Over the past several weeks t-online.de, a major mailbox provider in Germany, announced a few significant changes to the way it accepts email. The short version of these changes is this:
Your SPF domain (also called the Return-Path domain) must be example.com or a subdomain of example.com. This configures automatically after you set up domain authentication.
Your DKIM domain must be example.com or a subdomain of example.com. This also configures automatically after you set up domain authentication.
Your sending IP's rDNS must be example.com or a subdomain of example.com. You can set up reverse DNS for your sending IPs by following the instructions here.
Your domains across SPF, DKIM, and rDNS must all match for t-online.de to accept your mail.
If you send email to recipients at t-online.de, check your event webhook data or email activity feed for block events from t-online.de with the following reason: “554 IP=xxx.xx.xxx.xx - A problem occurred. (Ask your postmaster for help or to contact tosa@rx.t-online.de to clarify.).”
As a result of the changes implemented by t-online.de, many senders will encounter increased blocking when sending email to t-online.de recipients. Here are a few steps you can take if you notice your deliverability rates to t-online.de dropping or you see an increase in deferrals or blocks.
There is no resolution for this issue for senders who want to stay on shared IPs. Unfortunately, t-online.de has implemented a set of requirements that is fundamentally incompatible with shared IP sending. The negative impacts of these changes are not limited to Twilio SendGrid customers. Every organization using shared IPs to send messages to t-online.de recipients, regardless of the email service provider, has been impacted.
If communication with your t-online.de recipients is critical for your organization, we recommend that you upgrade to adedicated IP address, then configureDomain Authenticationandcustom rDNSto achieve proper alignment.
The requirements from t-online.de are clear: if the domain in the From address doesn’t match the SPF, DKIM, and rDNS domains, it will reject the email. In some cases, senders will be able to set up IP pools to address this issue. If you create IP pools, you’ll be able to specify which pool of IPs a message will go through. If you create a pool for each of the domains you send from, and the rDNS of the IPs in those pools match the domain in the From address, you’ll be able to successfully deliver your email.
In other cases, where the number of different sending domains is large, it may be impossible to successfully deliver email to t-online.de. Just remember: the only way to get your email through is to have full alignment with your From domain across your SPF, DKIM, and rDNS domains.
If you find that t-online.de blocks your email and you are confident that you have full domain alignment, you’ll need to review thet-online.de postmaster pageand ensure that you are in compliance with all of the recommendations, best practices, and requirements.
It is likely that the changes implemented by t-online.de will impact some of our customers’ ability to reach recipients at t-online.de. However, even if you aren't seeing an impact in your delivery to t-online.de based on these requirements, we recommend completing domain authentication and reverse DNS with your dedicated IP address(es) for optimal email delivery across your recipient mailbox providers.
If you’d like to learn more about email deliverability and authentication best practices, check out the following resources:
