Email quality and compliance checklist

Message format, headers, MIME, identity, and the envelope.

RequiredInternet message format
Every message must use the standard header and body structure, valid line endings, and legal field syntax before it enters SMTP.RequiredRequired message header fields
Each message needs a valid Date, From, and globally unique Message-ID, with recipient and subject fields that match its purpose.RequiredMIME multipart structure
Use valid MIME types, boundaries, transfer encodings, and multipart nesting so every client can select a safe representation.

SPF, DKIM, DMARC, transport security, and domain trust.

RequiredSender Policy Framework (SPF)
Publish one bounded SPF policy that authorizes legitimate envelope senders without exceeding DNS lookup limits or permitting the world.RequiredDomainKeys Identified Mail signatures
Sign outgoing mail with DKIM using aligned domains, protected private keys, rotating selectors, and canonicalization that survives normal transit.RequiredDMARC alignment and policy
Publish DMARC, collect reports, align SPF or DKIM with the visible From domain, and move to enforcement only after legitimate flows pass.

Reputation, list quality, bounces, and inbox placement.

RequiredReverse DNS and sending identity
Every sending IP needs stable forward-confirmed reverse DNS, an SMTP greeting that matches it, and an operational domain identity.RequiredRecipient list hygiene
Send only to expected recipients, remove permanent failures, suppress complainers, and stop mailing addresses that never engage or consent.RequiredSpam complaint handling
Subscribe to available feedback loops, connect complaints to recipients safely, suppress them promptly, and monitor complaint rates by message stream.

Readable, operable messages for people of all abilities.

RequiredSemantic email structure
Use headings, paragraphs, lists, tables, and landmarks according to meaning so assistive technology can navigate the message.RequiredAlternative text for email images
Every informative image needs concise equivalent alt text, while decorative images need an empty alt attribute and no repeated meaning.RequiredEmail color contrast and cues
Text, controls, and meaningful graphics need sufficient contrast, and color must never be the only way the message communicates state.

HTML and CSS that survive real-world email clients.

RecommendedRobust email layout tables
Use a simple presentation-table scaffold where client support requires it, without leaking table semantics into the reading experience.RecommendedInline CSS and safe fallbacks
Inline critical presentation, keep selectors simple, and design fallbacks for clients that remove style blocks or ignore unsupported properties.RequiredResponsive email layout
Messages must fit narrow screens, preserve readable type, and keep controls usable even when media queries or viewport hints are ignored.

Consent, tracking, data minimisation, and respectful measurement.

RecommendedTracking pixels and remote images
Treat open tracking as unreliable personal data collection, disclose it, minimise retention, and never make essential behavior depend on it.RequiredRecipient data minimisation
Put only necessary personal data in message bodies, headers, links, logs, and provider metadata, with explicit retention for each copy.RequiredConsent and subscription provenance
Keep verifiable evidence of how and when each recipient subscribed, what they expected, and which message purposes that choice covered.

Unicode, language, direction, and international addresses.

RequiredUTF-8 message content
Encode international text consistently as UTF-8 across headers and bodies, with MIME declarations and transfer encodings that preserve every character.RequiredMessage language and text direction
Declare the message language and mark bidirectional runs so pronunciation, punctuation, numerals, and reading order remain correct.RecommendedInternationalized email addresses
Accept and preserve Unicode mailbox addresses only when every validation, storage, SMTP, and support path handles SMTPUTF8 safely.

Subscription, unsubscribe, complaints, retries, and expiry.

RequiredOne-click list unsubscribe
Bulk subscription mail needs authenticated one-click unsubscribe headers that complete without login, redirects, confirmation pages, or extra choices.RequiredDelivery status and bounce handling
Classify SMTP and delivery-status failures, stop permanent retries, back off temporary failures, and connect outcomes to the correct recipient.RequiredRetry strategy and message expiry
Retry transient SMTP failures with backoff, cap queue lifetime, and expire time-sensitive messages before delayed delivery becomes harmful.

Injection, dangerous content, phishing resistance, and secrets.

RequiredEmail header injection prevention
Treat every header value as structured data, reject line breaks from untrusted input, and let a mail library serialize addresses and fields.RequiredSafe and trustworthy email links
Link text, visible domains, redirects, and destination context must agree, while sensitive actions require fresh server-side authorization.AvoidDangerous active email content
Do not depend on scripts, forms, embedded credentials, or untrusted active content; sanitise generated HTML and provide safe web fallbacks.

Machine-readable actions, calendars, receipts, and agent use.

RecommendedCalendar invitation interoperability
Calendar mail must include valid iCalendar data, stable event identifiers, correct methods, time zones, and updates that replace prior versions.OptionalMachine-readable email actions
Add structured actions only as progressive enhancement, bind them to visible content, and keep the ordinary website workflow complete.RecommendedSafe and usable email attachments
Attach only necessary files with accurate media types, safe names, bounded size, malware controls, and an accessible alternative where possible.