Email Infrastructure Checklist for SaaS Platforms

Decide whether each tenant gets a dedicated subdomain (e.g., tenant.example-mail.com) or uses plus-addressing (user+tenant@domain.com) to simplify routing and isolation.

Create MX records that point to at least two regions or providers with health-checked endpoints so inbound mail continues if a zone or provider degrades.

Use distinct domains or subdomains for receiving vs sending to protect deliverability and simplify DMARC policies without impacting inbound acceptance.

Allocate regional MX domains (e.g., eu.mail.yourapp.com) to ensure messages for EU tenants are received and stored in EU-managed infrastructure.

Set measurable targets such as p95 time from SMTP acceptance to webhook delivery and enforce them via alerts and capacity planning.

Store RFC 5322 raw emails in object storage with lifecycle policies and keep parsed JSON separately for fast query and replay workflows.

Enable STARTTLS with modern TLS versions, prefer forward secrecy, and log negotiated ciphers to meet enterprise security expectations.

Persist MAIL FROM, RCPT TO, and original recipients including plus-addressing tags to drive accurate tenant routing and threading.

Set limits for message size, recipients per message, and connection concurrency, and use RBL/greylisting selectively to reduce abuse without blocking legitimate traffic.

Push raw messages or pointers to a message queue (e.g., SQS, Kafka) with at-least-once semantics, enabling decoupled parsing and delivery.

Canonicalize line endings, remove 8-bit encoding issues, and convert content-transfer encodings so downstream parsers receive consistent input.

Use antivirus scanning and MIME type validation to block dangerous files and log policy events per tenant for auditability.

Support multipart/alternative, multipart/mixed, and multipart/related with recursion limits to avoid parser bombs and truncated content.

Decode RFC 2047 encoded-words and convert all text to UTF-8 to prevent mojibake and make downstream search and rules reliable.

Choose the best body candidate per MIME semantics, and when only HTML is present, sanitize and convert it to text for consistent indexing.

Extract attachments and map Content-ID references so clients can reconstruct message bodies or display placeholders in activity feeds.

Detect Outlook TNEF, extract actual attachments, and address provider-specific behaviors like Gmail plus-addressing and Apple inline images.

Link messages to existing conversations, and if headers are missing or malformed, fall back to heuristics on subject, sender, and body hashes.

Include canonical message IDs, tenant IDs, timestamps, and normalized bodies, and increment a schema version when fields change.

Attach an HMAC signature header over the request body with a timestamp and key identifier, and support secret rotation without downtime.

Provide a unique event ID and Idempotency-Key header so clients can safely retry without duplicating workflows.

Retry failed webhooks with capped backoff, send permanently failed events to a DLQ, and expose tenant-level retry visibility.

Provide a paginated endpoint with time-based cursors or watermark tokens, conditional GETs, and lightweight payload options for mobile or edge services.

Allow tenants to replay events by time range or message ID, with safeguards to prevent replay storms and to respect retention windows.

Scope every request by tenant, restrict cross-tenant data paths, and record audit logs for message views, downloads, and replays.

Use KMS-backed encryption for raw blobs and parsed metadata, and consider per-tenant keys if you serve regulated industries.

Throttle SMTP sessions, webhook deliveries, and API polling to prevent noisy neighbors from impacting shared infrastructure.

Track metrics like SMTP accept success, parser error rate, p95/99 delivery latency, and webhook success ratio, and alert on breach.

Propagate a correlation ID from SMTP acceptance through parsing and webhook calls to pinpoint latency and failures across services.

Inject queue delays, parser exceptions, and webhook timeouts in staging and during controlled game days to validate resilience.