Confirmations, password resets and notifications are called transactional email. Missing them breaks the product, so deliverability deserves attention.
Authentication
- SPF lists which servers may send mail for your domain.
- DKIM signs messages so receivers can verify they were not altered and come from you.
- DMARC tells receivers what to do with mail that fails those checks and gives you reports.
Large mailbox providers publish sender requirements and enforce them; check the current guidelines for the providers your users use.
How to send
- Use a reputable sending service or your hosting’s mail server correctly configured. Do not send from a random address.
- Use a consistent sender name and address on your own domain.
- Send only what the person expects, and keep marketing separate from transactional mail.
Reliability
- Send in the background so a slow mail server does not block the user.
- Retry on temporary failure and record permanent failures.
- Do not let one failure break the main action; decide what the user sees.
- Test with the large mailbox providers and look at the actual inbox, not only at the send log.
- Do not allow a form to send mail to arbitrary addresses, or spammers will use it.
Treat email as a feature with its own testing, not an afterthought.