Does sending e-mail in the name of customers increase the risk of being marked as spammer?

Question

We are developing a SaaS website application that lets users send invoices to their clients. Ideally, these e-mails should appear to be originating from our customers, so the sender e-mail address domain will not match the reverse IP entry for our server. In effect we would be forging their e-mail address, but of course with their consent.

Will that result in a higher probability of being marked as a spammer / their e-mails being marked as spam?

If yes, how bad is the penalty?

And what about people who have an e-mail address originating form an SPF-enabled domain? I guess it should be the majority of the big e-mail providers.

Answer 1

It will certainly increase the spam score, although by how much will depend on each filter technique and implementation. A bigger problem may be that some systems will simply reject the messages, unless each customer adds an appropriate entry into their SPF record. Without that your system may not be recognised as authorised to send messages for that domain.

Answer 2

Why not set the envelope sender address to an address you control (customername-invoice-bounces@yourdomain, if you like), and just set the From: line in the headers to the customer's intended sending address?

To 99% of recipients, the email appears to come from your customer, but you get to handle bounces however you please, and avoid falling foul of SPF and similar checks.

Answer 3

My answer would be a conditional No.

If you do not send Emails to Invalid addresses or people who do not want the emails, it is very unlikely that your emails will be considered SPAM.

1. Take this Email Server Test and implement the recommendations (Ignore Domain Keys as it will be difficult to implement on your envrionment).
2. Make sure you handle bounces properly and take the Email address off if email bounces.
3. Make sure you do not send Unsolicited emails through this server.

4. If your clients are knowledgeable, ask them to add a SPF record for your IP (in addition to their current records).

   You should be ok then.

   As far as reverse DNS goes, most email servers only check for a valid Reverse DNS and do not compare it against From addresses.

Answer 4

If your email server is set up correctly, there should be little if any penalty. I have only had to manualy whitelist incorrectly configured severs.

• DNS and RDNS should be correctly setup (mail.example.com > 192.0.2.10 > mail.example.com). If you can dedicate a server or IP this can be in the clients domain.
• As noted, the client should enable your server in SPF.
• Your server should greet with its DNS address (mail.example.com).
• From, Reply-to and Envelope from addresses should all resolve as recipients. At the very least they should use valid domains.

Sender addresses frequently are different from the sending domain. I relay a domain which does not have its own servers with no penalty. SPF is appropriately set up for the domain. Prior to setting up my own server, I relayed via my ISPs servers, again with no penalty.

Alternatively, you could arrange to relay via the clients server.