Understanding Email Delivery: A Comprehensive Guide

Last updated on Apr 8, 2025 7 min read Technical Guides

Introduction

Email delivery is a complex but essential aspect of modern communication infrastructure. Whether you’re managing emails for a small business or a large organization, understanding the underlying concepts can help you improve deliverability, security, and overall email performance.

This guide covers the fundamental aspects of email delivery, from the basic SMTP protocol to advanced authentication methods and reputation management strategies. We’ll use simple analogies to explain complex concepts and provide practical recommendations for implementation.

SMTP Protocol Basics

Simple Mail Transfer Protocol (SMTP) is the foundation of email delivery. It’s a communication protocol for electronic mail transmission, working like a postal service for the internet.

When you send an email, your email client connects to an SMTP server using TCP port 25, 587, or 465 (for SSL/TLS). The client provides the sender, recipient, and message content to the server.

The SMTP server then determines how to route the message, looking up the recipient’s domain MX (Mail Exchange) records through DNS to find the receiving mail server.

Key SMTP Commands:

  • HELO/EHLO: Identifies the sending mail server
  • MAIL FROM: Specifies the sender’s address
  • RCPT TO: Specifies the recipient’s address
  • DATA: Begins the transfer of the message content
  • QUIT: Ends the session

Email Authentication

Email authentication protocols help verify the identity of senders and protect against spoofing and phishing. Let’s explore the three main authentication methods using the classic “Alice and Bob” analogy.

SPF (Sender Policy Framework)

Think of SPF as a guest list for your domain’s mailroom. It specifies which mail servers are authorized to send emails on behalf of your domain.

How it works: The domain owner publishes a list of authorized sending servers in a DNS TXT record.

Strengths:

  • Easy to implement
  • Prevents direct domain spoofing
  • Widely supported

Weaknesses:

  • Doesn’t verify email content
  • Breaks with forwarding
  • No reporting mechanism

DKIM (DomainKeys Identified Mail)

DKIM is like a wax seal on an envelope. It adds a digital signature to emails that can be verified using a public key published in DNS.

How it works: The sending server adds a digital signature to the email header, which receiving servers can verify using the public key in DNS.

Strengths:

  • Verifies email content integrity
  • Survives forwarding
  • Cryptographically secure

Weaknesses:

  • Complex to implement
  • No reporting mechanism
  • Doesn’t prevent all spoofing

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together, providing instructions on what to do when authentication fails and offering reporting.

How it works: DMARC specifies what to do when SPF or DKIM checks fail and provides a reporting mechanism.

Strengths:

  • Provides reporting
  • Clear policy enforcement
  • Combines SPF and DKIM

Weaknesses:

  • Requires SPF and DKIM to be set up first
  • More complex to implement
  • Requires ongoing monitoring

Why Use All Three?

Each protocol addresses different aspects of email authentication:

  • SPF verifies the sending server is authorized
  • DKIM ensures message integrity and authenticity
  • DMARC provides policy enforcement and reporting

Together, they create a comprehensive authentication system that significantly improves email security and deliverability.

Real-World Scenario: If you only implement SPF, attackers can still forge emails that appear to come from your domain by manipulating the “From” header. DKIM helps prevent this by signing the headers, and DMARC ties everything together with clear policies on what to do when authentication fails.

DNS and Domain Hierarchy

The Domain Name System (DNS) is crucial for email delivery, acting as the internet’s phone book that translates domain names to IP addresses.

Domain Hierarchy (read right to left):

  • Root Domain: The invisible “.” at the end of all domains
  • TLDs (Top-Level Domains): .com, .org, .net, etc.
  • ccTLDs (Country Code TLDs): .ca (Canada), .uk (United Kingdom), etc.
  • Second-Level Domains: example.co, example.ca, example.com
  • Subdomains: mail.example.co, support.example.co

When you control a domain like example.co, you can create subdomains and set DNS records that affect email delivery and authentication.

DNS Records for Email:

  • MX Records: Specify which mail servers accept email for your domain and their priority.

    example.co. 3600 IN MX 10 aspmx.l.google.com.

  • TXT Records: Store SPF, DKIM, and DMARC policies as text.

    example.co. 3600 IN TXT "v=spf1 include:_spf.google.com ~all"

  • A/AAAA Records: Map hostnames to IP addresses (IPv4/IPv6).

    mail.example.co. 3600 IN A 192.168.1.1

  • PTR Records: Reverse DNS lookup (IP to hostname).

    1.1.168.192.in-addr.arpa. PTR mail.example.co.

These records work together to ensure proper email routing and authentication.

DNS and SPF Example for Multiple Domains:

For organizations with multiple domains, each domain needs its own DNS records:

For main domain with Google Workspace:

example.co TXT "v=spf1 include:_spf.google.com include:spf.mailjet.com ~all"

For secondary domain:

example.ca TXT "v=spf1 include:_spf.google.com include:spf.mailjet.com ~all"

For marketing domain:

marketing.example.com TXT "v=spf1 include:spf.mailjet.com ~all"

Email Types

Different types of emails serve different purposes and may require different delivery strategies.

Transactional Emails

Characteristics:

  • Triggered by specific actions or events
  • Time-sensitive
  • Expected by recipients
  • High priority
  • Usually sent to individuals

Examples:

  • Printer sending scan results to users
  • Password reset emails
  • Order confirmations
  • Account verification emails

Best Practice: Send transactional emails from your main domain using your primary email provider for highest deliverability and trust.

Notification Emails

Characteristics:

  • Inform users about updates or required actions
  • Moderate priority
  • Often automated
  • Semi-expected by recipients
  • Can be sent to individuals or groups

Examples:

  • Task notifications
  • Signature requests
  • Quote notifications to customers
  • Project status updates

Best Practice: Send notifications using a consistent sender address (e.g., [email protected]) to help recipients recognize and filter these emails.

Marketing Emails

Characteristics:

  • Promotional content
  • Sent in bulk to multiple recipients
  • Lower priority
  • Not specifically expected by recipients
  • Often part of campaigns

Examples:

  • Newsletter announcements
  • Product updates
  • Special offers
  • Event invitations

Best Practice: Send marketing emails from a separate domain (e.g., marketing.example.com) to protect your main domain’s reputation. Always include unsubscribe options and honor opt-out requests promptly.

Regular Business Emails

Characteristics:

  • Day-to-day communication
  • Personalized
  • Conversational
  • Varying priority
  • Usually sent to individuals or small groups

Examples:

  • Communications with partners
  • Customer support emails
  • Internal team communications
  • Vendor communications

Best Practice: Send regular business emails from your main domain using your primary email provider with proper signatures and branding for consistency and professionalism.

Domain Separation Strategy

For organizations with multiple domains, implement a strategic separation:

Main Domain (example.co):

  • Provider: Primary email provider (e.g., Google Workspace)
  • Use for:
    • Regular business emails
    • Transactional emails
    • Critical communications

Secondary Domain (marketing.example.com or example.ca):

  • Provider: Bulk email service (e.g., Mailjet, SendGrid)
  • Use for:
    • Marketing emails
    • Mass notifications
    • Newsletters

This separation helps protect your main domain’s reputation while still maintaining brand consistency across all communications.

Implement proper authentication (SPF, DKIM, DMARC) across all domains regardless of their use to ensure maximum deliverability and security.

Server Reputation Factors

Your email server’s reputation significantly impacts deliverability. It’s like a credit score for your sending IP and domain.

IP Reputation Factors:

  • Spam complaints
  • Bounce rates
  • Spam trap hits
  • Volume consistency
  • Blacklist presence

Domain Reputation Factors:

  • Authentication setup
  • Domain age
  • Content quality
  • Engagement metrics
  • Sending history

Why Reputation Matters: Email providers like Gmail, Outlook, and Yahoo use reputation scores to determine whether your emails reach the inbox or get filtered to spam. A poor reputation can significantly impact deliverability across all your communications.

Implementation Recommendations

  1. Primary Email Provider Configuration: Configure SPF, DKIM, and DMARC for your main domain
  2. Bulk Email Service Integration: Set up a service like Mailjet or SendGrid for notifications and marketing emails
  3. Domain Separation: Use a separate domain for mass emails
  4. Authentication Across All Domains: Implement SPF, DKIM, and DMARC for each domain
  5. Monitoring: Set up DMARC reporting to monitor authentication results

Benefits:

  • Improved deliverability for all email types
  • Protection against spoofing and phishing
  • Preserved reputation for your main domain
  • Better visibility into email performance
  • Reduced risk of blacklisting

Conclusion

Email delivery is a complex but manageable aspect of modern business infrastructure. By understanding the fundamental concepts of SMTP, authentication protocols, DNS configuration, and reputation management, you can significantly improve your email deliverability and security.

Implementing a strategic approach to different email types and using domain separation can help protect your main domain’s reputation while ensuring all your communications reach their intended recipients.

Remember that email authentication is not a one-time setup but requires ongoing monitoring and maintenance to adapt to changing email security standards and threats.

Further Reading

SMTP Protocol and Standards

Email Authentication

Server Reputation Management

email SMTP SPF DKIM DMARC DNS
Antoine Weill-Duflos
Antoine Weill-Duflos
Head of Technology and Applications

My research interests include haptic, mechatronics, micro-robotic and hci.