~/email-for-developers providers ↗
hub · deliverability

Deliverability and authentication

Picking a great provider is necessary but not sufficient. Inbox placement depends on authentication (SPF, DKIM, DMARC), warming, suppressions, and engagement. Google and Yahoo's February 2024 bulk-sender requirements made authentication mandatory for any sender pushing more than 5,000 messages a day to either provider.

authentication

SPF · DKIM · DMARC · BIMI

SPF

A DNS record listing which servers may send for your domain.

DKIM

A cryptographic signature attached to outbound mail.

DMARC

A policy that tells mailbox providers what to do when SPF or DKIM fail.

BIMI

A standard for showing your logo next to authenticated mail.
operations

Reputation and IP management

IP warming

Gradually ramping volume on a new IP to build reputation.

Dedicated IP

A sending IP reserved for one customer.

Shared IP

A sending IP used by many customers of a provider.

Suppressions

A list of recipients the provider refuses to send to.

Sandbox mode

A starter mode that limits sending to verified addresses.
checklist

Pre-launch deliverability checklist

  1. 01 Publish SPF for the sending domain. Validate with mxtoolbox or a provider tool.
  2. 02 Enable DKIM signing on the provider and add the public key to DNS.
  3. 03 Publish DMARC at p=none with an rua report address you control.
  4. 04 Verify the record in production by sending to a Gmail and Outlook address you can inspect headers on.
  5. 05 After two to four weeks of clean DMARC reports, tighten the policy to p=quarantine, then p=reject.
  6. 06 Send only to recipients who consented. Honor unsubscribe requests within 24 hours per CAN-SPAM.
  7. 07 Suppress hard bounces immediately. Most providers do this for you; verify it is on.
  8. 08 For volumes above 5,000/day to Gmail or Yahoo, confirm one-click List-Unsubscribe is configured.

reading this as developers picking email infrastructure

The question here is which one a backend engineer would rather operate. That means SDK depth in the language already in use, whether a retry can safely be replayed, how much the event log tells you when a customer says the email never arrived, and whether the pricing curve stays sane as volume grows.

Applied to this page, that means weighing developer experience, SDK breadth, idempotency keys, and operating track record ahead of the rest, against password resets, receipts, and magic links shipped from application code.