How a mail arrives

Email is older than the web and was designed without sender verification. Everything that decides today about authenticity and spam was added on top afterwards. That explains why delivery sometimes feels like a matter of luck.

The path of a message

A program hands the message over via SMTP to a server that accepts it. That server looks up the MX record in the recipient domain’s DNS, which names the responsible mail server, and delivers there.

Two things follow. First: without an MX record no mail arrives, regardless of whether the website works. Second: the MX points at a name, not at an address, and it can name several targets with priorities so that a second server takes over when the first does not answer.

Why acceptance deliberately hesitates

Greylisting temporarily rejects an unknown sender combination on the first attempt and accepts it on the second. A compliant mail server retries automatically, a crude bulk sender often does not. The price is a delay of minutes on the first mail from a new sender. That is not a fault, it is the purpose.

The three records that vouch for the sender

All three are DNS entries in the zone of the sending domain. They answer three different questions and do not replace one another.

SPF answers: who may hand in mail on behalf of this domain? The record lists the permitted servers. It has a hard limit: when mail is forwarded, the handing-in server changes, and SPF fails although nothing is wrong.

DKIM answers: is the message unaltered and does it come from this domain? The sender signs headers and body cryptographically, the public key sits in DNS. Forwarding survives that, as long as nobody touches the content.

DMARC answers: what should the recipient do when SPF and DKIM do not match? The record states a policy, from observe only through quarantine to reject, plus an address for reports. Only DMARC turns the two checks into a statement.

Tip

The order when setting this up: get SPF and DKIM right first, then let DMARC only observe, read the reports, and tighten the policy after that. Starting with a hard policy locks out yourself first, usually the newsletter or your own website’s contact form.

Reputation

Technically correct mail still gets filtered when the sending address or network has a poor reputation. Recipients score behaviour over time: complaints, delivery attempts to non-existent recipients, sudden jumps in volume. That is why a new sending path should be used cautiously at first, and why one large send to an old list does more harm than good.

What is visible in the dash is described under Mail check; mailbox settings are under Spam and virus protection.