Email Deliverability Checklist for SaaS Platforms

Use a subdomain such as inbound.yourapp.com exclusively for receiving customer emails so reputation and routing are isolated from marketing and transactional sending. This keeps policies clean and simplifies monitoring and rollback.

Adopt deterministic addresses like tenant+hash@inbound.yourapp.com or tenant-id@inbound.yourapp.com for easy mapping and revocation. Document how addresses are generated, rotated, and expired to prevent collisions.

Decide where the unmodified RFC 5322 message is stored before parsing so you can reprocess with new rules and recover from downstream failures. Include retention duration and encryption requirements.

Commit to acceptance availability and latency targets, for example p95 under 60 seconds from SMTP accept to event delivery. Use these SLAs to drive capacity planning and alert thresholds.

Plan for spikes driven by product events like incident notifications or onboarding campaigns. Define queue capacity, horizontal scaling limits, and a controlled degradation mode that prioritizes critical tenants.

Choose a REST polling API as a backup when webhooks are degraded so inbound data still flows. Automate the switch via feature flags and document the operational playbook.

List risks like malware attachments, phishing, and malicious HTML and map each to controls such as antivirus, sandboxing, and sanitization. Make acceptance decisions explicit to avoid silent drops.

Point multiple MX records for the inbound subdomain to geographically distributed endpoints and verify resolution from public resolvers. Use sensible TTLs so cutovers can happen quickly without flapping.

Sign the inbound zone and alert on broken chains or algorithm mismatches to reduce MX hijacking risk. Validate DS records after registrar changes.

Accept any address at inbound.yourapp.com to support per-tenant aliases while rejecting catch-all at the apex domain to limit abuse. Route unknown recipients to a quarantine workflow for analysis.

Set MX and supporting A or AAAA records to TTLs between 300 and 900 seconds to allow rapid rollback while avoiding resolver churn. Pre-announce changes and confirm global propagation.

Ensure both stacks are reachable to maximize delivery from large senders. Test SMTP connectivity from multiple regions and networks.

Provision postmaster@ and abuse@ on the inbound domain and route to your operations queue. This satisfies RFC requirements and surfaces deliverability complaints early.

If your receiving MTAs support it, publish TLSA records to pin certificates for STARTTLS. Monitor adoption and fallback cleanly for senders that do not implement DANE.

Provide a chain-valid certificate whose SAN matches MX hostnames, and require modern ciphers and TLS 1.2 plus. Test with multiple senders and scan for downgrade vulnerabilities.

Set a limit that matches product needs, for example 25 MB, and respond with 552 for oversized messages. Include a user-facing explanation link in NDRs to reduce support tickets.

Accept internationalized addresses and UTF-8 headers so global customers can reach your app without silent truncation. Validate downstream components for compatibility.

For suspicious messages, return 4xx to encourage retries or accept and tag for downstream review instead of issuing 550 rejects that may block legitimate senders. Maintain allowlists for high value partners.

Disable aggressive greylisting or whitelist major providers to avoid multi-hour delays that break SaaS workflows. Measure delay impact on your inbound SLOs.

Isolate noisy tenants and abusive senders so they do not degrade shared capacity. Expose limits and error codes via tenant admin to reduce support escalations.

Log session IDs, TLS version and cipher, remote IP, and envelope details and link them to message IDs. This is essential for audit trails, incident investigation, and reproducible bug reports.

Store unmodified content in durable storage and compute a hash for deduplication and replay. Attach the storage key to every downstream event.

Convert to UTF-8, decode quoted-printable and base64, and fix line endings to CRLF before parsing. Apply consistent part ordering so your app logic is deterministic.

Strip scripts and dangerous attributes, and fall back to text/plain when sanitization fails. Record what was removed for support visibility.

Do not rely solely on file extensions. Detect content types by magic bytes, quarantine executable formats, and define allowable lists per tenant.

Tolerate missing boundaries, unfold headers, and recover from bad encodings while emitting structured warnings. Route unrecoverable messages to a manual review queue.

Decode winmail.dat and resolve content-id images so customer emails from Outlook render correctly in your product. Rewrite inline images to durable links with access control.

Include a unique event ID, HMAC signature, and schema version in every delivery. Rotate secrets, publish a JWKS or key ID, and document replay and verification procedures.

Track acceptance availability and processing latency from SMTP to webhook and page on SLO burn. Tie error budgets to release gates for email-related services.

Send test messages from Gmail, Outlook, Yahoo, and a custom MTA with varied charsets and attachments to validate end-to-end paths. Alert on content changes, not only on timeouts.

Break down rejection reasons and surfaces by MX and region to catch localized failures. Correlate spikes with deploys and DNS changes.

Create dashboards for MIME parse failures, HTML sanitizer removals, and attachment extraction issues. Alert when a new pattern emerges so rules can be updated quickly.

Expose per-tenant delivery rates, p95 latency, and idempotency dedup counts. Trigger escalation when DLQ grows or when retry budgets are exhausted.

Document steps to roll MX, rotate webhook secrets, pause processing for a tenant, and replay from raw MIME. Keep commands copy-paste ready and test quarterly.

Simulate DNS misconfiguration, certificate expiry, webhook outages, and oversized message floods. Record detection times and fix gaps in observability and automation.