Managing deliverability. Technical Documentation Adobe Campaign v6.1

Transcription

1 Maagig deliverability Techical Documetatio Adobe Campaig v6.1

2

3 2014, Adobe All rights reserved. Published by Adobe Systems Ic. Terms of use Privacy Ceter A trademark symbol (,, etc.) deotes a Adobe trademark. All third-party trademarks are the property of their respective owers. Updated Iformatio/Additioal Third Party Code Iformatio available at Versio umber: 8515 Neolae, a Adobe Compay 18 rue Roger Simo Barboux, Arcueil - Frace

4 Table of Cotets Adobe Campaig v6.1 - Maagig deliverability Chapter 1. Itroductio Foreword Spam characteristics Maagig deliverability Chapter 2. Fuctioal recommedatios Startig a ew platform Seder address Duplicates Opt-out lik ad form Whitelistig No-commercial white lists Commercial whitelists Chapter 3. Techical recommedatios Reverse DNS SPF Cofiguratio of the applicatio DNS cofiguratio Feedback loop List-Usubscribe Presetatio Istallatio SMTP header for reattributig iactive addresses by Yahoo! Itroductio Istallatio Overview Precedece tag Presetatio Istallatio DomaiKeys Itroductio Overview Istallatio DKIM Adobe Campaig v6.1 - Maagig deliverability 3

5 MX Rules Defiitio Istallatio Public ID Examples Checkig SMTP error messages Checkig bouce messages Optimizig quaratie maagemet Quota met IP rotatio volume per IP Exchage betwee stat servers Exteral hostig Choice of domais Domai delegatio Choosig seder ad bouce mail addresses Other aliases Chapter 4. Domai-specific coditios AOL Feedback loop Whitelistig Report Card MSN Hotmail SederID Feedback loop Yahoo Feedback loop Whitelistig DomaiKeys Gmail Mail.ru, ibox.ru Web.de Comcast Feedback loop Outblaze Feedback loop Usa.et Feedback loop Excite Feedback loop Mailtrust Feedback loop Uited Olie (NetZero, Juo) Feedback loop Whitelistig RoadRuer Feedback loop EarthLik Feedback loop Cox Feedback loop Bluetie Feedback loop Chapter 5. Blacklistig databases Spamcop Spamhaus

6 RFC Igorat SORBS No-more-fu URIBL ix Maitu Chapter 6. Deliverability module Techical moitorig Ibox moitorig Ibox rederig Chapter 7. SpamAssassi Presetatio Istallatio Adobe Campaig v6.1 - Maagig deliverability 5

7 6

8 CHAPTER 1 Itroductio Table of Cotets Foreword Spam characteristics Maagig deliverability Foreword Deliverability issues geerally result from ati-spam measures implemeted by iteret service providers ad admiistrators of servers. Such issues rage from IP-address blacklistig, which ca result i reduced throughput, to recipiet-side issues (such as the qualificatio of messages categorized as spam). Spam characteristics Usolicited has certai characteristics that you should avoid as much as possible: A icorrect etwork cofiguratio: Spammers try to coceal their real idetity ad as a cosequece make their servers difficult to idetify. A legitimate etwork cofiguratio that does ot try to hide the idetity of the server is essetial to sedig i large volumes. Sedig to ivalid addresses: Spammers ofte use address geerators based o lists of frequet ames ad first ames; I additio, they rarely process techical otificatios set back by mail servers. A high rate of ivalid addresses is ofte iterpreted as a sig of spam. Double opt-i mechaisms ad effective hadlig of techical bouce messages make it possible to avoid this. High complait rate: ISPs usually have a promiet meas of reportig a received message as spam. This makes it possible to idetify ureliable sources. By rapidly hoorig opt-out requests, makig regular use of a give list, verifyig coset through a double opt-i system, ad implemetig feedback loops, you ca reduce complait rates. Sedig to hoeypot addresses: ISPs ad other orgaizatios (refer to make use of mailboxes that do ot correspod to physical persos but are created simply to trick spammers. These so-called "hoey pot" addresses are published o the Web i order to be collected by spambots ad thus catch illegitimate seders. The use of a double opt-i mechaism precludes this sort of address beig added to a list. Whe usig a third-party list, you must be sure of the methods employed by its maitaier. Aggressive vocabulary ad isistet use of images: To a lesser degree, the cotet of certai messages ca lead certai filters to detect it as spam. The use of certai words, the use of exclamatio poits i the subject lie ad withi the messages are read as telltale sigs of spam. Spammers are also kow to replace text with images to stop offedig text from beig aalyzed automatically by ati-spam filters. I respose to this, a message (i HTML format) with a high proportio of images, or images as attachmets, may ed up beig blocked.. Adobe Campaig v6.1 - Maagig deliverability 7

9 Irregular deliveries with irregular volume-sizes: spammers make programmed deliveries to maitai their reputatio over time. They sometimes eed to adapt their marketig pla to meet the best practices imposed by the ISPs ad so, after a peak i reputatio (ram-up), they cofigure regular deliveries. Maagig deliverability Adobe Campaig icludes fuctioality to maage the risk of o-deliverability ad to track messages. See sectios Deliverability module [page 39] ad SpamAssassi [page 43]. 8

10 CHAPTER 2 Fuctioal recommedatios Table of Cotets Startig a ew platform Seder address Duplicates Opt-out lik ad form Whitelistig No-commercial white lists Commercial whitelists Startig a ew platform Startig to sed o a ew platform is a sesitive step because the platform does ot have ay history of use ad o reputatio (whe the sedig IPs have ever bee used for this purpose). ISPs are aturally suspicious of IP addresses that have ever bee used to sed ad that suddely start to sed large volumes of traffic. I effect, spammers geerally use "ukow" IP addresses (that is to say addresses that have ever bee blacklisted) to sed the largest possible umber of messages before detectio. You caot expect to reach operatioal speed i terms of output at the very start of the productio phase. Furthermore, you should ot attempt to sed messages at this rate as it might lead the ISPs to block the sedig addresses ad to severely compromise the rest of the start-up phase. Startig a platform ofte happes whe usig a list of addresses for the first time ad which may ot be fully qualified. If you sed to ivalid addresses or to hoeypot addresses this will cotribute to dimiishig the reputatio of the platform. If you have a list of ivalid addresses, it is i your best iterests to import it ito the quaraties table (Admiistratio > Campaig Maagemet > No deliverables Maagemet > No deliverables ad addresses) before sedig for the first times. If, all the same, you wish to requalify the ivalid addresses, it is by far preferable to do this oce the reputatio of the platform is established ad bit by bit i order to "dilute" the use of bad addresses over time. To summarize the priciples to be followed whe startig up: Importig ivalid addresses ito the quaraties table (if you have this iformatio), Limitig the throughput rate (techical settig: limitig the umber of mtachilds), Progressively icreasig the volumes set: Do ot target the whole database from the very start, but rather add a extra fractio of the list each time you sed; This should eable you to icrease the volume at each step while reducig the overall rate of ivalid addresses Sedig regularly: To a certai extet is better to sed small shots regularly tha large campaigs sporadically, Payig close attetio to the delivery reports: high error idicators ca mea a techical settig is badly cofigured. Adobe Campaig v6.1 - Maagig deliverability 9

11 Seder address Certai ISPs check validity of the seder address (From) before acceptig messages. A badly formed address may result i it beig rejected by the receivig server. You must make sure a correct address is give at the istace level (meu Tools > Advaced > Deploymet wizard...) or i the most frequetly-used scearios. Duplicates Havig duplicate addresses ca have multiple cosequeces: The same message beig set more tha oce. Eve if Adobe Campaig performs a deduplicatio procedure by default before sedig, there is othig to stop the same message beig set by differet actios havig the same cotet whe a target is split. Usubscriptio requests ot hoored. If a recipiet usubscribes after receivig a message, their duplicate profile will still be eligible for future messages. Besides this side-steppig of opt-i procedures, this situatio will likely lead user to cosider the messages as spam ad to trigger a blacklistig procedure at the ISP. You must be especially prudet whe performig operatios o the database: Imports must be meticulously cofigured, i particular whe choosig the recociliatio key. Chaged addresses ca also be a source of duplicates. I particular, two addresses with differet domais may be routed to the same mailbox, for example i the case of a compay that has chaged ame ad has maitaied the former domai for a certai period of time: joe.doe@amce-co.com ad joe.doe@acme-rebraded.com. Automatic imports, whether they be of lists or from other database are elemets to be take ito accout whe maagig profiles. What happes whe you delete or move a profile i aother partitio? It might be recreated i the iitial partitio by a automatic import, for example, whe a purchase order is placed. The storig of profiles i differet folders ca be implemeted usig views rather tha partitios. I this way, you are sure that the profiles are i the same physical partitio while still eablig the adequate rights to be displayed ad maaged. There are, all the same, cases i which duplicates betwee the differet partitios is ormal. For example, whe sedig for third-parties or differet compay etities, it is logical for the same perso to be a recipiet for differet reasos. It is, however, rarely ormal to fid duplicates withi the same partitio. Opt-out lik ad form By default, whe the message is aalyzed, a typology rule checks whether a opt-out lik has bee icluded ad geerates a warig if it is missig. You ca chage this rule so that a error is raised rather tha a simple warig ad stop a delivery from goig out without this lik. You must check that the opt-out lik works correctly before each time you sed: For example, whe sedig the proof, make sure the lik is valid, that the form is o-lie ad that validatig this chages the value of the No loger cotact this recipiet field to Yes. You should make this check systematically because huma error is always possible whe eterig the lik or whe chagig the form. If a problem is detected cocerig usubscriptio after the delivery is started, it is still possible to perform a usubscriptio maually (usig the mass-update fuctio, for example) for those recipiets who click the opt-out lik eve if they were ot able to cofirm their choice. As a geeral rule, do ot try to get i the way of recipiets who wat to opt-out by requirig them to fill out fields such as their address or ame, for example. The form should have oe validatio butto oly, ad recociliatio should be performed o the ecrypted idetifier oly. Requestig additioal cofirmatio is ot reliable: a user may have two addresses redirected to the same box. If the recipiet is able to remember the first address oly ad wishes to usubscribe via a message set to the other oe, the form will refuse this because the ecrypted idetifier ad the address etered will ot match. 10

12 Fuctioal recommedatios Whitelistig The mai iteret service providers (ISPs) ad Web mail providers maage whitelists from recogized message seders. No-commercial white lists To be accepted by these whitelists, the seder must pass a series of tests based o a techical verificatio (its server must ot be a ope relay ad have a static IP) of the ifrastructure or its activity (delivery frequecy, volume, umber of complaits). If the seder does ot follow oe of these rules, it may be deleted from the whitelist. I its Adobe Campaig Deliverability package, Adobe Campaig offers a accompayig expert cosultig service for the certificatio process for o-commercial whitelists. Commercial whitelists Commercial whitelists are based o a system that allows a seder to pass through ati-spam filters or to have a icomig bous i the ati-spam. These payig white lists (CPT or o a aual basis) are offered by systems such as Retur Path Seder Score. ISPs are free to use these services ad the umber of ISPs ca vary depedig o the whitelist. A seder ca therefore better trusted after sedig these messages by havig a delivery guaratee. Certai whitelists also offer to ope images ad activate liks. Appearig i a whitelist is a udeiable asset for ay campaig. I its Adobe Campaig Deliverability package, Adobe Campaig offers a commercial whitelist certificatio service such as CSA ad Retur Path Seder Score. Adobe Campaig v6.1 - Maagig deliverability 11

13 12

14 CHAPTER 3 Techical recommedatios Table of Cotets Reverse DNS SPF Cofiguratio of the applicatio DNS cofiguratio Feedback loop List-Usubscribe Presetatio Istallatio SMTP header for reattributig iactive addresses by Yahoo! Itroductio Istallatio Overview Precedece tag Presetatio Istallatio DomaiKeys Itroductio Overview Istallatio DKIM MX Rules Defiitio Istallatio Public ID Examples Checkig SMTP error messages Checkig bouce messages Optimizig quaratie maagemet Quota met IP rotatio volume per IP Exchage betwee stat servers Exteral hostig Choice of domais Domai delegatio Choosig seder ad bouce mail addresses Other aliases Adobe Campaig v6.1 - Maagig deliverability 13

15 Reverse DNS A tool to verify the cofiguratio of a domai: A importat poit i the etwork cofiguratio is makig sure a correct reverse DNS is defied for each of the IP addresses for outgoig messages. This meas that for a give IP address, there is a reverse DNS record (PTR record) with a matchig DNS (A record) loopig back to the iitial IP address. The domai choice for a reverse DNS has a impact whe dealig with certai ISPs. AOL, i particular, oly accepts feedback loops with a address i the same domai as the reverse DNS (see Feedback loop [page 30]). SPF Refer to A wizard is available to create SPF records. A tool to verify a SPF record: The SPF (Seder Policy Framework) is a techique that, to a certai extet, eables you to make sure that the domai ame used i a is ot forged. Whe a message from a received from a domai, the DNS server of the domai is queried. The respose is a short record (the SPF record) that details which servers are authorized to sed s from this domai. If we assume that oly the ower of the domai has the meas to chage this record, we ca cosider that this techique does ot allow the seder address to be forged, at least ot the part from the right of the "@". I the fial RFC 4408 specificatio ( two elemets of the message are used to determie the domai cosidered as the seder: The domai specified by the SMTP "HELO" (or "EHLO") commad ad the domai specified by the address of the "Retur-Path" (or "MAIL FROM") header, which is also the bouce address. Differet cosideratios make it possible to take ito accout oe of these values oly; we recommed makig sure that both sources specify the same domai. Checkig the SPF provides a evaluatio of the validity of the seder's domai: Noe: No evaluatio could be performed, Neutral: The domai queried does ot eable evaluatio, Pass: The domai is cosidered authetic, Fail: The domai is forged ad the message should be rejected, SoftFail: The domai is probably forged but the message should ot be rejected solely o the basis of this result, TempError: A temporary error stopped the evaluatio. The message ca be rejected, PermError: The SPF records of the domai are ivalid. It is worth otig that records made at the level of the DNS servers ca take up to 48 hours to be take ito accout. This delay depeds o how ofte the DNS caches of the receivig servers are refreshed. Cofiguratio of the applicatio To defie the domai used for the HELO commad, edit the cofiguratio file of the istace (cof/cofig-istace.xml) ad defie a "localdomai" attribute as follows: <servercof> <shared> <dscofig localdomai="mydomai.et"/> </shared> </servercof> The MAIL FROM domai is the domai used i techical bouce messages. This address is defied i the deploymet wizard or via the Nms _DefaultErrorAddr optio. DNS cofiguratio A SPF record ca curretly be defied o a DNS server as a TXT type record (code 16) or a SPF type record (code 99). A SPF record takes the form of a character strig. For example: v=spf1 ip4: /32 ip4: /32 ~all defies the 2 IP addresses ad as authorized to sed s for the domai. ~all meas that ay other address should be iterpreted as a SoftFail. 14

16 Techical recommedatios Recommedatios for defiig a SPF record: Add ~all (SoftFail) or -all (Fail) at the ed to reject all servers other tha those defied. Without this, servers will be able to forge this domai (with a Neutral evaluatio). Do ot add ptr (opespf.org recommeds agaist this as costly ad ureliable). Feedback loop A feedback look works by declarig at the ISP level a give address for a rage of IP addresses used for sedig messages. The ISP will sed to this mailbox, i a similar way as what is doe for bouce messages, those messages that are reported by recipiets as spam. The platform should be cofigured to block future deliveries to users who have complaied. It is importat to o loger cotact them eve if they did ot use the proper opt-out lik. It is o the basis of these complaits that a ISP will blacklist a IP address. Depedig o the ISP, a complait rate of aroud 1% will result i the blacklistig of a IP address. A stadard is curretly beig draw up to defie the format of feedback loop messages: the Abuse Feedback Reportig Format (ARF). See for further details. Implemetig a feedback loop for a istace requires: a mailbox dedicated to the istace, which may be the bouce mailbox, IP sedig addresses dedicated to the istace. Implemetig a simple feedback loop i Adobe Campaig uses the bouce message fuctioality. The feedback loop mailbox is used as a bouce mailbox ad a rule is defied to detect these messages. The addresses of the recipiets who reported the message as spam will be added to the quaratie list. Create or modify a bouce mail rule, Feedback_loop, i Admiistratio > Campaig Maagemet > No deliverables Maagemet > Mail rule sets with the reaso Refused ad the type Hard. If a mailbox has bee defied specially for the feedback loop, defie the parameters to access it by creatig a ew exteral Bouce Mails accout i Admiistratio > Platform > Exteral accouts. The mechaism is operatioal immediately to process complait otificatios. To make sure this rule is workig correctly, you ca temporarily deactivate the accouts so that they do ot collect these messages, the check the cotets of the feedback loop mailbox maually. O the server, execute the followig commads: lserver stop imail@istace, lserver imail -istace:istace -verbose. If you are forced to used oe sigle feedback loop address for multiple istaces, you must: replicate the messages received o as may mailboxes as there are istaces, have each mailbox picked up by oe sigle istace, cofigure the istace so that they oly process oly the messages that cocer them: the istace iformatio is icluded i the Message-ID header of messages set by Adobe Campaig ad is therefore located also i the feedback loop messages. Simply specify the checkistacename parameter i the istace cofiguratio file (by default, the istace is ot verified ad this may lead certai address to be quaratied icorrectly): <servercof> <imail checkistacename="true"/> </servercof> List-Usubscribe Presetatio Addig a SMTP header called List-Usubscribe is madatory to esure optimal deliverability maagemet. This header ca be used as a alterative to the "Report as SPAM" ico. It will display as a usubscriptio lik i the iterface. Usig this fuctioality helps to protect your reputatio ad feedback will be executed as a usubscriptio. Adobe Campaig v6.1 - Maagig deliverability 15

17 Note: This fuctioality is available from Build To use List-Usubscribe, you must eter a commad lie similar to as follows: List-Usubscribe: mailto: cliet@ewsletter.example.com?subject=usubscribe?body=usubscribe The address cliet@ewsletter.example.com represets the platform's techical address (returpath address). Warig: The example above is based o the recipiet table. If database implemetatio is doe from aother table, make sure to reword the commad lie with the correct iformatio. The followig commad lie ca be used to create a dyamic List-Usubscribe: List-Usubscribe: mailto: %=erroraddress%?subject=usubscribe%=message.mimemessageid% Gmail, Outlook.com ad Microsoft Outlook support this method ad a usubscribe butto is available directly i their iterface. This techique lowers complait rates. Istallatio You ca implemet the List-Usubscribe by: directly addig the commad lie i the delivery template or, creatig a typology rule. Addig a commad lie i a delivery template The commad lie must be added i the additioal sectio of the 's SMTP header. This additio ca be doe i each , or i existig delivery templates. You ca also create a ew delivery template that icludes this fuctioality. Creatig a typology rule The rule must cotai the script that geerates the commad lie ad it must be icluded i the header. Note: We recommed creatig a typology rule: the List-Usubscribe fuctioality will be automatically added i each . 16

18 Techical recommedatios 1 List-Usubscribe: <mailto:usubscribe@domai.com> Clickig the usubscribe lik opes the user's default cliet. This typology rule must be added i a typology used for creatig . 2 List-Usubscribe: < Clickig the usubscribe lik redirects the user to your usubscriptio form. Example: SMTP header for reattributig iactive addresses by Yahoo! Itroductio The ew SMTP header is a madatory tool to cotrol future commuicatio ad persoal iformatio that will be set to Yahoo! users usig a address which has bee reattributed. Istallatio Adobe Campaig lets you add additioal headers that use delivery properties such as List-Usubscribe for example. If you wish, this type of additio ca be used for certai domais oly. This SMTP header is amed "Require-Recipiet-Valid-Sice" ad the deliveries cotaiig this tag "ask" Yahoo! for validatio of the targeted accout. Specific additioal tags: Name: Require-Recipiet-Valid-Sice, Iformatio used i the tag: address. Note: These elemets are ecessary for implemetig the tag ad are called whe it is about a marketig istace. However, real-time istaces operate with a feed: you must update this feed with the Date iformatio. Adobe Campaig v6.1 - Maagig deliverability 17

19 Overview Example If the target address is ad this address has bee preset i the database sice 12th October 2010, the header must be as follows: Require-Recipet-Valid-Sice: kelyslater@yahoo.com; 12 Oct 2010 If this address has bee reattributed to aother Yahoo! user, a error message will idicate this reattributio as a quaratied address. You ca the use a workflow to cotact the target via Facebook or a sms ad update its profile. Precedece tag Presetatio Some ISPs ask for mass seders to add a tag to their header which allows them to be idetified. A good example is Gmail where this tag is a pre-requisite. Istallatio Adobe Campaig lets you add additioal SMTP headers usig the delivery properties, such as the 'List-Usubscribe' tag. This type of SMTP additio ca also be added to certai domais oly For example, to oly iclude this SMTP header i Gmail, the fuctio is as follows: <% if (recipiet.domai == 'gmail.com') { %> Precedece: bulk <% } %> 18

20 Techical recommedatios DomaiKeys This techology, maily sposored by Yahoo, ca be implemeted i Adobe Campaig. Itroductio DomaiKeys is a specificatio usig public key techology to digitally sig a to prove the origi of the message. Note: This fuctioality is available from build 1933 owards. The followig domais curretly validate DomaiKeys: Yahoo, Gmail. Overview Private/Public key Selectors The domai ower geerates a pair of keys (public/private) that will be used to sig the messages set by the users of this domai. The public key is placed i the DNS of the domai as a TXT type record. The private key is kept o the messagig server that seds s for this domai. Whe a is set by the user of the domai, the messagig server uses the private key to sig the message. The sigature is added to the message header before it is set. Whe a siged message is received, the messagig server reads the sigature ad message domai the queries the DNS i order to obtai the public key of the domai. With this public key, the messagig server the checks whether the sigature of the message is valid. Selectors eable a domai to have multiple public keys i the DNS. The admiistrator ca the choose a give key depedig o the type of traffic. If the selector is 'test' ad the domai is 'example.com', the public key will be available from the test._domaikey.example.com TXT-type DNS record. The ame precedig _domaikey is the selector. Adobe Campaig uses default as the default selector. Istallatio Prerequisites This sectio describes the required cofiguratio i Adobe Campaig to eable DomaiKeys. You must be able to update the DNS records for your domai. Geeratig the keys From a commad prompt, use the followig sytax: $ opessl gersa -out rsa.private 1024 The result is a rsa.private file such as: -----BEGIN RSA PRIVATE KEY----- MIICXQIBAAKBgQCUBBPm/6CGCw3Imbgka0GWIp95KTlE645kZVLp3MWLMox4bQUu 2Jks9+3eg/qk5ITFmxH//LB6efRgroW005E7u18Z4FPWj0rKUuGYQTbMLq7+sB KmSZNiVFcuGCl3O8oA7EPPuf0oK9B84FAwp94cBw5qzSdkvd5bMMCwkfVQIDAQAB AoGAWgo8/SmFweTZhq0UGtwk18Oecr8/pL4tNP6Yy8csHeYge132K6ER5muhszs XQByUC7r/Tf/NxIW+fVQeta0lpRki+SBvQOJyzTfXYf1S9XyyIgbPmVz8sQK2Wr KdzUeM1ueSuL82dPJXvkXaXirpm0rSHSYu0D7878/CGzxaUCQQDFUAXsIq3u+iwl 27kkMPKqAb96fUxmF14huxmoB6oMbblFwAT94IxfoXOR5lwEoHZvklcfk0wiIyk vuv+fj1/akeawap1narz6wtychft+rumai5czyfc9bmacestkvmlb3411ooql5qp m2vaeuuw3i8gmji3uzdj18gtetv6s61kwjballzeku0ogx/3zybqzpqemt3kkts pklzrpnomldkgy0g1+snxjw7mxr//ujozjffet4kp+c+goje2+9/7ceekcqgrb ptz/hj2be3vwmkoeos86hgwzk2obsrhmqzdt5t2sfw4lpt3ddavtdjhsvfpira +zfmtsqpxz41fqzrd8cqqdccfvqumtmasfv5hgqjoplox8a6ivfnmsk7p0gpvt 2iwz49E+Os0q5AhghyOmxsmwLjUOmptLBrWMR/gt2w7Q -----END RSA PRIVATE KEY----- Adobe Campaig v6.1 - Maagig deliverability 19

21 Note: Adobe Campaig supports 512, 768, 1024, 1536 ad 2048-bit keys. To date, a miimum legth key is ot a prerequisite, however, it is geerally accepted that a 512-bit key ca potetially by falsified. The legth of the key ca have a impact o throughput (if CPU is the oly limitig factor): 512 bit: - 19 % compared to sedig usiged 768 bit: - 37 % 1024 bit: -60 % 1536 bit: -80 % 2048 bit: - 90 % To extract the public key from the private key, use the followig commad: $ opessl rsa -i rsa.private -out rsa.public -pubout -outform PEM The result is a rsa.public file such as: -----BEGIN PUBLIC KEY----- MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUBBPm/6CGCw3Imbgka0GWIp95 KTlE645kZVLp3MWLMox4bQUu2Jks9+3eg/qk5ITFmxH//LB6efRgroW005E7u18 Z4FPWj0rKUuGYQTbMLq7+sBKmSZNiVFcuGCl3O8oA7EPPuf0oK9B84FAwp94cBw 5qzSdkvd5bMMCwkfVQIDAQAB -----END PUBLIC KEY----- I Widows, you must dowload the OpeSSL library from the followig URL: Savig the public key i the DNS Creatig a TXT-type DNS record for selector._domaikey.example.com : Sytax for BIND default._domaikey.example.com. IN TXT "k=rsa; t=y; p=migfma0gcsqgsib3dqebaquaa4gnadcbiqkbgqcubbpm /6CGCw3Imbgka0GWIp95KTlE645kZVLp3MWLMox4bQUu2Jks9+3eg /qk5itfmxh/ /LB6efRgroW005E7u18Z4FPWj0rKUuGYQTbMLq7 +sbkmsznivfcugcl3o8oa7eppuf0ok9b84fawp94cbw5qzsdkvd5bmmcwkfvqidaqab" Sytax for DJBDNS (TINYDNS) 'default._domaikey. example.com:k=rsa;t=y; p=migfma0gcsqgsib3dqebaquaa4gnadcbiqkbgqcubbpm /6CGCw3Imbgka0GWIp95KTlE645kZVLp3MWLMox4bQUu2Jks9+3eg /qk5itfmxh/ /LB6efRgroW005E7u18Z4FPWj0rKUuGYQTbMLq7 +sbkmsznivfcugcl3o8oa7eppuf0ok9b84fawp94cbw5qzsdkvd5bmmcwkfvqidaqab;:86400 The parameters of the record are defied with the sytax parameter=value. The valid parameters are: g= defies the applicability of the key i relatio to the local ame of the seder. g=*: eables all seders i the domai example.com to use the key. g=seder;: eables this key to be used for messages set from seder@example.com. k = key type. Oly the value rsa is supported. This parameter is optioal. = ote cocerig the key. This ote is iteded for admiistrators ad is ot used by the sigature ad autheticatio processes. This parameter is optioal. p = public key ecoded i Base64. A empty value meas that the key has bee revoked. This parameter is madatory. t = flags defiig attributes. Oe sigle attribute is curretly defied by the specificatio: t=y meas that the domai is usig this key i test phase. The public key ecoded i Base64 correspods to the cotets of the rsa.public file betwee the lies: BEGIN PUBLIC KEY----- ad -----END PUBLIC KEY

22 Techical recommedatios You must also delete the spaces ad the carriage returs. Savig the private key i Adobe Campaig The private key is saved i the form of a optio i the Adobe Campaig database. Coect to Adobe Campaig as the Admiistrator ad the create a optio: Iteral ame: selector_rsa_private_key_domai Type: Log text Value: The private key ecoded i Base64. I the iteral ame of the optio, the selector part is optioal. As the default selector i Adobe Campaig is default, the default_rsa_private_key_example.com ad RSA_PRIVATE_KEY_example.com optios are equivalet. Importat: For the domai value, the period is chaged by Adobe Campaig ito the uderscore character "_". The private key populated i the optio must be the exact cotets of the rsa.private, icludig BEGIN PRIVATE KEY----- ad -----END PRIVATE KEY Eablig DomaiKeys maagemet To eable message sigig for a domai, go to the Admiistratio > Campaig maagemet > No deliverables Maagemet > Mail rule sets folder ad the select Domai maagemet from the list. If the domai is already i the list, simply select the DomaiKeys database, else create a ew rule for this domai ad the select the DomaiKeys optio. Importat: Eablig sederid o the domai forces the techical domai to be used to sig the message. Eablig sederid with DomaiKeys may be useful whe maagig multiple seder domais. Testig the cofiguratio The easiest thig to do is to create a test mailbox o yahoo.com. If DomaiKeys is correctly cofigured, you should receive a message from Yahoo! usig the address of the seder cofirmig the origi of the message. Further iformatio is give i the full headers: Adobe Campaig v6.1 - Maagig deliverability 21

23 DKIM DKIM comes from a combiatio of the DomaiKeys, Yahoo! ad Cisco Idetified Iteret Mail autheticatio priciples ad is used to check the autheticity of the seder domai ad guaratee the itegrity of the message. DKIM is a improvemet o DomaiKeys, ad will supersede it i the future. Usig DKIM requires some prerequisites: Security: ecryptio is a key elemet of the DKIM ad to isure the security level of the DKIM sice the sprig 2013, 1024b is the Best Practices recommeded ecryptio size. Lower DKIM keys will ot be cosidered as valid by the majority of access providers. Reputatio: reputatio is based o the IP ad/or the domai, but the less trasparet DKIM selector is also a key elemet to be take ito accout. Choosig the selector is importat: avoid keepig the default oe which could be used by ayoe ad therefore has a very weak reputatio. You must implemet a differet selector for retetio vs. acquisitio commuicatios ad for autheticatio. Adobe Campaig optio declaratio: i Adobe campaig the DKIM private key is based o a DKIM selector ad a domai. It is ot curretly possible to create multiple private keys for the same domai/sub-domai with differet selectors. It is ot possible to defie which selector domai/sub-domai must be used for the autheticatio i either the platform or the . The platform will alteratively select oe of the private keys, which meas the autheticatio has a high chace of failig. Note: Fuctioality available from build 1937 owards. If you have cofigured DomaiKeys for your Adobe Campaig istace, you just eed to select dkim i the domai hadlig rules. If ot, follow the same cofiguratio steps (private/public key) as for DomaiKeys. It is ot ecessary to eable both DomaiKeys ad DKIM for the same domai as DKIM is a improved versio of DomaiKeys. The followig domais curretly validate DKIM: aol, gmail. MX Rules MX rules (Mail exchager) are the rules that maage commuicatio betwee a sedig server ad a receivig server. Depedig o the material capacities ad the iteral policy, a ISP will accept a predefied umber of coectios ad messages per hour. These variables may be automatically modified by the ISP system depedig o the reputatio of the IP ad sedig domai. Via its deliverability platform, Adobe Campaig maages more tha 150 specific rules by the ISP, ad, i additio, oe geeric rule for other domais. These rules are updated via a daily workflow i order to regularly supply the cliet istace. Defiitio Example The maximum umber of coectios does ot deped exclusively o the umber of public IP addresses used by the MTA. For istace, if you have allowed 5 coectios i the MX rules ad you have cofigured 2 public IPs you might thik that you caot have more tha 10 coectios simultaeously opeed to this domai. This is ot true, i fact the maximum of coectio refers to a path ad a path that is a combiatio of oe of our MTA public IPs ad a public IP of the cliet's MTA. I this example, the user has 2 public IP addresses cofigured ad the domai is yahoo.com. user:~ user$ host -t mx yahoo.com yahoo.com mail is hadled by 1 mta5.am0.yahoods.et. yahoo.com mail is hadled by 1 mta6.am0.yahoods.et. yahoo.com mail is hadled by 1 mta7.am0.yahoods.et. MX records for yahoo.com tell us that yahoo.com has 3 Mail Exchagers. To coect the Peer Mail Exchager, the MTA is goig to request it's IP address from the DNS: 22

24 Techical recommedatios user:~ user$ host -t a mta5.am0.yahoods.et mta5.am0.yahoods.et has address mta5.am0.yahoods.et has address mta5.am0.yahoods.et has address mta5.am0.yahoods.et has address mta5.am0.yahoods.et has address mta5.am0.yahoods.et has address mta5.am0.yahoods.et has address mta5.am0.yahoods.et has address For this record, the user ca cotact 8 peer IP addresses. As he has 2 public IP address this gives him 8 * 2 = 16 combiatios to reach the yahoo.com mail servers. Each of those combiatios is called a path. The secod MX record appears as: user:~ user$ host -t a mta6.am0.yahoods.et mta6.am0.yahoods.et has address mta6.am0.yahoods.et has address mta6.am0.yahoods.et has address mta6.am0.yahoods.et has address mta6.am0.yahoods.et has address mta6.am0.yahoods.et has address mta6.am0.yahoods.et has address mta6.am0.yahoods.et has address of these 8 IP addresses are already used i mta5 ( , , ad ). This record lets the user use 4 ew IP addresses. The third record MX record will do the same. I total, we have 16 remote IP addresses. I combiatio with our 2 local public IPs we have 32 paths to reach yahoo.com mail servers. Note: If 2 MX records are referecig the same IP address, this oe will cout as oe path ad ot two. Istallatio From the Admiistratio > Campaig maagemet > No deliverables Maagemet > Mail rule sets > MX maagemet, you ca access the list of domais that are liked to a MX rule. You will fid: MX mask: domai o which the rule is applied. For example, for the address <foobar@gmail.com>, the domai is gmail.com ad the MX record is: gmail.com mail exchager = 20 alt2.gmail-smtp-i.l.google.com. gmail.com mail exchager = 10 alt1.gmail-smtp-i.l.google.com. gmail.com mail exchager = 40 alt4.gmail-smtp-i.l.google.com. gmail.com mail exchager = 5 gmail-smtp-i.l.google.com. gmail.com mail exchager = 30 alt3.gmail-smtp-i.l.google.com. I this case the MX rule *.google.com will be used. As you ca see, the MX rule mask does ot ecessarily match the domai i the mail. The MX rules applied for gmail.com addresses will be the oes with the mask *.google.com. Shared: Defies the scope of the properties for this MX rule. Whe checked, all of the parameters are shared o all IPs available o the istace. Whe uchecked, the MX rules are defied for each IP. The maximum umber of messages is multiplied by the umber of available IPs. Maximum umber of coectios: maximum umber of simultaeous coectios to the seder's domai. Maximum umber of messages: maximum umber of messages set by a coectio. Message per hour: maximum umber of messages set per hour to the seder's domai. Message per hour (speed): maximum umber of messages set per hour to the seder's domai for the speed selected. There are five speeds available: Slow, Normal, Fast, Very fast, Boost. Adobe Campaig v6.1 - Maagig deliverability 23

25 Note: For more iformatio, refer to the deliverability documet. Public ID A Public ID is a iteral idetifier of a Public IP used by oe or several MTAs. This IDs are defied i the MTA servers i the cofig-istace.xml file. Examples Below are some examples of usig MX rules. Why does the stat server hadle the Messages per hour throttlig whe all messages ca be delivered i less tha a hour? I this example, the user has a limit of 10,000 messages per hour for a particular domai, but the MTA throughput capacity is higher tha this limit. I this case, the traffic is divided ito 12 periods of 5 miutes for each hour, ad the real limit is 833 messages per period. 24

26 Techical recommedatios These messages will be delivered as quickly as possible. How do I apply these cofiguratios for MX rules? MX rules are reloaded automatically every morig at 6AM (server time). You ca also reload them maually ruig the followig commad lie o the server: $ lserver stat -reload Note: This commad lie is preferred to lserver restart. It prevets statistics collected before the restart beig lost ad avoids peaks i use which ca go agaist quotas defied i the MX rules. Checkig SMTP error messages The SMTP errors that are't checked by a rule are listed i the Admiistratio > Campaig Maagemet > No deliverables Maagemet > Delivery logs qualificatio folder. These error messages are by default iterpreted as ureachable soft errors. The most commo errors must be idetified ad a correspodig rule added i Admiistratio > Campaig Maagemet > No deliverables Maagemet > Mail rule sets if you wish to correctly qualify the feedback from the SMTP servers. Without this, the platform will perform uecessary retries (case of ukow users) or wrogly place certai recipiets i quaratie after a give umber of tests. Checkig bouce messages As for the SMTP errors, uprocessed bouce mail or bouce mail processed by Igored type rules must be moitored to determie whether ew rules should be added. For this, it is possible to specify a address the platform will forward these messages to. Adobe Campaig v6.1 - Maagig deliverability 25

27 Optimizig quaratie maagemet Upgradig the quaratie maagemet process cocers mid-sourcig/cloud Messagig ad a platform cofigured with a architecture format with marketig istaces ad a mid-sourcig istace. This upgrade esures that the marketig istace at the origi of the bouce ca process its ow bouce ad add it to its quaratie table. Note: From build 5811, the bouce log will have two IDs to idetify the marketig istace that must process the bouce ad add it to its quaratie table. Message ID, Broadlog ID. Quota met I Adobe Campaig, there is a cofiguratio regardig the umber of s per hour that ca be set. This cofiguratio must be used with vigilace, as the umber defied i the istace cocers the umber of coectios carried out with the ISP ad ot the umber of s actually set. This meas a coectio ca use a MX rule without successfully sedig a . I this case, a cofiguratio with a IP or a domai with a low reputatio will have to try several coectios before sedig a . For each attempt, a message per hour credit will be used. As a result, the marketig campaig performace will be sigificatly impacted. So quota met is ot oly a cofiguratio issue but ca also be liked to reputatio. It is importat to aalyze error messages i the platform the SMTP log. IP rotatio I particular whe startig up a ew platform, we recommed implemetig a system of rotatig the IP addresses used at the hardware level. This cosists of keepig a certai umber of IP address as backup addresses if the IP addresses beig used are blacklisted by a ISP. You ca start reusig the IP addresses you have let 'lie fallow' oce the restrictio is raised, i geerally after a few hours or at worst a few days. You must, however, make sure each IP is used regularly (at least 100 messages over a day per moth) so that it does ot lose its reputatio or get removed from the feedback loops or whitelists. Whe the reputatio of the platform is firmly established, you may cosider permaetly usig all the IPs. volume per IP From the Build 6830, Adobe Campaig stores the IP reputatio ad volume set per IP i a log file i order to have a better cotrol over this. This iformatio is available i a report. Warig: Whe this optio is implemeted, it is madatory to add a colum i the database. The update ca the take more or less time: it is importat to schedule this update durig a period of low activity. Exchage betwee stat servers I the cotext of a migratio or certai mid-sourcig/cloud messagig projects, we eed to have a marketig istace commuicatig with a ew versio of a mid-sourcig/cloud messagig istace. 26

28 Techical recommedatios Most of the time the versioig is differet from a update to a mior build, but the cofiguratio may require you to istall the most recet versio of the software. Durig this phase (which is a mix of the old versio ad the ew versio, which use the same IPs) it is ecessary to keep the itegrity of the MX rules. I this case oly, the stat server ca ru the two differet versios of the mid-sourcig/cloud messagig. Note: The most recet versio of the software must always be the master versio, however you must esure there is correct commuicatio betwee the MTAs ad stat server. Exteral hostig Whe discussig sedig s, we shall refer to exteral hostig whe the Adobe Campaig platform is: Etirely hosted exterally (database, trackig servers ad MTA servers), I mid-sourcig mode: the database ad applicatio server are located withi the local etwork whereas the MTA portio is exteralized. Choice of domais Exteral hostig, for techical reasos, implies almost systematically that the domai used i the techical sedig addresses ad the tracked liks is differet from the mai address of the seder. For example: The advertiser uses the domai domai.com i all commuicatios. The hoster caot techically use this domai to receive bouce messages because domai.com is the corporate messagig domai ad is ot iteded for such purposes. The hoster ca techically use domai.com for trackig because it is used by the Web site of the advertiser. The hoster must therefore use a differet domai that we will refer to as a techical domai, for example dml.et. This domai will be used to receive bouce mail ad redirect tracked liks. With this said, we will make two poits: 1 The seder address (From), which is the most commoly displayed address, ca always be give as the address of the advertiser domai.com 2 The tracked liks withi the message will use the techical domai dml.et To date, this way of operatig is permitted, however: If we cosider Hotmail, usig SederId will display the seder as From: dm-bouces@dml.et o behalf of Marketig Domai (marketig@domai.com), which may cofuse the recipiet as to the origi of the message. If the message is supposed to be set by a advertiser recogized by the domai domaie.com, the a cotaiig liks usig the domai dml.et could be cosidered as a attempt at phishig. I extreme cases, certai ati-spam filters may reject the message as suspicious based o the differece betwee the bouce domai ad the seder domai. It is therefore icreasigly importat that there is o doubt as to the autheticity of the seder based o the techical sedig domai. For this reaso, we recommed usig a techical sedig address that is a sub-domai of the advertiser's domai. I the previous example, we could use l.domai.com, ad i this way a recipiet would have o doubt that the techical seder of the message ad the tracked liks really do come from domai.com. The bouce address as l.domai.com ca be maaged directly by the hoster ad the trackig liks l.domai.com ca poit to their redirectio servers. Domai delegatio If a sub-domai eeds to be set up by the hoster it must be iitiated by the domai ower (the advertiser). It is techically possible for the ower to perform the DNS cofiguratio (MX, A, SPF...) of the sub-domai, however we advise agaist this because the hoster depeds o it for ay modificatio made to the DNS ad this is a potetially dagerous situatio (risk of losig bouce mail, or failure of trackig mechaisms) give the costraits of ruig a platform. We strogly recommed delegatig the sub-domai to the hoster. To delegate the admiistratio of a sub-domai to a third party, the ower of the mai domai must declare NS records for the sub-domai desigatig the DNS servers of the hoster. Adobe Campaig v6.1 - Maagig deliverability 27

29 Choosig seder ad bouce mail addresses Because the seder address is the most visible address to the recipiet, there should be o doubt as to its idetity ad should be defied usig the domai of the advertiser or at least a sub-domai, for example marketig@domai.com or marketig@l.domai.com. If the SPF record of the advertiser's domai authorizes the IP addresses used by the platform, it is ot ecessary to eable the Seder ID parameter i Adobe Campaig for MSN Hotmail domais ad the choice of the address for bouce messages is ot restricted. If the SPF record of the advertiser's domai does ot authorize the IP addresses used by the platform, the Seder ID parameter will have to be used for MSN Hotmail. I this case, the bouce address is give to the recipiet i the message header. You must choose a address that does ot suggest spam, meaig a address that refers to the seder ad does ot appear to be too techical, for example marketigerr@dml.et rather tha dm-bouces405@dml.et. Other aliases Adobe Campaig lets you defie differet aliases for trackig, mirror pages ad web forms ad thus defie a architecture that is appropriate for the availability ad productio costraits you have. To maitai cosistecy betwee these domais, you ca, for example, defie extra sub-domais as show below: Trackig: l.domai.com Mirror pages: m.l.domai.com Web forms: f.l.domai.com 28

30 CHAPTER 4 Domai-specific coditios Table of Cotets AOL Feedback loop Whitelistig Report Card MSN Hotmail SederID Feedback loop Yahoo Feedback loop Whitelistig DomaiKeys Gmail Mail.ru, ibox.ru Web.de Comcast Feedback loop Outblaze Feedback loop Usa.et Feedback loop Excite Feedback loop Mailtrust Feedback loop Uited Olie (NetZero, Juo) Feedback loop Whitelistig RoadRuer Feedback loop EarthLik Feedback loop Cox Feedback loop Bluetie Feedback loop This sectio describes the specific mechaisms of a represetative selectio of ISPs i the B2C area. Readig the message headers received by the ISPs is ofte a good idicatio of how the messages are cosidered i relatio to spam. software ad Webmail services geeral eable you to display the message headers i full (usually, by default, o the seder, date, subject ad recipiet are show). Adobe Campaig v6.1 - Maagig deliverability 29

31 AOL AOL provides high-volume seders with feedback loop ad whitelistig services. Whitelistig eables messages from certai IP addresses to be delivered without filterig. It is essetial to implemet a feedback loop before requestig whitelistig because whitelistig will oly be accepted if there is low complait rate for the sedig IP addresses, which is ulikely if the feedback loop is ot implemeted. You must the wait for at least 30 days before requestig whitelistig. Feedback loop The followig form eables you to request a feedback loop: Oce validated, you will receive a with a cofirmatio lik at the feedback address. You must make sure, before validatig this form, that the mailbox is workig ad that you ca collect its cotets. After validatig the lik, the service is usually implemeted withi 24 hours. The rule for bouce otificatios from AOL is already implemeted i Adobe Campaig Whitelistig Whitelistig requests ca be made from O request, AOL will moitor outgoig s ad complait rates over a period of 3 weeks. After such time, a decisio is made ad otificatio set to the cotact address specified i the form. Importat: The whitelistig form goes had i had with a feedback loop request. If both whitelistig ad feedback loop requests are made, the feedback loop messages will be set twice. Report Card O days whe the complait rate exceeds 0.1%, AOL automatically seds a Report Card to the postmaster address of the domai metioig the complait rate ad ecessity of maitaiig a low rate. These messages are set from postmaster@aol.com with a subject such as AOL cocers for yourdomai.com. This idicator eables you to evaluate the correct fuctioig of the feedback loop ad the opt-i mechaisms. MSN Hotmail Refer to The site has a form to cotact techical support. Cosult the complait rates for IP addresses: Usig this service eables you to moitor, o a daily basis ad for each IP address, the complait rates ad the umber of messages received by hoeypot addresses. To use this service, you must be able to receive messages set to oe of the followig addresses whose domai ame is deduced by reverse DNS ad the RIPE database usig the requested IP addresses: abuse@domai postmaster@domai A message with the cofirmatio data will be set to the oe of these addresses. If you cotact MSN Hotmail support, you will lear that spam filterig is operated by two differet etities. s received are first processed by Symatec (cotact Symatec Brightmail, <ivestigatio@review.symatec.com> for ay queries due to filterig at their level) who filters messages based o complait rates ad the umber of messages received at hoeypot addresses. Secodly, MSN Hotmail processes those messages that have bee let through by Symatec. At this level, they are ot aware of the reasos for which messages are blocked at the Symatec level. SederID MSN Hotmail is implemetig a autheticatio techology called SederID. It is essetially a variat of the SPF recommedatios. 30

32 Domai-specific coditios The DNS cofiguratio required for SederID is more striget tha that required by SPF. I particular, 3 records SPF, MX ad A are checked for the sedig domai. The Microsoft wizard eables you to verify the DNS cofiguratio of a domai ad offers help i defiig the SPF record. Certai headers are iterestig from this poit of view: X-SID-PRA: Marketig Domai <marketig@domai.com> X-SID-Result: TempError From: Marketig Domai <marketig@domai.com> Retur-Path: dm-bouces@dml.et The X-SID-PRA header is the address of the purported resposible seder (for more iformatio o the PRA, refer to calculated from other lies i the header as the address most represetative of the idetity of the seder. It is the domais i this address ad the Retur-Path address that are used as the referece for checkig the SPF records. If there are specific costraits for the domais used, usig a proprietary extesio of the SederID techology it is possible to cofigure the SPF records so that they oly apply to the Retur-Path or the PRA. Note: If the seder address (From) does ot match the PRA, Microsoft recommeds displayig both addresses explicitly i the cliet, which has the effect of showig the bouce address to the fial recipiet. Thus, i Hotmail, is seder is show as follows: From: dm-bouces@dml.et with the ame Marketig Domai (marketig@domaie.com) I order to make sure the bouce address does ot appear i the message header, you must apply the followig recommedatios: 1 Disable SederID i Adobe Campaig. 2 Make sure there is a valid SPF for each of the sedig domais 3 Make sure there is a valid public domaikey for each of the sedig domais. The X-SID-Result header gives the SederID evaluatio of the message upo receipt. The values used are the same as defied i the SPF. If the sedig ad the DNS records are correct ad a TempError is evaluated, it may be a problem of a obsolete DNS cache. MSN Hotmail uses a cache mechaism for SederID. To make sure the record is i the cache, simply fill i the olie form at the followig address: Note: Whe sederid is selected i Adobe Campaig, a Seder header with the bouce mail address is added to the messages. Thus the PRA value matches the bouce mail address. Feedback loop Below is a questioaire for compaies/cliets iterested i this program: 1 Your compay ame, the primary cotact ad a cotact 2 Does your compay follow stadard CAN-SPAM Act practices? 3 The opt-out lik for each list. Please iclude a fuctioal lik that we ca use for a oe time test. If you require users to have a accout, please provide a accout that we ca access ad close for the purpose of testig. 4 The home page where people sig up for each list. 5 Seder IPs for verificatio. 6 Is the IP address registered uder your compay's ame/domai ame? Or do you have exclusive sedig rights from the IP via your hostig compay (ot shared with ay other seders)? Please provide supportig documetatio. 7 Ca you remove recipiets that complai from these lists? Adobe Campaig v6.1 - Maagig deliverability 31

33 If the aswers to items 6 ad 7 are "o", Microsoft will be uable to eroll your compay at this time. The aswers to questios 6 ad 7 must be yes i order to use a feedback loop. With Adobe Campaig, aswer to questio 7 is yes. You ca request a feedback loop by fillig i the followig form: The service will retur a so-called Juk Reportig Agreemet, which you must complete ad sig digitally. At the same time, you must sed the techical details of the feedback loop required by 1 Name of the pricipal compay cotact, 2 Address, 3 Telephoe umber, 4 address, 5 The IP addresses used (a maximum of 150, separated with semi-colos), 6 The address of the feedback loop, 7 The maximum umber of s to sed per day usig the feedback loop (optioally o limit), 8 The message format: Attached accordig to RFC 822 or the origial messages. For questio umber 8, you must choose format RFC 822. The bouce mail rule for Hotmail is already implemeted i Adobe Campaig. Yahoo Refer to Two items from the header are used to qualify the sedig platform: X-YahooFilteredBulk: Autheticatio-Results: mta244.mail.mud.yahoo.com from=domai.com; domaikeys=eutral (o sig) A X-YahooFilteredBulk header meas that the message was directed to the user's spam folder. The Autheticatio-Results header gives the evaluatio of the seder usig the Domai Keys techology. I the example, domaikeys=eutral (o sig) meas that the sedig platform has ot implemeted this techology. Feedback loop The followig form eables you to request a feedback loop: Note: I order to implemet a feedback loop, you must: have a Yahoo accout, use the DomaiKeys or DKIM autheticatio stadard. Whitelistig Without a prior request, Yahoo will cosider messages set from a ukow IP address as spam ad users will receive these messages i the correspod folder of their webmail. A whitelistig request ca be made usig the form at Importat: Whe you request whitelistig from Yahoo, it is very importat to correctly uderstad ad scrupulously respod to all the questios. If you do ot do this, Yahoo will probably reject your request ad at the same time recommed that you review your practices before makig a ew request i 6 moths' time. 32

34 Domai-specific coditios Yahoo will the moitor messages set over a period of several days. Durig this time, s will be received i either the ibox or the spam folder. Yahoo will make a decisio to whitelist the platform based o this. This period usually lasts about 3 weeks. DomaiKeys Whe the domai validated by DomaiKeys is idetical to the seder domai, Yahoo displays a key to tell the user that the seder is legitimate ad tested by DomaiKeys. Gmail Gmail uses SPF. Usig a Gmail accout is also a good way of checkig the SPF is cofigured correctly. If the SPF is cofigured correctly, messages received will iclude the followig i the header: Received-SPF: pass (gmail.com: domai of istace-bouces@modomaie.et desigates as permitted seder) Received-SPF: pass (gmail.com: best guess record for domai of postmaster@mydomai.com desigates as permitted seder) Whe the SPF is ot defied for the domai, this lie will look like the followig: Received-SPF: eutral (gmail.com: is either permitted or deied by domai of bouces@l.mydomai.et) Fially, whe the seder address is forged, the header cotais the followig lie: Received-SPF: softfail (gmail.com: domai of trasitioig usurpe@spammeur.et does ot desigate as permitted seder) Gmail also checks the DomaiKeys sigatures. Mail.ru, ibox.ru Refer to Web.de It is possible to cotact techical support via the o-lie forms available at the followig address: Comcast Feedback loop You ca request a feedback loop usig the followig form: Outblaze Feedback loop Write to the followig address to request a feedback loop: postmaster@outblaze.com. Adobe Campaig v6.1 - Maagig deliverability 33

35 You must commuicate the followig iformatio: The IP list or rage i questio. The sedig domai used. The pricipal cotact (full ame, ad telephoe). The feedback loop accout. Usa.et Feedback loop The followig form eables you to request a feedback loop: Excite Feedback loop The followig form eables you to request a feedback loop: Mailtrust Feedback loop The followig form eables you to request a feedback loop: Uited Olie (NetZero, Juo) Feedback loop The followig form eables you to request a feedback loop: Whitelistig Whitelistig requests ca be made through the followig page: Importat: The whitelistig form works with the feedback loop request. RoadRuer Feedback loop The followig form eables you to request a feedback loop: 34

36 Domai-specific coditios EarthLik Feedback loop Write to the followig address to request a feedback loop: fblrequest@abuse.earthlik.et. You must commuicate the followig iformatio: The IP list or rage i questio. The sedig domai used. The pricipal cotact (full ame, ad telephoe). The feedback loop accout. Cox Feedback loop The followig form eables you to request a feedback loop: Bluetie Feedback loop The followig form eables you to request a feedback loop: Adobe Campaig v6.1 - Maagig deliverability 35

37 36

38 CHAPTER 5 Blacklistig databases Table of Cotets Spamcop Spamhaus RFC Igorat SORBS No-more-fu URIBL ix Maitu Several orgaizatios maitai databases of IP addresses ad domais that are reputed to be used by spammers. Cosultig these sites ca be useful to uderstad why certai messages were rejected as spam. It is geerally possible to request the removal of a address erroeously added to these lists. These databases are called RBLs (Real-time Blackhole Lists) ad they are cosulted via a DNS mechaism. There are three types of RBLs: By IP address: lists IP addresses sedig spam or likely to be relayig spam. By seder domai: lists seder domais (full domai of the bouce mail address) sedig spam or icorrectly cofigured By web domai: lists the domais (high-level domais as registered with the registrars) foud i the URLs of the liks ad images cotaied i spam cotet. I Adobe Campaig, the domai to be take ito cosideratio is geerally the address used for trackig. The followig is a list of the most widely used RBLs. For a more comprehesive list, you ca refer to or ("IP Tools" sectio, "Spam Database Lookup" form). Spamcop Refer to Oe of the best kow databases. If you are o this list, it is geerally a bad sig. Spamhaus Refer to Oe of the best kow databases. If you are o this list, it is geerally a bad sig. Adobe Campaig v6.1 - Maagig deliverability 37

39 RFC Igorat Specialized i the compliace with the RFC recommedatios, this site does ot measure reputatio but rather the techical compliace of a domai. SORBS compiles a list of IP addresses that are reputed to be dyamic IP address (i.e. attributed temporarily to ISP subscribers) or "ope relay" addresses. Certai domais check whether the IP address of a seder is ot listed o this site before acceptig . Checkig the IP addresses o this site ca prove useful. No-more-fu Refer to Lists the IPs assiged dyamically by the major ISPs to the geeral public. Newly used IPs are frequetly listed here. Removal is simple ad quick. URIBL Refer to This list cotais the domais foud i the URLs withi spams. We will therefore test the domai used for the trackig liks agaist this database. ix Maitu This is a list of IPs ad is widely used i Germay. See 38

40 CHAPTER 6 Deliverability module Table of Cotets Techical moitorig Ibox moitorig Ibox rederig Adobe Campaig offers tools to track the deliverability performace of your platform. These fuctios are part of a dedicated optio, the Deliverability module. Whe this module is cofigured for your Adobe Campaig platform, you have access to the followig iformatio: Techical trackig report for day to day deliverability performace (techical moitorig) ISP ibox rederig report, Overview of message quality (ibox, spam), Techical moitorig The techical moitorig report is available via the Deliveries > Deliverability > Techical moitorig meu i the Adobe Campaig home page. It icludes a umber of deliverability quality idicators for your platform (the idicators are updated daily at 9 AM). I additio, you are able to receive a daily report by at a specified address. Please let us kow the requested address by . Some techical terms: Adobe Campaig v6.1 - Maagig deliverability 39

41 IP ad RBL domai (Realtime Blackhole List): List of IP addresses of pollutig domais. These lists are maitaied by dedicated orgaizatios (such as SpamHaus, Spamcop...). Adobe Campaig curretly processes these lists. These RBLs reflect your reputatio ad ca be queried by the ISPs before acceptig to receive your s. SPF (Seder Policy Framework): Mechaism eablig you to check whether the seder is authorized o the sedig domai. SNDS(Smart Network Data Services): A Widows Live Hotmail ati-spam service. ( DomaiKeys: service developed by Yahoo ad iteded to certify the idetity of a seder. Reverse DNS: Adobe Campaig checks whether a reverse DNS is give for a IP address ad that this correctly poits back to the IP. SederScore: Database of reputed servers ( Ibox moitorig This report is available from the Deliveries > Deliverability > Ibox moitorig meus of the Adobe Campaig home page. It gives a overview of the quality of s set over a give period of time. A bechmark compariso is also made with the other platforms that have subscribed to the deliverability service. Ibox rederig This report is available for each delivery, i the rederig tab. Note: The umber of rederig reports is limited mothly accordig to your licese agreemet. The couter is reset every 25th day of the moth. Adobe Campaig has implemeted a dedicated workflow (Update seed etwork for Ibox Rederig) to eable you to recover the target addresses to use for your proof. This workflow is located i the Admiistratio > Productio > Techical workflows ode of the Adobe Campaig tree. This workflow creates ad updates the addresses used i the seed etwork. It rus daily at 5 AM. To force it to ru straightway, right click o the scheduler ad select Execute pedig task(s) ow. The cotacts are iserted i a folder amed Ibox Rederig recipiets ad assiged to a group Ibox Rederig recipiets to eable rapid targetig. 40

42 Deliverability module Simply add this group i your delivery actios to eable the Adobe Campaig capture process. The rederig thumbails ca be accessed i the Ibox rederig tab of the delivery a few miutes after sedig the s. Note: Each sedig is couted off agaist your umber of authorized rederig reports. Use the Update rederig butto to update the list. Example of a rederig report: Adobe Campaig v6.1 - Maagig deliverability 41

43 Note: If you have defied specific access rights for your operators, they require read rights for the "Ibox rederig recipiets" ad the associated group. This mode implies usig the msrecipiet table. If ot, you have to iclude the target addresses i your cotact table. If you use persoalizatio elemets i your s, the "source" profiles must be specified as a cosequece. 42

44 CHAPTER 7 SpamAssassi Table of Cotets Presetatio Istallatio Presetatio Adobe Campaig ca be cofigured to work with SpamAssassi. This makes it possible to score s to determie whether a message rus the risk of beig cosidered as spam by the ati-spam tools used upo receipt. Before startig a delivery, the Preview tab eables you to evaluate the risks. A warig message give the result of the test as i the followig example: Adobe Campaig v6.1 - Maagig deliverability 43

45 The Detail... lik eables you to view the aalysis type, from the Ati-spam checkig tab. If a high level of risk is detected, the followig message is displayed: 44

46 SpamAssassi The reasos for this risk are give i the Poits > Rule > Descriptio sectio of the Ati-spam checkig tab. Note: SpamAssassi must be istalled ad cofigured o the Adobe Campaig applicatio server. Istallatio For further iformatio o cofigurig SpamAssassi i Adobe Campaig, please refer to the Istallatio Guide. Adobe Campaig v6.1 - Maagig deliverability 45