Good email sending practices

I'm not going to call these 'best practices' but I hope they'll be useful if you're looking for ways to improve your email sending capabilities so as to maximize the odds that a message intended for a given recipient actually reaches that recipient's inbox.

• Make sure your mail servers are not configured as open relays
• This should go without saying, but it should still be your #1 concern
• Use ACLs and only allow relaying from the IPs of your application servers
• Check your servers by using a mail relay testing service
• Make sure you have reverse DNS entries for the IP addresses you're sending mail from
• This is another one of the oldies but goldies that you should double-check
• Use DKIM
• From the Wikipedia entry: DomainKeys Identified Mail (DKIM) is a method for associating a domain name to an email message, thereby allowing a person, role, or organization to claim some responsibility for the message. The association is set up by means of a digital signature which can be validated by recipients. Responsibility is claimed by a signer —independently of the message's actual authors or recipients— by adding a DKIM-Signature: field to the message's header. The verifier recovers the signer's public key using the DNS, and then verifies that the signature matches the actual message's content.
• Check out dkim.org
• Check out my blog post on setting up OpenDKIM with postfix
• Use SPF
• From the Wikipedia entry: Sender Policy Framework (SPF) is an email validation system designed to prevent email spam by detecting email spoofing, a common vulnerability, by verifying sender IP addresses. SPF allows administrators to specify which hosts are allowed to send mail from a given domain by creating a specific SPF record (or TXT record) in the Domain Name System (DNS). Mail exchangers use the DNS to check that mail from a given domain is being sent by a host sanctioned by that domain's administrators.
• Some SPF-testing tools are available at this openspf.org page
• Use anti-virus/anti-spam filtering tools as a precaution for guarding against sending out malicious content
• a list of such tools for postfix
• for sendmail there are 'milters' such as MIMEDefang 
• Monitor the mail queues on your mail servers
• Watch for out-of-ordinary spikes or drops which can mean that somebody might try to exploit your mail subsystem
• Use tools such as nagios, munin and ganglia to monitor and alert on your mail queues
• Monitor the rate of your outgoing email
• Again spikes or drops should alert you to suspicious activity or even errors in your application that can have an adverse effect on your mail subsystem
• Check out my blog post on visualizing mail logs although these days we are using Graphite to store and visualize these data points
• If you have the budget, use deliverability and reputation monitoring services such as ReturnPath
• These services typically monitor the IP addresses of your mail servers and register them with various major ISPs
• They can alert you when users at major ISPs are complaining about emails originating from you (most likely marking them as spam)
• They can also whitelist your mail server IPs with some ISPs
• They can provide lists of mailboxes they maintain at major ISPs and allow you to send email to those mailboxes so you can see the percentage of your messages that reach the inbox, or are missing, or go to a spam folder
• Again if you have the budget (it's not that expensive), use a service such as Litmus which shows you how your email messages look in various mail clients on a variety of operating systems and mobile devices
• If you don't have the budget, at least check that your mail server IPs are not blacklisted by various RBL sites
• You can use a multi-RBL check tool such as this one
• Make sure the headers of your messages match the type of email you're sending
• For example, if your messages are MIME multipart, make sure you mark them as such in the Content-type headers. You should have a Content-type header showing 'multipart/related' followed by other headers showing various types of content such as 'multipart/alternative', 'text/plain' etc.
• This is usually done via an API; if you're using Python, this can be done with something like

message = MIMEMultipart("related")
message_alternative = MIMEMultipart("alternative")
message.attach(message_alternative)
message_alternative.attach(MIMEText(plaintext_body.encode('utf-8'), "plain", 'utf-8'))
message_alternative.attach(MIMEText(html_body.encode('utf-8'), 'html', 'utf-8'))



Perhaps the most important recommendation I have: unless you really know what you're doing, look into outsourcing your email sending needs to a 3rd party service which preferably offers an API:

• Amazon offers the Simple Email Service (SES) as part of their AWS offerings
• Mailgun has a simple API
• Dyn Inc has recently entered the email sending arena too