Email Infrastructure, End to End
Understand the machinery under every send: the sending stack, the SMTP protocol, the DNS records receivers check, and the AWS SES delivery layer.
62 stepsabout 214 min total
The Complete Guide to Email Infrastructure
The machinery behind sending: domains, DNS, SMTP relays, IPs, and reputation. Here is how the pieces fit, and why the app-wrapper model struggles.
What Is SMTP, and How Does It Send Your Email?
SMTP is the protocol that transmits every email. Here is the handshake it runs, the reply codes it returns, and what they tell you when mail fails.
DNS Records for Email: MX, PTR, SPF, DKIM, and DMARC
Every deliverability check starts in your DNS. Here is what each email record does, MX, PTR, SPF, DKIM, DMARC, and how they work together.
AWS SES for Cold Email: Why the Delivery Layer Matters
Amazon SES is a cloud SMTP relay that sends at scale without per-mailbox limits. Here is what it gives cold email, and what it still leaves to you.
Shared vs Dedicated IP for Cold Email
A dedicated IP is not an upgrade for most senders. Here is the volume threshold where it starts to help, and why it hurts below that line.
Do You Need a Separate Domain for Cold Email?
Sending outreach from your main domain risks the address your customers reply to. Here is when to separate, and how many domains you actually need.
Email Infrastructure Audit Checklist
Audit DNS, senders, credentials, vendors, reputation, and evidence with a dated worksheet that assigns owners and remediation.
Shared IP Pool: Questions to Ask a Sending Vendor
Use this due-diligence checklist to understand shared IP governance, isolation, incident response, feedback data, and exit options.
How to Inventory Every System Sending as Your Domain
Find senders across DNS, headers, provider consoles, applications, and DMARC reports, then mark unknown sources for investigation.
Email Sending Credentials: Rotation and Offboarding
A provider-neutral runbook for inventorying, rotating, testing, revoking, and offboarding SMTP passwords, API keys, and roles.
Tracking Domain Migration Without Breaking Campaigns
Plan a tracking-domain cutover with DNS, TLS, redirects, unsubscribe paths, historical links, and before-and-after QA.
Email Infrastructure Ownership Matrix for Agencies
Use a client-ready RACI to assign ownership for DNS, providers, credentials, content, suppression, monitoring, and incidents.
DKIM Selector Rotation During a Provider Change
Roll DKIM selectors during an ESP migration with overlap, DNS verification, header checks, retirement, and rollback.
Email Authentication for Subdomains: Scope
Map SPF, DKIM, and DMARC behavior across sending subdomains without assuming policy inheritance or automatic alignment.
MX Record Cutover: Testing and Rollback
Plan an MX cutover with current-state capture, TTL review, mailbox readiness, test messages, and explicit rollback criteria.
PTR Readiness for Dedicated Sending IPs
Check reverse DNS ownership, hostname consistency, IPv4/IPv6 behavior, and SMTP evidence before using a dedicated sending IP.
MTA-STS: Test Mode Before Enforcement
Deploy MTA-STS with DNS discovery, HTTPS policy hosting, certificate checks, staged testing, and an explicit enforcement rollback.
SMTP TLS Reporting: Set Up and Read TLS-RPT Data
Publish TLS-RPT, route reports, parse failure data, and define retention without confusing transport evidence with inbox placement.
Email Provider Webhook Event Schema Migration
Map provider event contracts before a cutover: statuses, identifiers, signatures, retries, idempotency, replay, and fixtures.
Synchronize Provider Suppressions With Your Application
Reconcile provider bounces and complaints with application state using source-of-truth rules, append-only events, conflict handling, and privacy controls.
Design a Queue for Provider Rate Limits and Retry Safety
Design provider-aware retry queues with idempotency, backoff, quotas, dead letters, and clear handling for 4xx and 5xx outcomes.
Email DNS Change Validation Checklist
Validate email DNS changes with authoritative and recursive lookups, header evidence, propagation notes, and rollback documentation.
Multi-Tenant Email Infrastructure Isolation for Agencies
Choose isolation boundaries across domains, credentials, provider accounts, event streams, and suppressions without promising a reputation outcome.
AWS SES Sandbox to Production: Send-Path Readiness Checklist
AWS SES Sandbox to Production: Send-Path Readiness Checklist — Teams whose SES account is still constrained by sandbox behavior.
AWS SES SMTP Credentials: Rotation, Scope, and Failure Testing
AWS SES SMTP Credentials: Rotation, Scope, and Failure Testing — Teams using SES SMTP credentials that need safe rotation and rollback.
SES Rendering Failures: Debugging Templated Email Data
SES Rendering Failures: Debugging Templated Email Data — Developers receiving template rendering failures before delivery.
AWS SES API v2 Formatted vs Raw Email: A Practical Boundary
AWS SES API v2 Formatted vs Raw Email: A Practical Boundary — SES developers choosing managed composition versus full MIME control.
AWS SES Configuration Sets: Tags, Destinations, and Routing
AWS SES Configuration Sets: Tags, Destinations, and Routing — SES teams needing campaign or tenant-level event routing.
Partial Failure in Bulk Email Sends: Reconcile Every Recipient
Partial Failure in Bulk Email Sends: Reconcile Every Recipient — Teams losing per-recipient status when a bulk request partly fails.
CNAME Flattening and DKIM Verification: Detect DNS Interference
CNAME Flattening and DKIM Verification: Detecting Provider Interfer… — Teams using managed DNS, proxies, or flattening services.
Rate-Limit Headers and Retry-After for Email APIs
Rate-Limit Headers and Retry-After for Email APIs — Developers receiving 429s without pacing requests correctly.
Exponential Backoff With Jitter for Email Provider Retries
Exponential Backoff With Jitter for Email Provider Retries — Teams creating retry storms during throttling or transient failures.
Rate-Limit Failure Modes: 429, 454, and Provider-Specific Throttles
Rate-Limit Failure Modes: 429, 454, and Provider-Specific Throttles — Engineers mapping HTTP and SMTP throttling signals to actions.
Email Webhook Acknowledgement vs. Processing: Return Fast Safely
Webhook Acknowledgement vs Processing: Return Fast Without Losing E… — Teams doing slow work inside webhook requests and triggering duplicates.
Email Webhook Signature Verification and Replay Protection
Email Webhook Signature Verification and Replay Protection — Engineers exposing event endpoints to forged or replayed provider payloads.
DKIM Multiple Signatures: Which Signature Can Satisfy DMARC?
DKIM Multiple Signatures: Which Signature Can Satisfy DMARC? — Analysts reading messages signed by an ESP and customer domain.
SES Delivery Delay Events: When a Soft Failure Is Not a Bounce
SES Delivery Delay Events: When a Soft Failure Is Not a Bounce — Operators treating temporary delivery delays as permanent bounces.
SMTP vs Email API: Choosing the Right Sending Interface
SMTP vs Email API: Choosing the Right Sending Interface — Developers choosing between protocol compatibility and API control.
AWS SES Sending Quotas: Daily Limit vs Per-Second Rate
AWS SES Sending Quotas: Daily Limit vs Per-Second Rate — Operators misreading two separate SES capacity controls.
Email Send State Machine: Accepted, Queued, Delivered, Failed
The Email Send State Machine: Accepted, Queued, Delivered, Deferred… — Product and engineering teams conflating API acceptance with delivery.
ARC Chain Validation Failure: Find the First Broken Instance
ARC Chain Validation Failure: Find the First Broken Instance — Mail operators investigating cv=fail in forwarded chains.
BIMI SVG Validation Failures: A Preflight Checklist
BIMI SVG Validation Failures: A Preflight Checklist — Brand teams whose BIMI logo does not render.
BIMI VMC vs CMC: Evidence Needed Before Choosing a Certificate
BIMI VMC vs CMC: Evidence Needed Before Choosing a Certificate — Brand and security teams evaluating BIMI certificate paths.
DKIM Canonicalization Choices: Simple vs Relaxed Under Rewriting
DKIM Canonicalization Choices: Simple vs Relaxed Under Rewriting — ESP and mail-platform owners choosing DKIM canonicalization.
DMARC Policy Discovery: Parent, Subdomain, and No-Record Outcomes
DMARC Policy Discovery: Parent, Subdomain, and No-Record Outcomes — Operators testing what policy a receiver actually discovers.
Authentication Drift Detection: Compare Intended and Observed Senders
Authentication Drift Detection: Compare Intended and Observed Senders — Security and deliverability owners with many ESPs and subdomains.
AWS SES Event Destinations: CloudWatch, SNS, EventBridge, or Firehose
AWS SES Event Destinations: CloudWatch, SNS, EventBridge, or Firehose — Engineers choosing a downstream destination for send events.
Zoho Mail Domain Verification: DNS Handoff
Give your IT team a clear Zoho Mail DNS handoff: which verification method to use, what to copy, how to confirm it, and what to check afterward.
SES SMTP 535: Region and Credential Checklist
Fix an Amazon SES SMTP 535 error by checking SMTP credentials, AWS Region, rotation, encoding, whitespace, and a controlled connection test.
Email API 202 Accepted: Why It May Not Arrive
An email API returning 202 Accepted confirms an asynchronous request was accepted—not that the message reached an inbox. Trace each handoff to find the failure.
Zoho Mail SMTP: When to Use Port 465 or 587
Choose Zoho Mail SMTP port 465 or 587 by matching the port to SSL or STARTTLS, then verify the server, login, and account settings.
Inbound Email API: Webhooks vs. Polling
Choose between inbound email webhooks and polling by weighing latency, retries, replay, duplicates, cursoring, and backfill in your receiving workflow.
How to Verify a RepMail Sending Domain
Add a sending domain in RepMail, publish its three DKIM CNAME records, wait for verification, then select it and confirm sender readiness.
Merge Fields Work in Preview but Fail on Send
Learn why merge fields can look correct in preview but render incorrectly in a sent email, and follow a checklist to trace data, template, and recipient issues.
Email API Hidden Costs: Webhooks, Logs, and Retries
Email API pricing is not just sends. Compare webhook work, logs, templates, retries, storage, overage, and operational ownership before choosing a provider.
Do You Need a Mailbox for a RepMail Sending Domain?
RepMail requires a verified custom domain or subdomain and custom From address. Learn what mailbox hosting does—and does not—affect.
RepMail Merge Fields: How Recipient Data Enters a Template
Learn how RepMail merge fields map contact and sender data into templates, resolve at send time, and behave when a placeholder is unknown.
SMTP Reply Codes: What 2xx, 4xx, and 5xx Mean
Learn how to read SMTP reply codes, distinguish successful, temporary, and permanent responses, and choose the right diagnostic action.
What Does Queued Mean in Email?
Queued means an email is waiting for the next step in processing. Learn how to identify the queue, troubleshoot delays, and avoid duplicate sends.
Email Headers Explained: What the Metadata Shows
Learn what email headers contain, how to read them in a useful order, and what routing and authentication fields can—and cannot—prove.
Free Bulk Email Limits: Contacts, Sends, and Reset Windows
Compare free bulk email limits by contact count, sends, reset window, and campaign fit. Use this dated checklist to verify quotas before sending.
How Many Emails Can You Send for Free?
Free email limits depend on the provider, account, and sending period. Learn what to count, how to verify the current quota, and when to stop.