How to Meet the New t-online.de Email Delivery RequirementsLuke Martinez
What has changed at t-online.de?
Over the past several weeks t-online.de, a major mailbox provider in Germany, announced a few significant changes to the way it accepts email. The short version of these changes is this:
To get email accepted by t-online.de, the sender must have full domain alignment across their Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), reverse DNS (rDNS), and From domains.
This means if you send email from example.com:
- Your SPF domain (also called the Return-Path domain) must be example.com or a subdomain of example.com. This configures automatically after you set up domain authentication.
- Your DKIM domain must be example.com or a subdomain of example.com. This also configures automatically after you set up domain authentication.
- Your sending IP’s rDNS must be example.com or a subdomain of example.com. You can set up reverse DNS for your sending IPs by following the instructions here.
Your domains across SPF, DKIM, and rDNS must all match for t-online.de to accept your mail.
What should you look for when sending to t-online.de?
If you send email to recipients at t-online.de, check your event webhook data or email activity feed for block events from t-online.de with the following reason: “554 IP=xxx.xx.xxx.xx – A problem occurred. (Ask your postmaster for help or to contact firstname.lastname@example.org to clarify.).”
What should you do to comply with t-online.de’s policies?
As a result of the changes implemented by t-online.de, many senders will encounter increased blocking when sending email to t-online.de recipients. Here are a few steps you can take if you notice your deliverability rates to t-online.de dropping or you see an increase in deferrals or blocks.
I use a dedicated IP address and t-online.de is blocking my email.
- Ensure the domain you send email from fully configures with Twilio SendGrid’s Domain Authentication.
- Ensure that you configure your sending IPs with your reverse DNS domain.
I use shared IP addresses and t-online.de is blocking my email.
There is no resolution for this issue for senders who want to stay on shared IPs. Unfortunately, t-online.de has implemented a set of requirements that is fundamentally incompatible with shared IP sending. The negative impacts of these changes are not limited to Twilio SendGrid customers. Every organization using shared IPs to send messages to t-online.de recipients, regardless of the email service provider, has been impacted.
If communication with your t-online.de recipients is critical for your organization, we recommend that you upgrade to a dedicated IP address, then configure Domain Authentication and custom rDNS to achieve proper alignment.
I have dedicated IPs, but I send email from a number of different domains.
The requirements from t-online.de are clear: if the domain in the From address doesn’t match the SPF, DKIM, and rDNS domains, it will reject the email. In some cases, senders will be able to set up IP pools to address this issue. If you create IP pools, you’ll be able to specify which pool of IPs a message will go through. If you create a pool for each of the domains you send from, and the rDNS of the IPs in those pools match the domain in the From address, you’ll be able to successfully deliver your email.
In other cases, where the number of different sending domains is large, it may be impossible to successfully deliver email to t-online.de. Just remember: the only way to get your email through is to have full alignment with your From domain across your SPF, DKIM, and rDNS domains.
My mail is being blocked by t-online.de, but none of the above applies to me.
If you find that t-online.de blocks your email and you are confident that you have full domain alignment, you’ll need to review the t-online.de postmaster page and ensure that you are in compliance with all of the recommendations, best practices, and requirements.
Next steps with t-online.de
It is likely that the changes implemented by t-online.de will impact some of our customers’ ability to reach recipients at t-online.de. However, even if you aren’t seeing an impact in your delivery to t-online.de based on these requirements, we recommend completing domain authentication and reverse DNS with your dedicated IP address(es) for optimal email delivery across your recipient mailbox providers.
If you’d like to learn more about email deliverability and authentication best practices, check out the following resources:
- 2022 Email Deliverability Guide
- How to Authenticate Your Email in 5 Steps
- How to Stop Your Emails From Going to Spam
We will continue to monitor developments and updates from t-online.de and update this article if there are any substantive changes.