According to item 2.13 of the CSA criteria, an email sender must have sole control over the outbound email servers/hosts. In the new version of the CSA criteria which apply from 2022, Certified Senders must also prove this using a unique token for each host – the CSA Host Verification.

What companies now have to consider when communicating by email with their customers

A feedback loop is a technical service provided by mailbox providers that reports back spam clicks from email recipients to the sender. This function is used when a recipient clicks on the “spam button” in the interface of his or her email account to complain about receiving an email from the mailbox provider.

This document deals with the encrypted transport of messages between two email servers. Encryption during transport is crucial for a basic level of security for the exchange of messages.The exchange of messages between an email client and a server or the end-to-end encryption of messages are not covered in this article. If the aim is to create a secure overall system, these aspects should be considered in addition to the recommendations in this article.

It’s not always the case that everything runs smoothly on the Internet. Spam, phishing,Man-in-the-Middle attacks, spoofing; the list of sophisticated methods villains of theInternet utilize, is long. In almost all cases a medium is involved which we all use on dailybasis: Email. For obvious reasons, cyber-criminals do not use their own identities. Rather, they like to make use of well-known companies and brands; often paymentservices, banks, online shops, or delivery companies. Basically, every brand can beaffected.

BIMI is an acronym of Brand Indicators for Message Identification. It is an open standardcreated jointly by several big players in the email market, such as Google, VerizonMedia/Yahoo, and Linkedin. In the past, several mailbox providers (MBP) developed individual techniques to get abrand’s logo into the recipient’s inbox. This approach has several disadvantages:

• The MBP needs to maintain a repository of logos.
• The brand owner needs to get in contact with every MBP in order to make sure the correct logo will be used.
• As each individual MBP implements its own way of supporting logos, each individual brand owner has to implement each MBP’s specification separately.

Since the new CSA Rules of Procedure came into effect on 1 July 2019, One-Click Unsubscribe (RFC8058) is now a mandatory CSA criteria for newsletters. Senders are legally required to offer newsletter recipients a cost-neutral possibility to unsubscribe without requiring knowledge of log-in data. For a long time, this has been solved with unsubscribe links or buttons in the newsletter. The one-click unsubscribe link unsubscribes the recipient immediately from the newsletter. Making subscribers login or additionally confirm the cancellation of subscription is not permitted.

Once you’ve ruined your reputation, life gets a lot simpler. This might be the case for private individuals, but it’s a different story in business. Mail-order retailers, service providers, and the banking industry are profoundly dependent on their good reputation, and are therefore also intent on maintaining and optimizing it on the Internet. If their customers become the victims of a “Man in the Middle” attack, this goodreputation can go down the drain in a matter of moments. In a “Man in the Middle” attack, the attacker manages to get between the customer and the business, and impersonates the business. Such an attack is also possible in the other direction, targeting the business as a supposedly trusted customer.

It is standard practice for Email Service Providers (ESPs) to maintain client-specific or even global suppression lists (do-not-contact lists), in order to prevent the importation into the system of email addresses for which contact must under no circumstances be re- established. This may be because the recipient has complained in the past and has made the desire not to receive further emails from this sender explicit.

Authentication is absolutely essential for professional email transmission. If you want to go further than SPF and DKIM and use DMARC, then alignment is obligatory. But even without DMARC, alignment is a correct and important step to implementing an authenticated email.