CX Works

CX Works brings the most relevant leading practices to you.
It is a single portal of curated, field-tested and SAP-verified expertise for SAP Customer Experience solutions

E-mail Marketing - Trust with the Right ESP Setup

18 min read

Become a trusted e-mail sender with the right ESP setup

E-mail marketing is a very effective marketing tactic. When sending out marketing messages as part of a campaign, it is the goal of every marketer that as many e-mails as possible make it to the recipient's inbox. For the e-mail process, marketing automation engines, like SAP Marketing Cloud, are integrating with e-mail service providers (ESP) for the actual sending of e-mails. This article describes how you should configure your ESP to maximize your e-mail deliverability.

Table of Contents


Despite all the great new channels, tactics, and technology, e-mail marketing remains one of the main campaign tactics used in most countries around the globe. However, it is often an underestimated channel leading to inefficient usage.

In the article Welcome to E-mail Marketing, we have already introduced you to the basics of e-mail marketing. Now, it is time to dive deeper into the topic of building trust with the right ESP setup. 

Trust is a key factor when it comes down to communication. Regardless of the channel, you tend to give attention to those who you consider reliable. The same happens with e-mail campaigns. You are joining a limited and controlled territory so you must be sufficiently reliable to not only be allowed to enter this territory, but also to grab attention from people. Being a trusted sender requires you to comply with industry standards around message authentication and domain setup.

The Right Setup for Your E-mail Service Provider

Marketing automation engines (such as SAP Marketing Cloud) are leveraging e-mail service providers (ESPs) to send out marketing messages. The setup and technical configuration that is required when integrating with an ESP has a big impact on being a trusted sender. Following the industry best practices and setting up a proper message authentication can be seen as the groundwork. Even with the best content/engagement strategy and a high-quality contact list, your messages will not make it to the recipient's inbox if the technical setup is done incorrectly. In other words, the first checks that the internet service providers (ISP - inbox providers such as Gmail, Yahoo, and others) are performing when assessing the trustworthiness of your message to determine the sender. This check occurs if industry standards for message authentication have been applied.

In the following sections, we will have a detailed look at the relevant aspects you need to consider for being a trusted sender.

Sender Identification

Before inbox providers can determine the trustworthiness and relevance of a marketing message and ultimately decide on the placement of that e-mail, they need to identify the message sender. For the identification, the IP address and domain name are taken into account:

Aspect Description Example
IP Address
  • The IP address of the message sender
  • An IP address (Internet Protocol address) is a unique identifier for devices that are communicating with each other through the Internet Protocol. The IP address is visible in every e-mail message header and used by the ISPs to identify the e-mail sender.
  • The domain name of the message sender
  • The domain name is an identification string for a network domain. The idea is to provide a recognizable name to the numerically addressed internet resources (IP addresses). Every domain has at least one Domain Name System (DNS) server that publishes information about the domain and the name servers of any sub domain. The sender's domain of an e-mail can either be determined by looking at the sender's address or by analyzing the e-mail message header. As for the IP address, the domain name is used by the ISPs to identify the e-mail sender.
    (for sender address:
    (for sender address

There's not much you can do regarding the IP. It will be assigned to you by the ESP, but the domain needs some special care as described in the next section.

IP and Domain Reputation

As we have learned in the previous section, ISPs are using the IP and domain information for identifying a message sender. For assessing the trustworthiness of a sender, ISPs are looking at the reputation of the sender. When talking about reputation, we need to be aware that there are two different types of reputation,  IP reputation, and domain reputation. Let's have a look at the differences between them and why it is important to manage and monitor both of them.

  • IP Reputation
    The IP reputation states how the inbox providers are perceiving the IP that is sending the messages. It is important to keep in mind that when leveraging ESPs, the messages are technically sent through their servers. This means, the sending IP address belongs to the ESP.

  • Domain Reputation
    The domain reputation states how the inbox providers are perceiving the domain/subdomain that is sending the messages. In contrast to the IP's reputation, the domain belongs to the sender of the message.

Looking at how inbox providers are assessing your reputation, the IP address used to be one of the determining factors. However, we have noticed that besides the IP address, the sender domain is getting more and more important. As an IP address can be used by more than one sender (see details in the dedicated section below), and spammers can easily rotate IP addresses, more and more ISPs such as Gmail are using the domain reputation in addition to the IP reputation.

Shared versus Dedicated IP Address

Depending on the ESP you choose, you have the option to choose between a shared or dedicated IP address. This is referring to the aspect, that is, if the sending IP address is exclusively used by your organization or shared with other customers from the ESP.

Shared IP Address Dedicated IP Address
Characteristics E-mail senders are grouped together and share a pool of IPs. There is a dedicated IP address for your exclusive use.
  • The reputation of the IP pool is dependent on the e-mail sending practices of the entire group of e-mail marketers working at different companies.
  • If a company is assigned to a group that includes marketers with good e-mail practices, they will benefit with an overall better sending reputation thus their e-mails are likely to successfully make it to the inbox. A bad sending behavior will only partly affect the reputation, as ISPs will block those senders to not risk a blocklisting of the shared IP.
  • The reputation of the dedicated IP address is only dependent on your own sending practices.
  • There is no risk that your reputation is damaged by a bad sending behavior of other ESP users.
  • It is not possible to benefit from other marketer's good e-mail practices.
  • The reputation monitoring is done by the e-mail service provider.
  • You do not have to worry about maintaining a proper sending volume as the ESP is pooling the e-mails of multiple senders.
  • It is purely your responsibility to monitor and actively manage your own e-mail reputation.
  • Ongoing efforts for maintaining your reputation is higher than with a share IP (for example, ESPs are taking care of preventing and removing blocklisted entries).
Cost It highly depends on the ESP's pricing model, but in general, dedicated IP addresses are more expensive.
When to Use?
  • Your sending pattern is irregular and/or your target groups are small.
  • You are early in your e-mail marketing journey and/or don't have skilled resources ready for actively managing your reputation.
  • You have a regular sending pattern.
  • You are regularly addressing large target groups.
  • You have e-mail marketing experienced resources ready for actively managing the reputation.
  • You are confident in the quality of your contact list.

As you can see from the comparison, dedicated IP addresses are a very good option for experienced marketing organizations that want to have the full control over their marketing messages. For smaller companies or companies who are just starting with e-mail marketing, we recommend to start with a shared IP. When making the decision, you should be honest with yourself about your own e-mail practices and ensure you understand the business implications of your decision. It is very common to start with a shared IP (and custom domain) and then move to a dedicated IP. This is usually the best approach when you are just starting with e-mail marketing and have a small contact list to begin with. 

Message Type Classification and Domain Strategy

Now that you have been introduced to the basics of IP and domain reputation, it is time to learn how to come up with your own domain strategy. At first, you need to decide on the domain that you want to use for sending e-mails. By default, the ESP does not provide a custom domain. We highly recommend that you work with a custom domain as it will make it easier for recipients to notice the connection to your brand. As there is no one-size-fits-all approach, we recommend to choose a domain where your recipients will recognize you as a source they would expect to receive an e-mail from. Ideally, you can use an already existing domain that your customer are already familiar with. 

As you learned in the introduction article, we differentiate between different message types such as transaction or marketing messages. This is a very important aspect to consider when defining your domain strategy. If the characteristics and types of your messages are really diverse, it might make sense to define multiple sub domains per use case or message type. As the reputation is connected to a domain/IP combination, a campaign causing a lot of hard bounces will damage the reputation for the used domain and will have an impact on all future mailings through this domain. Image one is showing you the two possible options. Using sub domains per message type (right example), can help to mitigate the negative consequences of situations like these, by ensuring that if something does go wrong, your other domains are not affected. 

image one: domain strategy approaches depending on message types

We are often asked if there is a relation between the reputation of a sub domain and the corresponding main domain. Unfortunately, there's not really an answer to that since the ISPs keep their spam detection algorithms a secret. However, we have noticed that sub domains can be a good choice when your messages differ from each other while still having a connection to the main brand.

There is one other aspect to consider for a larger organization which is thinking about using their corporate domain for their marketing e-mails: Make sure to align with your IT security department to see if your DNS server can be configured accordingly or if any infrastructure security policies prevent a configuration for bulk messaging. Also, be aware that in case you have heavy e-mail traffic using the same domain, this will impact your reputation. It might become very difficult to analyze deliverability issues, if you do not have the full transparency about the messages that are sent through this domain. Therefore, our recommendation is to go with one or many separate sub domain(s) for your marketing purposes.

Message Authentication

Message authentication is absolutely essential for professional e-mail transmission. By authenticating your messages with industry-standard techniques, inbox providers are able to determine the authenticity of the sender's identity. In the end, message authentication is about proving that an e-mail is from the sender it states it is from. To establish this message authentication, the following three standards need to be configured for your sending domain:

Authentication Standard Description How to Set it Up

DomainKeys Identified Mail (DKIM)

By using DKIM, the e-mail sender claims responsibility for his e-mail. It is a cryptographic method to verify that the e-mail originated from the domain that sent it. Every time an e-mail campaign is sent, a private key is included in the e-mail message header. When inbox providers are receiving the message, they can verify the public and private headers. This information is used to verify not only the sender, but also that the e-mail message was not changed during the sending process.

To enable DKIM, you need to generate a domain key for your sending domain and add the public key as an additional entry to your DNS configuration.

For more information, please refer to your ESP as they can provide you with documentation on how to enable DKIM in his environment.

Sender Policy Framework (SPF)

The sender policy framework allows inbox providers to verify that an incoming e-mail from a specific domain has, in fact, been sent from that domain. It is verifying the envelope of the e-mail and checking if the server that is sending the e-mail is allowed to send e-mails on behalf of the sender.

To enable SPF, you need to add a TXT record to your DNS server configuration.

For a detailed documentation on how to create a SPF TXT record, please refer to the following page: How to create an SPF TXT record.

Domain-Based Message Authentication, Reporting and Conformance (DMARC)

DMARC is an e-mail validation protocol that helps to detect and prevent e-mail spoofing (the creation of e-mail messages with a forged sender address). It is designed to combat phishing and spam. Following DMARC will help to ensure your e-mails make it to the inbox.

For more information on DMARC, please visit the DMARC website.

To comply with the DMARC standard, you must do the following:

  1. Enable DKIM and SPF for your domain.
  2. Add a DMARC record on your DNS server configuration.

For more information, please refer to the official DMARC configuration overview.

Please note: For setting up the message authentication and infrastructure, you need to have access to the DNS server configuration. Typically, this is owned by the IT network team. We recommend that you involve colleagues from the the network team so that they can support you in performing the actual changes on the DNS side.

Verification, Testing and Monitoring

Before finishing your configuration activities, you should make sure to thoroughly verify your setup. Testing or validating your e-mail deliverability can become quite tricky. The ISPs deciding on the placement of an e-mail into the inbox are keeping their placement algorithms secret. That means, it can be very hard to find a causal context of a deliverability issue. However, we recommend to perform the following checks:

  • Verify if your message authentication and DNS setup works properly.
  • Make use of spam checker tools to simulate an inbox placement.
  • Prepare yourself for tracking and analyzing your warm-up. A warm-up is referred to as a process for introducing a new IP/domain combination and make it known to ISPs. For more details, please refer to the dedicated section below.

In addition to one time checks before the first send out, you also need to monitor your reputation on a continuous basis. Most ESPs will not provide you with all the functionality for planning, testing, sending, and analyzing of your e-mails. Therefore, we highly recommend you to leverage additional tools. We had some good experiences with the following tools and recommend them to you to use as part of your e-mail marketing toolkit

E-mail Testing Suite: Litmus

image two: spam test in Litmus showing you a missing DMARC record

Litmus is an e-mail testing suite that allows you to run spam tests and verify your message authentication. After sending a test e-mail to a dedicated Litmus address, it will tell you in a structured format, if your domain and message authentication configuration was done correctly and the likelihood that your messages will make it to the recipient's inbox. In the above example (image two), you can see that our test setup did not contain a proper DMARC entry, that we did not set up a List-Unsubscribe, and therefore messages to Gmail and GMX inboxes will probably end up in the spam folder.

Besides the spam checker functionality, Litmus also allows you to test and verify your content. More details can be found in our related article: E-mail Marketing - The Content.

Reputation Analyzer: Google Postmaster

image three: use Google Postmaster tool to receive actual insights on your deliverability to Gmail recipients

With Google Postmaster, you get access to actual e-mail deliverability KPIs (key performance indicators) for messages that where sent to Gmail addresses through your domain. For setting up Google Postmaster, you need to verify your domain at Postmaster and add a TXT entry generated from Postmaster to your DNS server configuration. Once you have done this and sent a significant number of messages, actual delivery KPIs will be shown in a dashboard. 

The example in image three is a real-life example and shows you how we managed to turn a very bad domain reputation into a good one by executing a solid warm-up plan. Without access to Google Postmaster, it would have been very hard to verify whether or not we were on track with our warm-up plan.

Using the tools will make your life a lot easier as they will provide you with deliverability insights that go way beyond the common e-mail KPIs (for example: open rates, delivered e-mails, bounces).

Domain and IP Warm-Up

Once your ESP is set up and before starting to productively send out marketing messages, it is crucial to warm-up your IP and domain combination. A warm-up process means to gradually increase the sending volume with your IP/Domain combination according to a predetermined schedule. By going through this process, you make yourself known to the ISPs and establish a reputation as a legitimate sender.

Suddenly starting to send out a high volume of messages from a IP/domain combination that was not used before, will damage your whole e-mail reputation. ISPs will classify your messages as spam and it will take you a lot of work and time to turn this bad reputation into a positive one again. 

For more information on how to build a warm-up plan including an example, please refer to the following article:


In this article, you learned what it takes to be a trusted sender with the right ESP setup. We introduced you to the factors that have an impact on your e-mail deliverability and described best practices around message authentication and domain strategy. 

Please make sure to deep dive into all aspects of becoming an e-mail deliverability hero:

You might also want to go one step back to learn about the essentials of e-mail marketing. Another related article explains how to integrate with Amazon SES as ESP. In case you need further support, please refer to our dedicated 'E-mail Deliverability Guidance' service. You will find more details in the fact sheet that is linked in the services section of this article.