n<li>Check your domain health. Often. <a href=\"https:\/\/dnschecker.org\/domain-health-checker.php\"><strong>https:\/\/dnschecker.org\/domain-health-checker.php<\/strong><\/a><\/li>\n<\/ul>\n<p>Zuper out<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Whoever holds the gold makes the rules Late 2023, Google and Yahoo announced new guidelines for sending e-mails to their networks. Yes, you read it : &#8220;to&#8220;, not &#8220;from&#8220;. If you&#8217;re an e-mail user and recently got a notification that your mail was refused by Gmail, read on and find<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[8,6,9],"tags":[70,69,66,68,62,13,63,59,64,72,73,65,71,67],"_links":{"self":[{"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=\/wp\/v2\/posts\/550"}],"collection":[{"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=550"}],"version-history":[{"count":2,"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=\/wp\/v2\/posts\/550\/revisions"}],"predecessor-version":[{"id":557,"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=\/wp\/v2\/posts\/550\/revisions\/557"}],"wp:attachment":[{"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=550"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=550"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/zupertails.be\/wur\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=550"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}