Authenticate every sending domain

Publish SPF so receiving servers know which systems may send for the domain. Sign messages with DKIM so recipients can verify that content was not modified. Add DMARC to define alignment and reporting policy. Use a dedicated, resolvable mail hostname with correct forward and reverse DNS.

Verification should be visible per domain. A green label is useful only when it comes from a real DNS lookup and the signing key installed on the active mail server.

Protect reputation from the first message

Do not send purchased lists or traffic without clear consent. Separate transactional mail from promotional campaigns, use recognizable From addresses, and make replies useful. New domains and IP addresses need gradual, consistent volume rather than sudden bursts.

Published rolling 60-minute limits are an important control even when a plan allows more monthly volume. They contain compromised keys and unexpected application loops without allowing an artificial burst at the top of an hour. Each message stops counting exactly 60 minutes after it was sent.

Use a durable queue and deliberate retries

Remote mail servers fail temporarily. A queue should acknowledge accepted requests quickly, retry transient errors with exponential backoff, and stop retrying permanent failures. Multiple workers should claim different jobs without duplicates, and a crashed worker should not strand a message forever.

Super Mail Hub persists outbound jobs before delivery and uses concurrent workers with row-level claims. Queued, processing, retrying, sent, and failed states remain visible to operators.

Handle bounces, complaints, and suppression

A production system must ingest delivery status, hard bounces, soft bounces, and complaint feedback. Hard-bounced or complaining recipients should enter a suppression list so future sends are blocked. Repeatedly sending to invalid addresses damages reputation quickly.

Track rates by domain, message stream, and customer. Alert before a problem becomes a blocklist incident, and suspend abusive accounts without affecting healthy tenants.

Launch checklist

Complete these checks with real DNS and a staging recipient before opening paid subscriptions.

  • SPF, DKIM, and DMARC pass and align.
  • TLS certificates and secure SMTP/IMAP ports work.
  • Forward and reverse DNS match the production mail hostname.
  • Queue retry and worker-recovery behavior is tested.
  • Bounce, complaint, and suppression processing is active.
  • Per-customer hourly, daily, and monthly limits are enforced.
  • Backups, restore tests, monitoring, and abuse contacts are documented.