4 ms·

SPF & DKIM are only the start of the story. Use a non consumer IPv6 address, TLS, and DMARC. Have perfect DNS (including correct reverse lookups). Sign your zon

SPF & DKIM are only the start of the story. Use a non consumer IPv6 address, TLS, and DMARC. Have perfect DNS (including correct reverse lookups). Sign your zones. Monitor your IP and domain status with every reputation list on earth. Sign up for the postmaster tools at Google and Outlook. Running your own email ain't a hobbyist thing anymore, you gotta play like you're in the NBA. I'm doing all the above, my deliverability is solid. And pay attention to the changing landscape - for example, I will be implementing ARC real soon.

CaptSpify 9y ago
> Running your own email ain't a hobbyist thing anymore, you gotta play like you're in the NBA I'd disagree. I've been running my own just fine for years. Yeah, you have to put some work into it, but spf/dkim/dns have been suiting me just fine.
- inopinatus 9y ago
  I think this is a matter of perspective. My response was to someone who, in my assessment of what they'd listed, had more of that work to put in. Note they were also talking of using email as a file transfer protocol, which you may not be doing. Also your years of operation may (as with my 17 years of spamless service) have built a very positive reputation for domains and addresses.
roblabla 9y ago
I mean, DMARC, ARC and TLS make perfect sense (though I have none setup because DMARC is nuclear, I didn't know about ARC, and TLS is just up for the submission port for me). But signed DNS ? What does that protect against, malicious registrar ? And the postmaster tools don't work for me on google because the volume of email I send is too low. So there's that. On a sidenote : It's about time something like ARC comes out. If I understand it correctly, it should fix many setups that involve mail forwarding. That'd be a godsend for me, I'll probably set it up soon enough.
- inopinatus 9y ago
  Eh, you have the wrong approach. Just do everything and assume they all contribute to reputation. Maximise, don't minimise, your appearance of being a well-run ESP that takes internet citizenship seriously. For example, zone signing: I don't know if it makes a difference to domain reputation, but it might, so I do it. DMARC is not a nuclear option, no-one starts out with the reject policy, in fact most of my domains are still p=none and I monitor the reports. You absolutely can and should - irrespective of how much information it gives you in return - verify your domains in Google's Postmaster Tools, monitor your IP addresses and junk mail tagging at Hotmail via Microsoft SNDS/JMRP, and setup DMARC reporting e.g. using Postmark's weekly digest. I strongly suspect your lack of TLS is hurting you in particular. For this and other reasons besides I advise you to enable TLS for all inbound and outbound. And use a real cert.

CaptSpify 9y ago

> Running your own email ain't a hobbyist thing anymore, you gotta play like you're in the NBA I'd disagree. I've been running my own just fine for years. Yeah, you have to put some work into it, but spf/dkim/dns have been suiting me just fine.

inopinatus 9y ago
I think this is a matter of perspective. My response was to someone who, in my assessment of what they'd listed, had more of that work to put in. Note they were also talking of using email as a file transfer protocol, which you may not be doing. Also your years of operation may (as with my 17 years of spamless service) have built a very positive reputation for domains and addresses.

roblabla 9y ago

I mean, DMARC, ARC and TLS make perfect sense (though I have none setup because DMARC is nuclear, I didn't know about ARC, and TLS is just up for the submission port for me). But signed DNS ? What does that protect against, malicious registrar ? And the postmaster tools don't work for me on google because the volume of email I send is too low. So there's that. On a sidenote : It's about time something like ARC comes out. If I understand it correctly, it should fix many setups that involve mail forwarding. That'd be a godsend for me, I'll probably set it up soon enough.

inopinatus 9y ago
Eh, you have the wrong approach. Just do everything and assume they all contribute to reputation. Maximise, don't minimise, your appearance of being a well-run ESP that takes internet citizenship seriously. For example, zone signing: I don't know if it makes a difference to domain reputation, but it might, so I do it. DMARC is not a nuclear option, no-one starts out with the reject policy, in fact most of my domains are still p=none and I monitor the reports. You absolutely can and should - irrespective of how much information it gives you in return - verify your domains in Google's Postmaster Tools, monitor your IP addresses and junk mail tagging at Hotmail via Microsoft SNDS/JMRP, and setup DMARC reporting e.g. using Postmark's weekly digest. I strongly suspect your lack of TLS is hurting you in particular. For this and other reasons besides I advise you to enable TLS for all inbound and outbound. And use a real cert.