Six ways a listserv provider can improve email delivery

At OnlineGroups.net, we help people to collaborate using email. That makes it pretty important that people actually receive email that is sent by their groups. Unfortunately, a lot of spam and phishing email is sent to those same people. Their email providers have to sort out the helpful collaborative email from the unhelpful email. Sometimes they get it wrong and people do not receive email from their online groups.

Listserv (aka email discussion list or mailing list) providers like ourselves send a lot of email. It is not surprising that email providers like Gmail and Outlook.com treat us with caution. It is therefore a good idea to take steps to demonstrate that our email is legitimate.

Here are six important steps that a listserv provider should take to demonstrate that it is legitimately sending email to group members.

  1. Make sure people opt in
  2. Make it easy to opt out
  3. Be easy to contact
  4. Support Reverse DNS
  5. Support SPF
  6. Support DKIM

The first three are fairly simple. The last three are a bit technical. I’ll explain each of them in turn.

1. Make sure people opt in

All spam is email people did not ask to receive. The most important thing a listserv provider can do is to make sure the people receiving the email have asked receive the email. At OnlineGroups.net, we do this by encouraging site administrators to invite people to join groups, rather than just adding them. When administrators do just-add people, we ask them to make absolutely sure that they have those people’s consent.

2. Make it easy to opt out

Even when people have opted in, sometimes they just want to get out of a listserv. A listserv provider should make it really easy to do this. At OnlineGroups.net we put an subscribe link at the bottom of every email. It is a mailto link that allows you to send an email to the group address with the subject line unsubscribe. If you do this, OnlineGroups.net will unsubscribe you instantly and silently. You simply will not hear from that group again.

Unfortunately, it can be hard for people to find the bottom of an email. There is often a lot of text from previous messages to scroll past. Sometimes, people email everyone in the group with the subject line unsubscrib. If it is one of our own groups, we unsubscribe those people ourselves.

We also put an unsubscribe link such as List-Unsubscribe:<mailto:ogn_admins@onlinegroups.net?Subject=Unsubscribe> in the email header. Some email clients, such as Gmail, use this to provide an unsubscribe link in their UI.

Ideally, we would provide a one-click unsubscribe link. Sadly, that is going to take a bit of work. You can unsubscribe from an OnlineGroups.net group from the group page, but you need to log in first.

3. Be easy to contact

Sometimes, people want to contact you. They may want to ask you to stop sending them email, or they may wish to report someone who is abusing your email system. Here are some ways to make it easy for people to contact you.

  • The DNS record for your domain should contain a contact email address.
  • Provide an email address such as abuse@example.com for your domain, specifically for complaints about abuse of your system.
  • Provide a contact address in the header of all listserv emails. At OnlineGroups.net, we use a List-Owner header that contains the support address for the site, like the following. List-Owner: <mailto:support@onlinegroups.net> (OnlineGroups.Net Support).
  • Provide a support email address on the web interface for your groups.

4. Support reverse DNS

If you are sending bad email, you should try to hide your server. If you are sending good email, you should make it easy to find your server, and to confirm that you have found it. Reverse DNS helps to confirm that your email server is what it says it is.

All email servers have a URI (Uniform Resource Identifier) and an IP address. Most people prefer to type in a URI such as smtp-1.onlinegroups.net than an IP address such as 50.97.204.243. Computers called Domain Name Servers (DNS) make sure that the URI smtp-1.onlinegroups.net points to the server at 50.97.204.243. Reverse DNS works the other way around. It makes sure that the server at 50.97.204.243 points to the URI smtp-1.onlinegroups.net.

Together, the DNS and reverse DNS show that there is a valid relationship between the owner of the domain name and the owner of the server using the IP address.

If your server uses multiple domains to send email, you only need to create a valid reverse DNS using one of those domains. A receiving server determines the IP address of the sending server, checks its reverse DNS and then checks the forward DNS on the domain returned.

Reverse DNS examples

An email may be relayed by a series of servers before it reaches you. Each time this happens, the server adds a Received header to let you know what it did. The Received header begins by identifying the server that received the email. This part looks like the following.

     Received: from smtp-1.onlinegroups.net (smtp-1.onlinegroups.net
     [50.97.204.243])

The previous example shows an IPv4 (Internet Protocol version 4) address. Some servers use an IPv6 address as in the following example.

     Received: from smtp-1.onlinegroups.net ([2607:f0d0:2101:b9::2])

If your server uses both IPv4 and IPv6, its reverse DNS record must therefore include both addresses.

You can check the reverse DNS using tools such as Web DNS tools and from the command line as follows.

     $ host 50.97.204.243
      243.204.97.50.in-addr.arpa domain name pointer
      smtp-1.onlinegroups.net.
     $ host 2607:f0d0:2101:b9::2
      2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.9.
      b.0.0.1.0.1.2.0.d.0.f.7.0.6.2.ip6.arpa 
      domain name pointer smtp-1.onlinegroups.net

5. Support SPF

If you are sending bad email, you should try to pretend that you are sending it from someone else’s domain. If you are sending good email, you should make it easy to check whether or not an email has come from one of your servers. Sender Policy Framework (SPF) is a way to specify the mail servers that are authorised to send email from your domain.

An SPF record is part of the DNS record for a domain. It contains a list of the IP addresses of servers that are authorised to send email from that domain.

An email server connects to another email server using its IP address and receives an email with a MAIL FROM address in the message envelope (this address can be referred to as the HELO address and appears in the message header as the RETURN-PATH). The receiving email server can check the SPF record of the domain in the envelope MAIL FROM address. If that SPF record contains the IP address of the server it is connected to, then the receiving server can be confident that the sending server is authorised by the owner of the domain.

If your email server uses both IPv4 and IPv6, then your SPF record must contain both addresses.

On a regular OnlineGroups.net site, all group email addresses end in @onlinegroups.net (even if the site uses a subdomain for its web address). This means that the SPF record for the domain onlinegroups.net will be valid for all the groups on these sites. OnlineGroups.net customers can add a custom domain to their site. Groups on sites with custom domains all use the custom domain in their email address. This means that sites with a custom domain (or subdomain) must add an SPF record containing the IPv4 and IPv6 addresses of our mail server.

SPF examples

You can check the presence and validity of an SPF record with this SPF record testing tool or by requesting the TXT DNS record as follows.

     $ host -tTXT onlinegroups.net
     onlinegroups.net descriptive text "v=spf1 ip4:50.97.204.243
     ip4:69.59.157.22 ip4:216.98.148.185 ip4:203.97.50.115 
     ip4:202.6.116.226 ip4:209.126.222.8 ip6:2607:f0d0:2101:b9::2
     ?all"

Here is an example of the header field in an email that shows that the SPF test passed for an email sent from the group with the address groupid@onlinegroups.net to the address user-name@gmail.com.

     Authentication-Results: mx.google.com; spf=pass (google.com:
       domain of groupid+user-name=gmail.com@onlinegroups.net 
       designates 50.97.204.243 as permitted sender) 
       smtp.mail=groupid+user-name=gmail.com@onlinegroups.net

6. Support DKIM

DKIM is a further means of proving that an email comes from where it says it comes from. It proves that an email has not been interfered with since it was sent, and allows a listserv provider to claim responsibility for the email it sends. DKIM is the email equivalent of the air travel security question “did you pack your own bags”?

A mail server that supports DKIM adds a signature to outgoing email. That signature is made by processing the contents and some headers of the email with a private key. The signing server publishes a public key that can be used to check whether the email really was signed by that server. The server receiving the email uses the public key to check that the signature matches the applicable parts of the email. If it is valid, the receiving server knows that the email has not been altered since it was signed.

The signing server does not have to use the same domain that the email uses.

As almost all listservs change one or more headers as it processes the email, the DKIM signatures on incoming email will all be invalid. It is OK to leave them intact as they will be counted as non-existent as long as there is one valid signature in the header.

DKIM examples

Here is a DKIM signature from the header of an email signed by onlinegroups.net.

     DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; 
        d=onlinegroups.net; s=mail; t=1407461250;
	bh=ILHLaEmedNNmU1d9XaPRACcqhmR6GB/KLlRLkcDlxek=;
	h=In-Reply-To:References:Date:Subject:From:To:
        Reply-To:List-Id:List-Post:List-Subscribe:List-Unsubscribe:
	List-Help:List-Archive:List-Owner;
	b=ErZpfCcgiahOJwdiHx2Nwz+zrsQ0ZudJ99hKfeUtW9Mn8Ntzh6S38e2DFd
	  6gZdexqOLE/Ilc6W0ZnFbszra0HusgJ6rC4mJCjlrBJN/On0Ct3JqfFjsx
	  FlDjiA7K/ynSkZ86Xhv77LVCsM8aIx02zBAoujd4UiQvbSDnfh+p3GQ=

Here is an excerpt from the Authentication-Results header field that shows that the DKIM signature was passed as valid.

     Authentication-Results: mx.google.com;
     [...]  dkim=pass header.i=@onlinegroups.net

Leave a Reply

You must be logged in to post a comment.