email-best-practices

Add an SPF TXT record listing your sending servers, publish the DKIM TXT record provided by your email service, and create a DMARC record starting with p=none for monitoring. Verify each with dig TXT commands, then roll DMARC from none to quarantine to reject.

Transactional emails facilitate a user-initiated action like password resets or order confirmations and can be sent without opt-in. Marketing emails are promotional, require explicit consent, and must include an unsubscribe mechanism under GDPR and CASL.

Spam placement is most commonly caused by missing SPF, DKIM, or DMARC authentication, which Gmail and Yahoo now require. Also check sender reputation, bounce rates above 4%, complaint rates above 0.05%, and sudden volume spikes.

Add hard bounces and spam complaints to a suppression list immediately via webhook events, and never send to them again. Retry soft bounces on a 1h, 4h, 24h schedule and suppress after three to five failures.

Send a deterministic idempotency key based on the business event, such as password-reset-userId-requestId, with each request. Retries with the same key return the original response instead of sending a duplicate, typically within a 24-hour window.

Double opt-in is recommended for all marketing lists because it verifies deliverability, confirms intent, and reduces complaints. It is effectively required in some regions like Germany and helps meet GDPR and CASL consent standards.