What has changed at t-online.de?
Over the past several weeks t-online.de, a major mailbox provider in Germany, announced a few significant changes to the way they accept email. The short version of these changes is this:
In order to get email accepted by t-online.de, the sender must have full domain alignment across their Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), Reverse DNS (rDNS), and From domains.
This means if you send email from example.com:
- Your SPF domain (also called the Return-Path domain) must be example.com or a subdomain of example.com. This is configured automatically after you set up domain authentication.
- Your DKIM domain must be example.com, or a subdomain of example.com. This is also configured automatically after you set up domain authentication.
- The rDNS of your sending IP(s) must be example.com or a subdomain of example.com. You can set up reverse DNS for your sending IPs by following the instructions here.
Your domains across SPF, DKIM, and rDNS must all match for t-online.de to accept your mail.
What should you look for when sending to t-online.de?
If you send email to recipients at t-online.de, check your event webhook data or email activity feed for block events from t-online.de with the following reason: “554 IP=xxx.xx.xxx.xx – A problem occurred. (Ask your postmaster for help or to contact email@example.com to clarify.)”
What should you do to comply with T-Online’s policies?
As a result of the changes implemented by t-online.de, many senders will encounter increased blocking when sending email to t-online.de recipients. Here are a few steps you can take if you notice your deliverability rates to t-online.de dropping or you see an increase in deferrals or blocks.
I use a dedicated IP address and t-online.de is blocking my email.
- Ensure the domain you are sending email from is fully configured with SendGrid’s Domain Authentication
- Ensure your sending IPs are configured with your own Reverse DNS domain
I use shared IP addresses and t-online.de is blocking my email.
There is no resolution for this issue for senders who want to stay on shared IPs. Unfortunately, t-online.de has implemented a set of requirements that is fundamentally incompatible with shared IP sending. The negative impacts of these changes are not limited to SendGrid customers. They are being felt by every organization who uses shared IPs to send messages to t-online.de recipients regardless of their Email Service Provider.
If communication with your t-online.de recipients is critical for your organization we recommend that you upgrade to a dedicated IP address and then configure Domain Authentication and custom rDNS in order to achieve proper alignment.
I have dedicated IPs, but I send email from a number of different domains.
The requirements from t-online.de are clear: if the domain in the From address doesn’t match the SPF, DKIM, and rDNS domains, they will reject the email. In some cases, senders will be able to set up IP pools to address this issue. If you create IP pools, you’ll be able to specify which pool of IPs a message will go through. If you create a pool for each of the domains you send from, and the rDNS of the IPs in those pools match the domain in the From address, you’ll be able to successfully deliver your email.
In other cases, where the number of different sending domains is large, it may be impossible to successfully deliver email to t-online.de. Just remember: the only way to get your email through is to have full alignment with your From domain across your SPF, DKIM, and rDNS domains.
My mail is being blocked by t-online.de, but none of the above applies to me.
If you find that your email is being blocked by t-online.de and you are confident that you have full domain alignment, you’ll need to review the t-online.de postmaster page and ensure that you are in compliance with all of their recommendations, best practices, and requirements.
Next steps with t-online.de
It is likely that the changes implemented by t-online.de will impact some of our customers’ ability to reach recipients at t-online.de. However, even if you aren’t seeing an impact in your delivery to t-online.de based on these requirements, we recommend completing domain authentication and Reverse DNS with your dedicated IP address(es) for optimal email delivery across your recipient mailbox providers.
If you’d like to learn more about email deliverability and authentication best practices, check out the following resources:
We will continue to monitor developments and updates from t-online.de and update this article if any substantive changes are made.