# The Email Specification - Checklist Source: https://webspecification.com/email/checklist/ ## Foundations - [ ] **Internet Message Format (RFC 5322)** (required) - Construct structurally valid email messages adhering to RFC 5322 grammar, strict CRLF line endings, 998-character line limits, and standard header folding rules. https://webspecification.com/email/foundations/message-format/ - [ ] **Essential Email Header Fields** (required) - Emit mandatory RFC 5322 header fields (From, Date, Message-ID), structured recipient fields, and machine-readable metadata while preventing header duplication. https://webspecification.com/email/foundations/header-fields/ - [ ] **MIME Multipart Message Structure** (required) - Structure rich email payloads using standardized MIME multipart trees (alternative, related, mixed), paired plain-text fallbacks, and collision-resistant boundary delimiters. https://webspecification.com/email/foundations/mime-multipart/ ## Authentication - [ ] **Sender Policy Framework (SPF)** (required) - Publish a single, bounded SPF policy that authorizes legitimate envelope senders without exceeding the 10-DNS-lookup limit or using overly permissive qualifiers. https://webspecification.com/email/authentication/sender-policy-framework/ - [ ] **DomainKeys Identified Mail (DKIM) Signatures** (required) - Cryptographically sign outgoing email messages with DKIM using aligned domains, minimum 2048-bit keys, canonicalization, and regular selector rotation. https://webspecification.com/email/authentication/dkim-signatures/ - [ ] **Domain-based Message Authentication, Reporting, and Conformance (DMARC)** (required) - Enforce domain-aligned email authentication with a DMARC policy that instructs receivers how to handle unauthenticated mail and generates aggregate feedback reports. https://webspecification.com/email/authentication/dmarc-policy/ ## Deliverability - [ ] **Reverse DNS (PTR) & Forward-Confirmed Reverse DNS (FCrDNS)** (required) - Configure Forward-Confirmed Reverse DNS (FCrDNS) on every sending IP address, ensuring the PTR record matches the forward A/AAAA record and the SMTP EHLO greeting. https://webspecification.com/email/deliverability/reverse-dns/ - [ ] **Mailing List Hygiene & Recipient Validation** (required) - Maintain pristine sender reputation through automated bounce management, double opt-in confirmation, inactive subscriber sunsetting, and spam trap avoidance. https://webspecification.com/email/deliverability/list-hygiene/ - [ ] **Spam Complaint Handling & Feedback Loops (FBL)** (required) - Process user spam complaints in real-time through ISP Feedback Loops (FBL) and RFC 5965 Abuse Reporting Format (ARF) to maintain spam complaint rates below 0.10%. https://webspecification.com/email/deliverability/complaint-handling/ ## Accessibility - [ ] **Semantic HTML Structure & Screen Reader Accessibility** (recommended) - Structure email markup with true semantic HTML elements (h1-h3, p, ul, ol), document language declarations, and clear hierarchical reading order. https://webspecification.com/email/accessibility/semantic-structure/ - [ ] **Color Contrast & Dark Mode Adaptation in Email** (recommended) - Meet WCAG 2.2 AA contrast standards (minimum 4.5:1) while architecting email designs for dark mode color inversions across Outlook, Apple Mail, and Gmail. https://webspecification.com/email/accessibility/color-and-contrast/ - [ ] **Accessible Image Alt Text & Image-Off Fallbacks** (required) - Provide meaningful alternative text for informative images, null alt attributes for decorative graphics, and styled fallbacks when remote images are blocked. https://webspecification.com/email/accessibility/image-alt-text/ ## Rendering - [ ] **Cross-Client HTML Table Layout Architecture** (recommended) - Construct bulletproof HTML email scaffolds using presentation tables, role="presentation" ARIA semantics, 600px max-width containers, and Microsoft Outlook ghost tables. https://webspecification.com/email/rendering/table-layout/ - [ ] **CSS Inlining & Cross-Client Style Compatibility** (recommended) - Inline critical CSS rules directly onto HTML elements to survive webmail style-stripping while leveraging embedded style blocks for media queries and dark mode. https://webspecification.com/email/rendering/inline-css/ - [ ] **Responsive Email Layout & Fluid-Hybrid Design** (recommended) - Design responsive email templates using fluid-hybrid layouts, mobile-first breakpoints, single-column column stacking, and 44x44px touch targets. https://webspecification.com/email/rendering/responsive-layout/ ## Privacy - [ ] **Tracking Pixels, Remote Image Privacy & Apple MPP** (recommended) - Understand remote tracking pixel mechanics, Apple Mail Privacy Protection (MPP) proxy caching, GDPR/ePrivacy compliance, and pseudonymized analytics. https://webspecification.com/email/privacy/tracking-pixels/ - [ ] **Consent Provenance & Audit Trails** (required) - Maintain immutable cryptographic records of subscriber consent, capturing timestamps, IP addresses, signup URLs, form identifiers, and policy versions for regulatory compliance. https://webspecification.com/email/privacy/consent-provenance/ - [ ] **PII Protection & Data Minimisation in Email** (required) - Minimize Personally Identifiable Information (PII) transmitted across email bodies and URL parameters, enforcing masking, TLS transport, and ephemeral log retention. https://webspecification.com/email/privacy/data-minimisation/ ## Internationalisation - [ ] **UTF-8 Encoding & Multilingual Message Bodies** (required) - Standardize on end-to-end UTF-8 encoding across email headers and MIME bodies using Quoted-Printable or Base64 transfer encodings to prevent character corruption. https://webspecification.com/email/internationalisation/utf-8-content/ - [ ] **Language Direction & Right-to-Left (RTL) Layouts** (recommended) - Architect bidirectional and Right-to-Left (RTL) email layouts with document-level dir="rtl" declarations, mirrored table alignments, and isolated BiDi spans. https://webspecification.com/email/internationalisation/language-direction/ - [ ] **Internationalized Email Addresses (EAI) & Punycode** (recommended) - Support Internationalized Domain Names (IDN) via Punycode and handle non-ASCII local-parts using RFC 6530 Email Address Internationalization (EAI) and SMTPUTF8. https://webspecification.com/email/internationalisation/international-addresses/ ## Lifecycle - [ ] **One-Click List-Unsubscribe (RFC 8058)** (required) - Implement RFC 8058 one-click list unsubscribe headers with HTTP POST endpoints, mailto fallbacks, DKIM signature protection, and zero login barriers. https://webspecification.com/email/lifecycle/one-click-unsubscribe/ - [ ] **Automated Bounce Handling & Delivery Status Notifications (DSN)** (required) - Classify and process hard and soft delivery failures using RFC 3463 enhanced status codes, Variable Envelope Return Path (VERP), and instant suppression automation. https://webspecification.com/email/lifecycle/bounce-handling/ - [ ] **SMTP Retry Scheduling & Queue Expiry** (required) - Configure outbound SMTP queue management with exponential backoff, randomized jitter, greylisting survival delays, and strict 72-to-120-hour queue retention limits. https://webspecification.com/email/lifecycle/retry-expiry/ ## Security - [ ] **Email Header Injection & CRLF Neutralization** (required) - Prevent SMTP and RFC 5322 header injection vulnerabilities by neutralizing CRLF control characters and using typed mail serialization libraries. https://webspecification.com/email/security/header-injection/ - [ ] **Secure Hyperlinks & Click-Tracking Integrity** (required) - Enforce HTTPS-only hyperlinks, eliminate phishing link text mismatches, and protect email click-tracking redirects against open redirect vulnerabilities using HMAC signatures. https://webspecification.com/email/security/safe-links/ - [ ] **Dangerous Content & Prohibited Email Elements** (required) - Eliminate prohibited active content (JavaScript, iframes, embedded objects, raw forms) and restrict high-risk file attachment extensions to prevent malware classification. https://webspecification.com/email/security/dangerous-content/ ## Automation - [ ] **Schema.org Email Markup & Gmail Actions** (optional) - Embed structured Schema.org JSON-LD markup in transactional emails to render interactive One-Click Actions, order summaries, and flight/event cards in Gmail and Apple Mail. https://webspecification.com/email/automation/machine-readable-actions/ - [ ] **iCalendar (iMIP) Automated Calendar Invitations** (recommended) - Publish standards-compliant calendar meeting invites, updates, and cancellations using iCalendar (RFC 5545) and iMIP (RFC 6047) multipart attachments. https://webspecification.com/email/automation/calendar-invitations/ - [ ] **MIME File Attachments & Binary Data Transport** (recommended) - Attach documents and assets using RFC 2183 Content-Disposition, RFC 2231 international filename encoding, Base64 transfer encoding, and 10MB size ceilings. https://webspecification.com/email/automation/attachments/