ESP & Large Sender Guidelines
Requirements and recommendations to help ESPs and large email senders follow best practices and strengthen trust and safety on the internet.Email Service Providers (ESPs) and shared infrastructure hosts are responsible for the email sent via their infrastructure. Hosting abusive senders will negatively impact reputation for shared domains and infrastructure.
Everything in the Sender Guidelines applies to mail sent via the platform. The recommendations below explain how operators can meet these guidelines at scale and maintain a healthy reputation.
1. Infrastructure
Do
Have each customer send from a dedicated subdomain for exclusive use on the platform, and use it as both the From domain and the DKIM signing domain. The customer can either delegate the subdomain to the ESP's nameservers or point the required records to the ESP with CNAMEs. Remove the DNS records when the customer leaves, so the subdomain cannot be taken over.
Brand the reverse DNS and HELO with the customer's domain where possible, instead of using the default ESP hostname. Make sure the HELO, PTR and A record all use the same hostname. Spamhaus evaluates all domains seen in DNS and received headers, so an isolated identity helps build a stronger domain reputation.
Maintain an active, monitored abuse address (e.g.
abuse@example-esp.com) and ensure the WHOIS record/RDAP information reflects current contact details.Separate IPs by traffic type so that transactional email (receipts, alerts, password resets) is distinct from marketing email.
Utilise subdomains for each mailing stream so receivers can identify them.
When a customer leaves, remove their domain and any related records from the platform, and tell them to delete the CNAMEs or delegations they set up for the ESP. Require domain ownership verification before any account can send from a domain, so a leftover record cannot be used to take over the subdomain.
Register for feedback loops (FBLs) at all major mailbox providers. Route complaint data back to the responsible customer account and automatically add senders with multiple complainants to suppression lists.
Enable RFC8058 for one click unsubscribe for all users sending bulk email.
Monitor key signals such as sudden volume spikes, bounce rates above 5%, or complaint rates above 0.3% at the customer account level, and trigger automatic throttling or a review when thresholds are exceeded.
Don't
Do not leave the abuse address unmonitored. If hosted on a cloud platform, ensure the mailbox is unfiltered so it can receive all abuse reports. Alternatively, set up a mailbox at a domain where mail can be received unfiltered and update the WHOIS record/RDAP accordingly.
Do not redact or obfuscate headers, as this can make email appear suspicious. The final 'Received' line, or last hop, showing the IP that connected to the receiving mail server must be visible.
Do not use cousin domains to segregate email traffic; instead, use subdomains.
2. List & Engagement Hygiene
Do
Ensure customers implement Confirmed Opt-in and periodically verify that it is being used.
Encourage customers to validate email addresses when they are first collected. Bad addresses caught at signup are far less likely to bounce, go unengaged, or turn out to be a spam trap whereas addresses cleaned later have usually already been mailed, and the damage to reputation is already done.
Protect subscription forms with CAPTCHA and a honeypot field, and throttle confirmation emails per recipient address across the platform.
Monitor for signups and new addresses concentrated in recently registered, disposable or short-lived domains. A cluster of new subscribers on domains registered in the last few days is a signal of low-quality acquisition, not list growth.
Perform proper bounce management, action unsubscribes, and suppress invalid and unengaged recipients at the platform level. Provide continual feedback to customers on these actions.
Provide engagement data to customers so they can take relevant action.
Recommend a strong sunset policy for recipients who are no longer engaging with emails.
Recommend a permission pass campaign to customers whose addresses have not engaged for more than 12 months, and suppress any address that does not re-confirm.
Don't
Do not allow customers to purchase, rent, or harvest email lists. This must be explicitly prohibited in the Acceptable Use Policy (AUP).
Consent is NOT transferable. If there is a legitimate case of sharing data with another entity like a merger or acquisition, follow a process to inform recipients well ahead of the change.
3. Authentication
Do
Ensure all customers have SPF, DKIM, and DMARC configured before they are permitted to send email. The SPF record should be for the return-path domain and the customer does not need to set a separate one for their sending domain.
Sign all outbound email with DKIM using the customer's own domain, so the DKIM domain aligns with their From domain. For customers on shared pools, double-sign with both the ESP's domain and the customer's domain. This means reputation can be separated and tracked better.
Don't
Do not allow customers to use freemail domains such as
gmail.comoryahoo.comas the envelope sender. These providers publish SPF records that do not authorise the ESP's infrastructure, so the mail will fail SPF and, under their DMARC policies, be quarantined or rejected.
4. Customer Onboarding & Compliance
Do
Educate customers on email best practices and compliance.
Vet new customers before onboarding by reviewing list sources, how permission was obtained, and sending history. Allow a controlled first few sends to monitor their bounce, complaint and engagement metrics before providing full access.
Require multi-factor authentication for customer accounts and protect API keys and SMTP credentials. Monitor for signs of hijacked accounts, such as sudden volume spikes, new sending domains, or unusual bounce and complaint rates, and suspend sending quickly when they appear.
Look for accounts with suspicious activity like volume spikes, new senders etc and review them periodically.
Monitor list growth rate, not just sending volume. A list that has grown steadily and then increases sharply is a signal of a purchased list, a compromised signup form, or a subscription bombing attack in progress.
Recognise that customers in the shared IP pool or shared domain can affect the reputation of other customers in the pool. Apply a higher threshold for these users. This is particularly relevant if free accounts are provided, as they are more prone to abuse.
Maintain a strict AUP that is enforced during onboarding, with clearly defined thresholds for suspension and termination applied consistently.
Maintain a compliance team that actively monitors abusive behaviour and is empowered to take corrective action promptly.
Spamhaus Tools & Resources
DNS Tools for troubleshooting IP and Domain Reputation