Learn

RFC 8617 reference — the three ARC header fields, instance and chain-validation tags, sealing and validation rules, and how receivers use an intact chain to override DMARC failures caused by forwarding.

Implementing BIMI — DMARC enforcement prerequisites, the BIMI DNS record, SVG Tiny PS logo requirements, VMC/CMC certificates, and mailbox-provider support.

RFC 6376 reference plus RFC 8301 (rsa-sha256 required, 1024–4096-bit keys) and RFC 8463 (ed25519-sha256) — signature and key record syntax, tag meanings, canonicalization, signing scope, and risks.

M3AAWG DKIM Key Rotation BCP (rev. March 2019) — semiannual rotation cadence, selector naming schemes, the two-live-keys workflow, p= retirement, CNAME/subdomain delegation for third parties, and rotation auditing.

The DKIM replay problem (draft-ietf-dkim-replay-problem) — how one legitimately signed message gets resent to millions, why l=/x= don't fix it, current mitigations and their tradeoffs, and what it means for ESP infrastructure.

The IETF DKIM WG redesign of DKIM — per-hop chained signatures bound to the SMTP envelope, documented modifications ("recipes"), authenticated bounces, replay resistance — with WG status as of July 2026. NOT a published standard.

What DMARC does and doesn't do, how it builds on SPF and DKIM, domain alignment, the DNS record, and choosing a handling policy.

The XML aggregate feedback format — report structure, transport, filename and subject conventions, external-destination verification, and policy-override reasons.

Operational DMARC deployment — full tag reference, subdomain policy, pct sampling, alignment strictness, report processing, forwarding/mailing-list failure modes, and the none→quarantine→reject rollout.

Per-message DMARC failure ("forensic") reports — ARF format, required fields, the ruf/fo tags, privacy constraints, and why few providers send them.

The standards-track DMARC spec that obsoletes RFC 7489 — full record tag registry, the DNS Tree Walk replacing the Public Suffix List, alignment rules, policy discovery, and what changed.

RFC 7208 reference — record syntax (mechanisms, qualifiers, modifiers, macros), the check_host() evaluation algorithm, DNS lookup limits, result codes, and common pitfalls.

RFC 8601 reference — syntax of the header receivers use to record SPF/DKIM/DMARC/iprev results, ptypes and properties, method result codes, and how to read one.

Misdirected bounces to forged return-paths — why accept-then-bounce causes it, how Backscatterer.org listings work, BATV prvs= tagging mechanics (draft-levine-smtp-batv-01) with operational pros/cons, and modern alternatives.

How bounce messages are structured: the multipart/report DSN format, per-message and per-recipient fields (Action, Status, Diagnostic-Code), and how senders should parse them.

The X.Y.Z enhanced mail system status code taxonomy — classes, subjects, and the full detail-code table — and how to use it for bounce classification.

Per-country reference: Japan's opt-in Specified Electronic Mail Act and APPI, NZ's Unsolicited Electronic Messages Act (express/inferred/deemed consent), Singapore's Spam Control Act (<ADV>, 10-business-day unsubscribe) + PDPA, and Korea's Network Act Art. 50 opt-in with the (광고) label and night-time rule.

Australia's opt-in regime: express/inferred consent, sender ID and unsubscribe rules (5 business days, 30 days, no login), ACMA penalties incl. Commonwealth Bank's record AU$3.55M, plus OAIC APP 7 and tracking-pixel guidance.

LGPD legal bases for email marketing (consent vs. legitimate interest per the ANPD guide), controller/operator roles as they hit ESPs, international transfer state (Resolução 19/2024, EU adequacy), children's-data position, and sanctions up to R$50M.

FTC compliance requirements for commercial email in the US: the seven core rules, the commercial vs. transactional distinction, sender liability, and penalties.

The FTC's regulatory detail behind CAN-SPAM: the codified definitions of sender, primary purpose, and valid physical postal address; the multi-sender designation test; forward-to-a-friend liability; the 10-business-day opt-out; and aggravated violations.

CRTC rules for commercial electronic messages sent to Canada: express vs. implied consent (with time limits), CEM identification and unsubscribe requirements, exemptions, and penalties up to $10M.

A running digest of recent consent guidance and enforcement the KB should track — NZ DIA spam case studies (real outcomes), ACMA's 2024 statement on what 'consent' now requires in Australia, and CNIL's rules for sharing B2C data with marketing partners — each with the operational lesson.

What to capture and retain to prove consent to a regulator or blocklist: the ICO's obtain/record/manage data points, the emerging record structure standards (Kantara Consent Receipt → ISO/IEC 29184 → ISO/IEC TS 27560 → W3C DPV), and an ESP-implementable consent-record schema with retention and evidence-production guidance.

Digest of CRTC CASL enforcement — penalties, undertakings, the section 9 intermediary-liability bulletin, compliance-program guidance, and program statistics — plus the CAN-SPAM statute itself (15 U.S.C. 7704 prohibitions, aggravated violations incl. harvesting, and 7705 promoted-business liability), each with the lesson for an ESP.

The ESP's own GDPR obligations: controller/processor roles per EDPB 07/2020, the Article 28 DPA clauses an ESP must offer, sub-processor rules, international transfers (SCCs 2021/914, EU-US DPF 2023/1795), and data-subject-request handling as a processor.

The EU opt-in rule for email marketing: ePrivacy Art. 13 and its soft opt-in, the GDPR consent standard per EDPB 05/2020, lawful basis (consent vs. legitimate interests), tracking pixels under Art. 5(3) per EDPB 2/2023, and the member-state divergence table.

CNIL's rules for commercial email (B2C opt-in, existing-customer exception, B2B professional-relevance test) and the 2026 recommendation requiring consent for most email tracking pixels — including the deliverability-measurement exemption every ESP needs to know.

The erasure-vs-suppression tension — M3AAWG's Dec 2024 support document on when suppressing an address keeps an ESP a Data Processor and when it makes the ESP a Data Controller, with the 13 suppression events analyzed.

Germany's unfair-competition route to email consent: UWG §7(2) no. 2 express prior consent for B2C and B2B, the §7(3) exception's four cumulative conditions, the double-opt-in case law, and enforcement by competitors via cease-and-desist.

When collecting a child's email address triggers US COPPA (under-13 rule, verifiable parental consent, the FTC six-step plan), the UK Age Appropriate Design Code's 15 standards, GDPR Article 8 age thresholds, and what all of this means for ESP signup forms and age gates.

Dutch spam rules under Telecommunicatiewet Art. 11.7 (ACM), the ICO's B2B marketing guidance, and a cross-jurisdiction answer to 'can I email business addresses without consent?' for UK, France, Germany, and the Netherlands.

How GDPR/UK GDPR objection, opt-out, consent withdrawal, and erasure requests interact with marketing lists and suppression — ICO operational guidance plus enforcement patterns from the EDPB one-stop-shop case digest (551 Art. 17 and 80 Art. 21 decisions).

ICO guidance on direct marketing by electronic mail under PECR and UK GDPR: consent standard, the two soft opt-ins, individual vs. corporate subscribers, bought-in lists, and refer-a-friend.

How to set up your sending domain in ActiveCampaign — add the domain in Advanced Settings, verify it, add the DKIM, Mailserver Domain and DMARC records, and confirm the Authenticated status — with each step linked to ActiveCampaign's current help center.

How to authenticate your sending domain in Brevo — add the domain, add the Brevo code, DKIM and DMARC records, and confirm the Authenticated status — with each step linked to Brevo's current help center.

How to authenticate your sending domain in Cakemail — verify the sender, add the DKIM and DMARC TXT records and the tracking and bounce CNAME records, and confirm the Authenticated status — with each step linked to Cakemail's current help center.

How to self-authenticate your sending domain in Constant Contact — choose DKIM CNAME or TXT records, add the DKIM and DMARC records, and activate self-authentication — with each step linked to Constant Contact's current knowledge base.

How to connect your email sending domain in HubSpot — start the connection, add the two DKIM CNAME records and the SPF and DMARC TXT records, and confirm the Authenticated status — with each step linked to HubSpot's current knowledge base.

How to set up a verified sending domain in Kit (formerly ConvertKit) — add the domain, add the CNAME records and the DMARC TXT record, and validate — with each step linked to Kit's current help center.

How to set up a branded sending domain in Klaviyo — generate the records, add the NS or CNAME records, the verification TXT record and the DMARC TXT record, then verify and activate the domain — with each step linked to Klaviyo's current help center.

How to authenticate your sending domain in Mailchimp — verify the domain, add the two DKIM CNAME records and the DMARC TXT record, and confirm the Authenticated status — with each step linked to Mailchimp's current help center.

How to authenticate your sending domain in MailerLite — add the domain, add the DKIM CNAME record and the SPF and domain verification TXT records, add a DMARC record, and confirm the domain is authenticated — with each step linked to MailerLite's current help center.

How to authenticate a sending domain in Salesforce Marketing Cloud Engagement with a Sender Authentication Package (SAP) or Private Domain — create the domain, choose delegated or self-hosted DNS, publish the name server or zone-file records, and wait for the Active status — with each step linked to Salesforce Help, and the steps Salesforce performs marked as such.

Running an abuse desk at an ESP, ISP, or hosting provider — mandatory role addresses (RFC 2142), report intake, triage priorities, auto-acknowledgement, unblocking, complaint-priority tiers, remediation workflow, ticketing, and staffing/management.

Spamhaus's three-part operational playbook for ESPs digested — set senders up for success (onboarding safeguards, mandatory authentication, cross-functional policy), monitor and educate customers (data tiers, business-impact framing), and take proactive protective measures (risk-tiered IP pools, list scanning, behavioral routing, rate-limiting as leverage); plus the hosting-provider anti-fraud-signup controls.

Detecting, containing, and remediating compromised customer accounts and outbound abuse on ESP/hosting infrastructure — M3AAWG Compromised User ID BCP, Hosting Abuse BCP, and Web Messaging Abuse BCP digested.

How major ESPs (Postmark, Amazon SES, SendGrid) actually implement customer sending-domain authentication — on-behalf-of models, CNAME-delegated DKIM, custom MAIL FROM subdomains, link branding, verification flows, and customer DNS failure modes.

The runbook for winding down a customer who is leaving on good terms — draining in-flight mail, relinquishing or quarantining their dedicated IPs, retiring their sending subdomain and DKIM selectors, reconciling suppression retention against a GDPR erasure request, and revoking access — as distinct from abuse termination.

The M3AAWG Vetting BCP digested — pre-send vetting questionnaires (corporate entity, infrastructure, sending history, list practices), red flags, the test-send methodology, ongoing post-send monitoring triggers, and vetting tools (WHOIS, D&B, PACER).

How sending platforms police customers at the account level — acceptable-use-policy structure and prohibited-use categories, the review/pause/shutdown state machine and the exact bounce/complaint/spamtrap thresholds that trigger it (AWS SES), the account-under-review reinstatement workflow and staged suspension ladder (Twilio SendGrid), and the opt-in/opt-out policy the platform enforces on senders.

The continuous-monitoring architecture of a sending platform — pre-send scanning, send-time anomaly detection against per-customer baselines, post-send feedback watchers, alert design (leading vs lagging, threshold vs trend, per-pool vs per-customer), and the graduated automated-response ladder.

How an ESP vets IP address space before sending on it — prior-use and reputation history via ARIN WhoWas/RDAP and RIPEstat, why recycled IPs inherit blocklist history, the IPv4 transfer/lease-market abuse problem, and pre/post-acquisition checklists.

How mature sending platforms structure multi-tenancy — dedicated vs managed IP pools, shared-pool fallback, per-tenant reputation tracking, and automated tenant enforcement — extracted as design evidence from AWS SES and SendGrid.

The disaster-recovery runbook for a shared IP pool torched by a bad tenant — distinguishing a poisoned pool from one struggling sender, attributing and isolating the offender, containing them, delisting the pool's IPs across blocklist zones, evacuating clean tenants to a healthy pool, and deciding whether to rehabilitate or retire the burned IPs.

How an ESP works a spam-trap-hit incident — detection signals, trap confidentiality, customer notification, acquisition audit, list-hygiene review, and escalation to termination — per M3AAWG "Help! I Hit a Spam Trap!" (Feb 2023).

How mass fraudulent form signups weaponize confirmation email as a DoS against victim mailboxes, the detection signatures of an attack in progress, and the layered defenses form owners and ESPs must run.

How a multi-tenant platform scopes suppression — global vs account vs tenant vs stream — with auto-suppression triggers, precedence and override semantics, retention, and bulk transfer, extracted from AWS SES's documented design.

The signal-vendor landscape for automating ESP customer vetting — email-risk APIs, IP/device fraud scoring, domain intelligence, payment-fraud signals, breach lookups — and the automation architecture that composes them into onboarding gates, progressive trust ladders, and continuous re-scoring.

Why transactional/API senders evade the standard vetting playbook, the transactional-specific abuse catalog (fake-transactional phishing, relayed subscription bombing, API-key blast radius, marketing-as-notification blending, dormant reactivation), onboarding checks matched to the integration, ongoing per-template controls, and the policy language that keeps the transactional/marketing boundary enforceable.

The core principle of deliverability — sending wanted and expected email — and how mailbox providers measure it.

A campaign-lifecycle mental model — assemble list, create content, transmit cleanly, deal with recipient issues, track, manage hygiene, fine-tune — mapping each step to the KB articles that cover it in depth.

What else M3AAWG publishes for senders and ESPs, plus the feedback-loop ecosystem — FBL format types and the per-provider FBL signup list.

The industry checklist for SPF, DKIM, DMARC, and ARC deployment — concrete record requirements for senders, and what intermediaries and receivers are expected to do.

Industry-consensus baseline for commercial senders and ESPs — opt-in standards, unsubscribe requirements, data transparency (WHOIS, DNS/HELO, shared vs. dedicated IPs), client vetting, feedback-loop handling, and bounce/NDR processing.

Industry-consensus rules for choosing, segmenting, authenticating, delegating, and migrating the domains used to send bulk and transactional email.

Digest of the Word to the Wise "Email Best Practices" white paper (Laura Atkins, 2012) — delivery-focused best and worst practices for bulk senders.

Segmenting mail streams into reputation realms — isolating transactional from marketing mail, grouping by quality, and sizing IP counts by volume.

How many sending IP addresses to use, based on daily volume, for a single homogeneous mail stream.

Why new sending IPs must be warmed up, what to expect, and a concrete ramp-up schedule (volume, pacing, audience selection).

The acquisition-integrity angle on list building — Spamhaus's confirmed-opt-in baseline, the acquisition metadata every address should carry, and why harvesting software (illegal in AU/NZ/CA and elsewhere) and purchased/appended/co-reg lists are the root cause of poor list quality.

How mailbox-provider feedback loops (FBLs) work — ARF report structure, enrollment and vetting, and operational recommendations for feedback providers and senders.

The eight ways addresses end up on a mailing list — from confirmed opt-in to harvested — ranked by relationship ownership and complaint risk, with the acquisition rules that keep complaints down.

Exact syntax and semantics of the List-* header fields and the one-click List-Unsubscribe-Post mechanism, including DKIM requirements and why major mailbox providers mandate them.

Apple's published requirements for sending bulk email to iCloud Mail (mac.com, me.com, icloud.com), its filtering model, and its escalation path.

Delivering to corporate mail protected by secure email gateways — how Proofpoint, Mimecast, and Barracuda filter differently from consumer mailbox providers, their delisting paths, link-rewriting systems, and how to warm, diagnose, and measure B2B sends.

Comcast (comcast.net / Xfinity) sender policy: full BL/RL/ES/DM error-code table, SenderScore-based rate limits, connection and recipient limits, blocklist removal, and FBL.

Google's requirements for delivering to personal Gmail accounts — authentication, spam-rate thresholds, one-click unsubscribe, bulk-sender rules, and the enforcement timeline.

How Gmail actually decides placement — per-domain authenticated-sender reputation, ML/LLM spam and phishing classification, tabbed-inbox categorization, and the per-user personalization signals that make one-size diagnosis impossible.

Complete catalog of Gmail SMTP reply codes with their enhanced status codes, meanings, and fixes.

Sender requirements for GMX, WEB.DE and mail.com (United Internet): mandatory aligned DKIM, strict header/DNS rules, RFC 8058 unsubscribe, error-message format, and the CSA path.

The remediation map for Microsoft blocks: Office 365 anti-spam IP delist portal (sender.office.com), delist@microsoft.com for 5.7.511, the Outlook.com sender support form, SNDS/JMRP prerequisites, what each channel needs, and realistic timelines.

Reading X-Forefront-Antispam-Report and X-Microsoft-Antispam headers, SCL and BCL scales with per-level actions, compauth reason codes, how EOP/MDO layers filter, and Tenant Allow/Block List mechanics from the sender's perspective.

Outlook.com postmaster policies, the May 2025 high-volume (>5,000/day) SPF+DKIM+DMARC mandate (Junk folder or 550 5.7.515 rejection, depending on the Microsoft source), connection limits, and SMTP error code reference.

The cross-provider map of sender-support, mitigation, and unblock channels — Google, Yahoo, Apple, Microsoft — with the exact forms, required fields, eligibility gates, and the evidence to gather before any escalation.

How Yahoo's DKIM-domain-based Complaint Feedback Loop works: enrollment via Sender Hub, ARF report format, and operational rules.

Yahoo's server-side data feeds for senders: the Placement Feed (inbox/spam/folder/error/complaints) and Campaign Performance Feed (engagement metrics), with schemas and SLAs.

Yahoo Mail's requirements for all senders and bulk senders (authentication, one-click unsubscribe, 0.3% complaint threshold) plus recommendations on list hygiene, infrastructure, and reputation.

Yahoo Mail's SMTP error/deferral categories (4XX temporary, 5XX permanent, TS* deferrals, PH* content blocks) with causes and recommended actions.

Content-level filtering factors — spam-trigger-word myths vs reality, image/text balance, link practices, headers, subject lines, Gmail tabs, and engagement-optimizing design.

Concrete definitions of bounce, complaint, and engagement metrics, with the numeric thresholds major ESP guides consider healthy — and the corrective actions when a metric goes out of range.

The delivery-event taxonomy an ESP/MTA emits (processed, deferred, delivered, bounce, blocked, dropped, spam-report, open, click), plus insights reporting, delay diagnosis, and engagement-quality scoring — the instrumentation layer beneath the troubleshooting playbooks.

Symptom-driven decision procedures (symptom → hypothesis → discriminating test → fix) for the four delivery failure modes — not delivered, delayed, in spam, missing — with per-provider branches and a scenario library.

How to acquire addresses safely, validate them at signup, handle bounces and complaints operationally, and sunset unengaged recipients before they hurt reputation.

How to send legally required bulk notices — breach notifications, recalls, policy changes — to entire databases (including suppressed and unengaged addresses) without destroying sender reputation.

Outbound queue theory and delivery tuning as a discipline — queue-age diagnosis, per-destination concurrency and rate shaping, connection reuse, adaptive backoff and dead-site detection, scheduler fairness, and bounce-driven traffic-shaping automation.

M3AAWG's Nov 2020 study of automated "bot clicks" from security scanners — <10% B2C vs 20–80% B2B click/open inflation, why filtering NHI out is unreliable, and the practices that reduce it.

How ESPs actually count opens and clicks — pixel and link-wrapping mechanics across Pardot, Eloqua, Bird, Customer.io, and Braze — with unique-vs-total definitions, the "read rate" concept, and what each metric does and doesn't prove.

Community-maintained per-provider MTA shaping baselines — connection limits, messages per connection, rates, TLS requirements, and automated-throttle rules — from the KumoMTA shaping files, attributed and dated.

How inbox placement is actually measured — seed lists, subscriber panels, pixel/read-rate telemetry, and mailbox-provider dashboards — and the systematic bias each method carries, including Google Postmaster Tools' no-data blind spots.

How to read the Received trace fields of a delivered message: the field syntax, bottom-to-top order, which hops you can trust, computing per-hop delay across time zones, and how Received relates to Authentication-Results.

The recovery runbook after a compromise or reputation collapse — securing the account, purging queues, rebuilding suppressions, re-warming vs cold warm-up, reading deferrals during recovery, automated warmup schedules as vendors implement them, and when to replace vs rehabilitate an IP or domain.

How senders monitor IP and domain reputation in practice — blocklist monitoring, seed/inbox-placement testing, provider dashboards, feedback loops, warning signs, and the delisting/recovery workflow.

Why per-address PTR provisioning breaks at IPv6 scale, the five approaches RFC 8501 enumerates (with trade-offs), and what mail receivers expect from IPv6 reverse DNS.

Why receivers impose stricter rules on IPv6 mail — M3AAWG's 2014 inbound-policy paper (/64 aggregation, reject-without-PTR, reject-without-authentication) and what that means for senders and ESPs today.

Dedicated vs. shared IPs, subdomain strategy, domain warm-up, From-address hygiene, feedback-loop wiring, reputation monitoring tools, and a troubleshooting framework.

How open and click tracking work mechanically, and how Apple MPP, Microsoft Safe Links, gateway scanners, and image proxies distort the resulting metrics — with guidance on which signals remain trustworthy.

What Google Postmaster Tools provides — enrollment, every dashboard (compliance, spam rate, reputation, feedback loop, authentication, encryption, delivery errors) and how to interpret each.

Smart Network Data Services (per-IP reputation data for Outlook.com: filter results, complaint rates, trap hits) and the Junk Email Reporting Program feedback loop — data provided, thresholds, and enrollment.

Securing a domain portfolio against hijacking, lookalike/cousin-domain abuse, and spoofing — inventory, registrar/registry locks, defensive registration, monitoring, takedown paths, and the protective DNS records for non-sending and parked domains.

Dated, vendor-attributed benchmark tables — Validity seed-measured inbox/spam/missing rates by provider, country, region, and industry; Marigold and Freshworks per-industry engagement rates; and Sinch's sender-adoption and maturity figures.

Annotated guide to the key independent deliverability expert sites — Word to the Wise, Spam Resource, EmailKarma — and how to use them for current events.

Alphabetical one-stop definitions of the deliverability terms of art used across this knowledge base, with links to the deep articles.

A practical catalog of free diagnostic tools — aboutmy.email, mail-tester, learndmarc, internet.nl, Google CheckMX, MXToolbox Email Health, check.spamhaus.org — what each tests, inputs, and where it fits in a workflow.

How DNSBLs work, the Spamhaus blocklists (SBL/CSS/XBL/PBL/DBL/ZRD/AuthBL/HBL, combined as ZEN), why senders get listed, how delisting works, and Spamhaus's operational deliverability guidance.

The classification layer for the abuse cluster — one entry per abuse type with definition, victim, the detection signals an ESP sees, the typical actor (intentional customer vs compromised customer vs external), and which KB article owns the response.

The industry-consensus stance — deceptive delivery of unsolicited "cold email" is an abusive practice; full definition, deceptive-tactic list, detection indicators, and the non-transferability of consent.

The OECD's cross-border anti-spam policy framework: eight elements, the Council Recommendation on enforcement co-operation, and the BIAC/MAAWG ISP and email-marketing best practices.

BGP/IP hijacking and the IPv4 transfer/leasing market as email-abuse vectors — how spammers acquire fresh "clean" IP space, the research quantifying transferred/leased-prefix abuse, Spamhaus's network-hijacking observations, and RPKI/ROA as the mitigation.

The two surviving commercial allowlist programs — Validity Sender Certification and the Certified Senders Alliance — with exact admission criteria, performance thresholds, costs structure, which receivers honor each, and an honest assessment of when certification pays off.

Trap types (pristine, recycled, typo), how each gets onto a list, what hitting them signals about data quality, and how to respond.

Per-list detail on Spamhaus listing criteria, escalation policy, self-service vs investigated delisting, return/error codes, and how receivers should query the zones — beyond the zone overview in Blocklists & Spamhaus.

How modern content filters judge message bodies — URL/domain reputation lists (SURBL zones, query mechanics, redirector handling) and fuzzy hashing (rspamd shingles, near-duplicate campaign detection) — and what that means for senders' link domains and templates.

What RFC 1870 SIZE, RFC 2920 PIPELINING, RFC 3030 CHUNKING/BINARYMIME, and RFC 3461 DSN (NOTIFY/RET/ENVID/ORCPT) do, and when each matters on an ESP's outbound path.

Deliverability-focused MIME digest: structure and headers, multipart/alternative ordering, quoted-printable and base64 rules and pitfalls, size inflation, and the malformed-MIME defects that trigger filtering.

The auto-responder rulebook: when not to respond, the Auto-Submitted header, null return-path and loop prevention, and how senders should emit and handle OOO/vacation replies.

Deliverability-focused digest of SMTP: session model, envelope vs. content, reply-code semantics, null sender, retry rules, size limits, and timeouts.

Deliverability-focused digest of the message format: required vs. optional headers, From/Date/Message-ID/Reply-To rules, line limits, and malformations that trigger filtering.

The vocabulary of email: MUA/MSA/MTA/MDA, ADMDs, actor roles, mediators vs. relays, and which actor sets which identity field.

How greylisting works (tuple mechanics, timing windows, reply codes), the IETF recommendations for greylisters, and what senders must do — same-IP retries, pool interactions — to pass it.

EAI digest: the SMTPUTF8 SMTP extension, UTF-8 headers, the no-downgrade rule, error codes, and what an ESP must decide about accepting and delivering internationalized addresses.

Working with mailbox providers (wanted/expected email) versus working against them (gaming techniques) — why gaming fails and why sending less can earn more.

DNSSEC-authenticated TLS for SMTP — TLSA record placement and parameters, the sending-MTA validation algorithm, failure handling, and how DANE compares to MTA-STS.

How receiving domains publish an enforceable TLS policy via a DNS TXT record plus an HTTPS policy file, and how sending MTAs discover, cache, and apply it.

The US federal reference for email security — its numbered security recommendations across SPF, DKIM, DMARC, TLS, DANE/MTA-STS and S/MIME, the threat/mitigation matrix, and the federal-compliance context (BOD 18-01, FISMA, SP 800-52/800-53).

How mismatched end-of-DATA parsing between MTAs (bare <LF>.<LF> vs standard <CR><LF>.<CR><LF>) lets an attacker smuggle a second spoofed message that inherits the session's authenticated domain and passes SPF/DKIM/DMARC; the Dec 2023 SEC Consult disclosure and the receiver-side fixes.

The sender-side TLS layer for mail — RFC 3207 STARTTLS mechanics, RFC 7435 opportunistic security, RFC 8314 implicit TLS on 465/587, RFC 8689 REQUIRETLS, and the RFC 8996 TLS 1.0/1.1 deprecation.

The reporting channel for SMTP transport security — DNS record syntax, JSON report schema, the full failure result-type taxonomy, and how to use the reports operationally.

The industry TLS floor — opportunistic TLS everywhere with only TLS 1.2/1.3, encrypted intracompany traffic, encrypted user access (993/995/465/587/HTTPS), and TLS version/cipher logging feeding TLS-RPT.