---
title: "Email checklist: all 67 rules · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/checklist
updated: 2026-10-20
licence: "All rights reserved"
---

# Email checklist

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

Every rule in the email playbook, by chapter, required rules first. Each links to its own page with how we built it and how to check it.

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/checklist`.

## Message basics

- [ ] **Required** [Send the headers every message needs](https://agentwranglers.se/playbook/email/message-basics/required-headers): Give every message exactly one `From`, `To`, `Subject`, `Date` and `Message-ID`, in the format RFC 5322 sets out.
- [ ] **Required** [Include a plain-text part](https://agentwranglers.se/playbook/email/message-basics/plain-text-part): Send HTML email as `multipart/alternative`, with a plain-text part first and the HTML part last.
- [ ] **Required** [Encode everything as UTF-8](https://agentwranglers.se/playbook/email/message-basics/utf-8): Declare `charset=UTF-8` on every text part, and encode non-ASCII characters in headers as RFC 2047 encoded words.
- [ ] **Required** [Declare the language and text direction](https://agentwranglers.se/playbook/email/message-basics/language-and-direction): State the message language in a `Content-Language` header. In HTML mail, also set it on the root, and set `dir` for right-to-left languages.
- [ ] **Required** [Keep messages small](https://agentwranglers.se/playbook/email/message-basics/message-size): Keep the HTML part under 100 KB and the whole message under 5 MB. Link to large files instead of attaching them.
- [ ] **Recommended** [Point replies to a mailbox someone reads](https://agentwranglers.se/playbook/email/message-basics/reply-to): Send from an address that accepts replies, or set `Reply-To` to one that does. Never send from an address that bounces.
- [ ] **Recommended** [Accept international addresses](https://agentwranglers.se/playbook/email/message-basics/international-addresses): Accept and store email addresses with non-ASCII characters, and send to them through servers that support SMTPUTF8.
- [ ] **Recommended** [Mark automated messages](https://agentwranglers.se/playbook/email/message-basics/auto-submitted): Add `Auto-Submitted: auto-generated` to messages a system sends on its own, such as receipts, alerts and password resets.

## Sending domain and authentication

- [ ] **Required** [Publish an SPF record](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/spf): Publish one SPF record for every domain that sends mail, listing every server and service that sends for it.
- [ ] **Required** [Sign every message with DKIM](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dkim): Sign every message with DKIM, using a 2048-bit RSA key on your own domain, and replace each key at least every six months.
- [ ] **Required** [Enforce DMARC](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dmarc): Publish a DMARC record, read its reports, and move from `p=none` to `p=quarantine` and then `p=reject` once all mail passes.
- [ ] **Required** [Lock down domains that never send mail](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/no-mail-domains): Give every domain and subdomain that sends no mail a null MX, an SPF record of `v=spf1 -all` and a DMARC record with `p=reject`.
- [ ] **Required** [Give sending servers matching DNS names](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/reverse-dns): Give every sending IP address a reverse DNS name that points back to the same address, and use that name in the SMTP greeting.
- [ ] **Required** [Send and receive over TLS](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-tls): Offer STARTTLS with a valid certificate on every MX host, and send outgoing mail over TLS.
- [ ] **Optional** [Pin mail TLS with DANE](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/smtp-dane): If your domain is signed with DNSSEC, publish TLSA records for your MX hosts, so sending servers check the certificate through DNS.
- [ ] **Optional** [Keep authentication through forwarders with ARC](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/arc): If you run a mailing list or forwarding service, add ARC seals, so receivers can trust results that the forwarding broke.
- [ ] **Optional** [Show your logo with BIMI](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/bimi): Once DMARC is enforced, publish a BIMI record, so supporting inboxes show your verified logo next to your mail.

## Deliverability

- [ ] **Required** [Meet the bulk sender rules](https://agentwranglers.se/playbook/email/deliverability/bulk-sender-rules): Meet the sender rules of Gmail, Yahoo and Microsoft before you send more than 5,000 messages a day to any of them.
- [ ] **Required** [Warm up new domains and addresses](https://agentwranglers.se/playbook/email/deliverability/warm-up): Raise the volume from a new domain or IP address slowly, over several weeks, starting with your most engaged recipients.
- [ ] **Required** [Send only to people who asked](https://agentwranglers.se/playbook/email/deliverability/confirmed-opt-in): Add an address to a marketing list only after its owner confirms by clicking a link. Never buy, rent or scrape lists.
- [ ] **Required** [Keep the list clean](https://agentwranglers.se/playbook/email/deliverability/list-hygiene): Remove addresses that hard bounce at once, and stop mailing people who have not clicked or bought for six months.
- [ ] **Recommended** [Separate transactional and marketing mail](https://agentwranglers.se/playbook/email/deliverability/separate-streams): Send transactional mail and marketing mail from different subdomains, and from different IP addresses when you control them.
- [ ] **Recommended** [Watch your sender reputation](https://agentwranglers.se/playbook/email/deliverability/watch-reputation): Track your spam complaint rate and sender status with the providers' own tools, and act when they change.
- [ ] **Recommended** [Use a steady sender identity](https://agentwranglers.se/playbook/email/deliverability/steady-identity): Send from the same From name and address on the same domain every time, and use a reply address people can actually reach.
- [ ] **Recommended** [Write mail that does not look like spam](https://agentwranglers.se/playbook/email/deliverability/honest-content): Make the subject and the links match what the message is about. Never use misleading subjects or fake replies.

## Unsubscribe and bounces

- [ ] **Required** [Offer one-click unsubscribe](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/one-click-unsubscribe): Add `List-Unsubscribe` and `List-Unsubscribe-Post` headers to every marketing or list message, so mail apps can unsubscribe in one click.
- [ ] **Required** [Unsubscribe within two days](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/honour-unsubscribes): Stop sending to anyone who unsubscribes within two days, and never ask them to log in or confirm by email.
- [ ] **Required** [Show an unsubscribe link in the message](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/visible-unsubscribe): Put a clear unsubscribe link in the body of every marketing message, not only in the headers.
- [ ] **Required** [Keep transactional mail free of marketing](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/transactional-only): Keep receipts, password resets and security alerts free of advertising, so they stay transactional and reach people who unsubscribed from marketing.
- [ ] **Required** [Stop on permanent failures and retry temporary ones](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/handle-bounces): Read every bounce and SMTP reply. Suppress an address after a permanent failure for a bad mailbox, and retry only temporary failures.
- [ ] **Required** [Retry with backoff and give up in time](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/retry-and-expire): Retry temporary failures with growing gaps, and give up after a set time, then tell the sender.
- [ ] **Required** [Stop at the first complaint](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/suppress-complaints): Suppress an address at once when its owner marks your mail as spam.
- [ ] **Required** [Accept mail at postmaster and abuse](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/postmaster-abuse): Accept mail for `postmaster@` and `abuse@` on every domain you send from, and route it to a person who reads it.
- [ ] **Recommended** [Label list mail](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/list-id): Give each mailing list a `List-Id` header, so people and mail apps can filter and manage it.
- [ ] **Optional** [Let people choose what they get](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/preference-centre): Offer a page where people can pick the kinds of mail they want, as well as leaving entirely.

## Layout and accessibility

- [ ] **Required** [Mark up the message with meaning](https://agentwranglers.se/playbook/email/layout-and-accessibility/semantic-structure): Use headings, paragraphs and lists, and mark every layout table with `role="presentation"`, so screen readers announce content and not table cells.
- [ ] **Required** [Describe every image](https://agentwranglers.se/playbook/email/layout-and-accessibility/image-alt-text): Give every meaningful image an `alt` that says what it shows or does, and give decorative images an empty `alt=""`.
- [ ] **Required** [Use contrast and more than colour](https://agentwranglers.se/playbook/email/layout-and-accessibility/email-contrast): Meet the contrast in [colour contrast](https://agentwranglers.se/playbook/website/accessibility/color-contrast) and never show meaning by colour alone, as [not colour alone](https://agentwranglers.se/playbook/website/accessibility/not-color-alone) says.
- [ ] **Required** [Make email text easy to read](https://agentwranglers.se/playbook/email/layout-and-accessibility/readable-text): Set body text to at least 16 pixels, with a line height of at least 1.4 and a content column no wider than 600 pixels.
- [ ] **Required** [Send text instead of pictures of text](https://agentwranglers.se/playbook/email/layout-and-accessibility/live-text): Put every important word in live text. Never send a message that is one large image.
- [ ] **Required** [Fit every screen](https://agentwranglers.se/playbook/email/layout-and-accessibility/responsive-email): Make the message work on a phone first, with fluid widths and media queries only as an extra.
- [ ] **Required** [Make buttons easy to tap](https://agentwranglers.se/playbook/email/layout-and-accessibility/email-buttons): Build each call to action as a link styled as a button, at least 44 by 44 pixels, with clear words.
- [ ] **Required** [Test in the clients your readers use](https://agentwranglers.se/playbook/email/layout-and-accessibility/client-testing): Send every new template to the main email clients before it goes to people, and check it in light and dark mode.
- [ ] **Recommended** [Build layout that Outlook can show](https://agentwranglers.se/playbook/email/layout-and-accessibility/layout-tables): Build the outer layout with tables and fixed widths where classic Outlook on Windows needs them, and use modern CSS only as an extra.
- [ ] **Recommended** [Inline the CSS and plan for it to fail](https://agentwranglers.se/playbook/email/layout-and-accessibility/inline-css): Put the CSS that matters inline on each element, and make sure the message still reads if a client strips the rest.
- [ ] **Recommended** [Plan for dark mode](https://agentwranglers.se/playbook/email/layout-and-accessibility/email-dark-mode): Design for clients that switch to dark mode, so text stays readable and logos stay visible.
- [ ] **Recommended** [Write a preheader](https://agentwranglers.se/playbook/email/layout-and-accessibility/preheader): Set the short text that inboxes show after the subject, so it adds to the subject instead of repeating it.

## Email privacy

- [ ] **Required** [Keep personal data out of links](https://agentwranglers.se/playbook/email/email-privacy/private-links): Never put email addresses, names or other personal data in link addresses or tracking parameters. Use a random reference instead.
- [ ] **Required** [Send only what the message needs](https://agentwranglers.se/playbook/email/email-privacy/email-data-minimisation): Put only the data each message needs into it, and keep sensitive data out of subject lines and previews.
- [ ] **Required** [Keep proof of consent](https://agentwranglers.se/playbook/email/email-privacy/consent-records): Send marketing email only to people who agreed to it, and keep a record of when, where and to what they agreed.
- [ ] **Required** [Keep email logs lean](https://agentwranglers.se/playbook/email/email-privacy/lean-email-logs): Log what you need to run and debug email, without full message bodies, and delete it on a set schedule.
- [ ] **Required** [Never email customers from test systems](https://agentwranglers.se/playbook/email/email-privacy/test-mail-capture): Outside production, send all mail to a capture server or to an allow list of test domains. Never deliver it to customer addresses.
- [ ] **Recommended** [Don't rely on tracking pixels](https://agentwranglers.se/playbook/email/email-privacy/tracking-pixels): Avoid tracking pixels, and never make a decision on open data alone. Where you do track opens, say so and get consent where the law asks for it.

## Email security

- [ ] **Required** [Never let visitors pick who gets your mail](https://agentwranglers.se/playbook/email/email-security/fixed-recipients): Forms that send email must never let a visitor choose the recipient or write the message others receive. Limit how much mail any one address can trigger.
- [ ] **Required** [Send only links people can trust](https://agentwranglers.se/playbook/email/email-security/safe-links): Use HTTPS links on your own domain, and make the visible text match where each link goes. Never use public link shorteners.
- [ ] **Required** [Make your mail hard to fake](https://agentwranglers.se/playbook/email/email-security/phishing-resistance): Never ask for a password, code or payment detail by email. Send from the same domains and addresses every time, so fakes stand out.
- [ ] **Required** [Make sign-in and reset links single-use and short-lived](https://agentwranglers.se/playbook/email/email-security/sign-in-links): A link that signs someone in or resets a password works once, expires within an hour, and holds a long random token. A sign-in code expires within 15 minutes.
- [ ] **Required** [Keep secrets out of email](https://agentwranglers.se/playbook/email/email-security/no-secrets-in-email): Never send passwords, full card numbers, ID numbers or API keys by email. Email is stored in many places and is hard to delete.
- [ ] **Recommended** [Avoid risky attachments](https://agentwranglers.se/playbook/email/email-security/safe-attachments): Send only document types that are safe to open, such as PDF and images. Link to a signed-in download for anything private or large.
- [ ] **Optional** [Sign or encrypt sensitive mail](https://agentwranglers.se/playbook/email/email-security/signed-encrypted-mail): For mail that must stay private or be provably yours, sign or encrypt it with S/MIME or OpenPGP.
- [ ] **Avoid** [Send no scripts or forms in email](https://agentwranglers.se/playbook/email/email-security/active-content): Do not put scripts, forms, embedded frames or plugins in email. Mail apps strip or block them, and they look like attacks.

## Automation and agents

- [ ] **Required** [Send each message once](https://agentwranglers.se/playbook/email/automation-and-agents/send-once): Give every automated message a deduplication key, and send through a queue that skips a key it has already sent.
- [ ] **Required** [Put the facts of a receipt in text](https://agentwranglers.se/playbook/email/automation-and-agents/readable-receipts): Every receipt and confirmation states its key facts as plain text. That covers who, what, when, how much and the reference number.
- [ ] **Required** [Treat incoming email as untrusted](https://agentwranglers.se/playbook/email/automation-and-agents/untrusted-incoming-mail): When an AI agent reads incoming email, treat every message as data that may hold hostile instructions.
- [ ] **Recommended** [Send calendar invites that update correctly](https://agentwranglers.se/playbook/email/automation-and-agents/calendar-invites): Send invites as iCalendar with a stable event id, and send changes and cancellations for the same id. Calendars then update the event instead of adding a new one.
- [ ] **Recommended** [Write mail that assistants can read safely](https://agentwranglers.se/playbook/email/automation-and-agents/assistant-readable): Make every email clear to AI assistants that read it for people. State facts plainly, and hide no text.
- [ ] **Optional** [Add structured data to orders and bookings](https://agentwranglers.se/playbook/email/automation-and-agents/email-markup): Describe orders, reservations and deliveries with schema.org data in the email, so mail apps can show them as cards.