Przemysław Zalewski

Email sending compliance

Email developer: sending that meets Gmail and Yahoo rules

Gmail and Yahoo now require bulk senders to have one‑click unsubscribe, suppression, bounce and complaint handling, and aligned SPF, DKIM and DMARC. On a suppression-list platform I led to 300+ GB, one‑click unsubscribe shipped four months before they announced the rule. Check your domain below.

Book a free 30‑min call Email me instead

Want a number first? See hours, price and start date →

Calls this week · work starts 3 November 2026 · Wrocław, Poland (CET), remote

Przemysław Zalewski
300+ GBof production data on one platform I led
4app stores I ship to end to end: iOS, Android, macOS and Windows, plus the web
3 to 4engineers in teams I led
9years of TypeScript, React and Node.js

Sound familiar?

Email sending problems I fix in 2026

Outlook bouncing our emails with 550 5.7.515?

Since 5 May 2025 Microsoft rejects mail from domains that send over 5,000 messages a day to Outlook.com, Hotmail and Live unless SPF and DKIM pass and DMARC is in place. Rejected mail comes back as 550 5.7.515, and each bounce is an invoice, a password reset or a newsletter your customer never saw.

I list every service that sends as your domain, add DKIM to each one and align SPF and DMARC with the From address. I check the result with my free SPF, DKIM and DMARC checker before and after the change. In September 2026 an email app told people to check their password when Comcast and Microsoft were in fact rejecting a shared cloud IP on reputation (code 4.7.650). I traced it from a session replay, added an alert and made the case for clean sending IPs.

People unsubscribe and still get our emails

Gmail’s sender FAQ lists unsubscribe requests not honored within 48 hours as a requirement failure, and since November 2025 Gmail has been ramping up enforcement on non-compliant traffic. Every email after an unsubscribe invites a spam report against the domain your invoices and password resets come from.

I build one suppression list that your app, CRM and newsletter tool all check before every send, and one‑click unsubscribe writes to it at once. On a UK publisher’s suppression-list platform I led, one‑click unsubscribe shipped four months before Google and Yahoo announced the rule. In June 2025 the unsubscribe button on a client’s email platform silently did nothing; my fix was live within an hour of the report.

Sound like you? Book a free 30‑min call →

Microsoft 365 SMTP with a password stops working in December?

At the end of December 2026 Microsoft turns off Basic authentication for SMTP AUTH by default in all existing Exchange Online tenants and plans to announce the final removal date in the second half of 2027. Apps, scanners and scripts that send with a stored password stop sending unless an admin turns it back on.

I move your app to OAuth 2.0 for SMTP or to Microsoft Graph sendMail and test it before the switch‑off date. In 2026 I moved Patriot Mail’s Gmail, Outlook and Yahoo sign‑in to OAuth only, wrote its plain-language guide to Microsoft’s move away from passwords, and fixed a Microsoft sign‑in error the same evening a tester reported it.

Postmaster Tools says our domain needs work. What now?

Since 3 February 2026 the Postmaster Tools API returns Gmail’s compliance status for your domain, and since 24 June 2026 it also returns a deliverability status verdict. A failing requirement is on record the day Gmail flags it, whether or not anyone on your team looks.

I fix the failing requirement first, usually DMARC, one‑click unsubscribe or honoring unsubscribes. Then I connect the compliance status to the alerts your team already reads, so the next regression reaches you the day Gmail reports it. In September 2026 I caught local development environments sending real email from a production domain, rotated the key and made local mail write to files instead.

Facing one of these? Book a free 30‑min call →

Why me

Unsubscribe and suppression that hold at scale

One‑click unsubscribe, a suppression check before every send, bounces and spam complaints handled from day one. For a UK email publisher this ran with constant-time sign‑up and zero-downtime deploys.

SPF, DKIM and DMARC that pass

SPF within the DNS lookup limit, DKIM on every service that sends for you, DMARC moved from none to quarantine or reject with reports someone reads. BIMI only once DMARC enforces. I do not sell IP warm‑up or promises of inbox placement.

Templates that survive Outlook

React Email or MJML, tables where tables are still needed, dark mode, a plain‑text alternative, previews checked across clients before anyone hits send. The template lives in the repo and ships with the feature.

Clients that speak IMAP for real

IDLE, CONDSTORE, partial fetch, servers that lie about capabilities, OAuth for Gmail and Microsoft 365. Patriot Mail talks to real mailboxes on web, iOS and macOS and treats every incoming message as untrusted input, including for the AI that reads it.

Live demo

Check your domain’s email authentication

Type the domain you send from. The check reads MX, SPF, DKIM, DMARC and BIMI and shows which records fail.

Demo loading…

Try your company domain, then a competitor’s. A DMARC policy of “none” is the most common finding.

Full report: SPF, DKIM and DMARC checker · BIMI checker · test a real email

Proof

Work I can show

Problem, what I did, result. Client names only where I am allowed to use them.

Suppression-list platform: MVP to product, 300+ GB in production

The problem
A UK email publisher needed suppression lists built to grow to terabyte scale with constant-time sign‑up and zero-downtime deploys.
What I did
I led a small team from MVP to the full platform. Postgres partitioning by tenant and list, parallel request pipelines, blue/green deploys. One‑click unsubscribe shipped four months before Google and Yahoo announced the requirement.
Result
300+ GB and millions of events in production, zero-downtime deploys, an opt‑out path that kept working through a deliberate backend outage, and a compliance feature that landed before the deadline existed. In August 2026 I found orphaned table partitions left behind by deleted accounts and sales demos, stopped them piling up and recovered about 140 GB.

300+ GB outage-tested opt‑out blue/green

See also: TypeScript & Node.js · Full‑stack & custom software

Patriot Mail in production: four problems, each fixed within a day

The problem
Between June and September 2026 an email app in production hit four things users notice at once: Yahoo users signed out in a loop, a bare “Critical error” screen after deploys, error pages when the backend dropped a connection, and inbox ads about to launch with a label that did not say “ad”.
What I did
Yahoo sometimes signs logins with elliptic-curve keys the app did not accept: I added them, kept the list of allowed algorithms strict and put an alert on every failed sign‑in. Tabs left open across a deploy asked for deleted code files: one silent reload with a loop guard, a designed error screen and reports that survive the reload. Dropped backend connections: automatic retries for reads only, never for sends or moves. For the ads I proposed “Sponsored” in place of the old label, following the FTC guide on native advertising.
Result
The Yahoo fix was live about two hours after the report, and the deploy error and the ad label each shipped the same day, the label first to test accounts. A dropped connection now means a retry, never a duplicate email, and critical sign‑in bugs now pause feature work.

~2 h fix reads‑only retries FTC label

Patriot Mail: an AI email client through CASA Tier 2 and onto the App Store

The problem
A greenfield AI‑native email client for web, iOS and macOS, built at Sanddev, needed Google’s CASA Tier 2 security assessment before it could read Gmail, and it had to work for older people.
What I did
I was the principal engineer at Sanddev. I wrote the delivery plan, shaped the product vision and treated prompt injection through untrusted email as a design constraint before any model touched a mailbox. CASA and OWASP ASVS controls became a Playwright suite that runs on every pull request. WCAG 2.2 AA sits behind an automated axe gate.
Result
I led CASA Tier 2 to a pass in January 2026, with third-party pentest findings fixed, and led the yearly reassessment, validated in October 2026; the questionnaire turned into a check on every PR. Live on the App Store on iOS and macOS since April 2026. Text scaling to 200% and a calm‑email mode shipped for older users. At that reassessment five items came back for missing evidence; I fixed the code first, then resubmitted updated evidence, and all five were accepted on 27 October.

CASA Tier 2 iOS + macOS WCAG 2.2 AA Open ↗

See also: SaaS & MVP · Mobile & desktop apps

Offer: From an AI‑built MVP to a product people pay for

Facing something similar? Book a free call →

One foot in the door

Not ready for a project? Start with one week or one pull request.

Two ways to see how I work before you commit to a sprint. Fixed scope, the price range below, the final number in writing within 24 hours of the call.

One-week email code audit

I read the repo, CI, tests, deploys and the parts the team avoids, by hand. You get a written report with risks ranked by cost, what to fix first, a plan with milestones and a go or no‑go you can defend. The report is yours whether or not we continue.

$1,080⁠–⁠$2,160 excl. VAT · 30⁠–⁠40 h · See price and start date →

Code review of one pull request or one module

Send me the diff that worries you. Within a few days you get line‑level comments, the three things I would change first and whether I would merge it. I have reviewed 800+ pull requests on one product since 2018.

$72⁠–⁠$216 excl. VAT · 2⁠–⁠4 h · See price and start date →

Book a call to pick one Free 30‑minute call first. If neither fits, I say so on the call.

How it works

Three steps from this page to a running project.

  1. 1

    A 30-minute call

    You describe the product and the problem. I ask the questions I would ask on day one.

  2. 2

    Scope in writing

    Within 24 hours after the call you get a short written plan: what we build first, what we measure, how we work together and what it costs. No slide deck.

  3. 3

    Working software in week one

    Deployed, measured and open for your review. After that, the numbers set the pace.

Book a free call Email me instead

Fit check

Is this a fit?

A good fit when

  • You need a senior who owns delivery, not a pair of hands
  • The product has to ship and be measured, with or without a product manager
  • A solo engagement, or one team of up to four that I lead directly
  • TypeScript, React, Node.js, Cloudflare, Postgres, PostHog, and Python when the work needs it

Probably not when

  • A program that needs a ten‑person vendor team
  • A stack built around Java or a cloud I do not work in
  • Body leasing by the hour with no say in how the work is done

Working style

How I work

Zero bug policy

A bug is fixed or consciously closed, never parked. Alerts and error tracking in every project, so I learn about problems before the client does.

Review as a craft

800+ pull requests reviewed on one product since 2018. I review for the product and its reasons. The code comes second.

Measured, not assumed

PostHog in every project from day one. A tracking plan per feature, and dashboards leadership reads instead of asking me for numbers.

Good to know

Email rules that are easy to miss

Gmail’s bulk-sender label is permanent

A domain that sends 5,000 messages to Gmail in one day is a bulk sender for good, and subdomains count toward the parent domain (Google).

Two spam-rate numbers, not one

Gmail asks senders to stay below 0.10 percent spam rate and never reach 0.30 percent. Transactional mail does not need one‑click unsubscribe (Google, Google).

One-click unsubscribe must be DKIM-signed

Under RFC 8058, both List-Unsubscribe headers must be covered by the DKIM signature, and the endpoint must not answer with a redirect (RFC 8058).

SPF fails on two empty lookups

The 10‑lookup limit counts include, a, mx, ptr, exists and redirect. There is a separate limit of 2 lookups that return nothing, so one dead include can fail SPF (RFC 7208).

DMARC dropped pct

RFC 9989 (May 2026) replaced RFC 7489. pct is gone, t=y is the new test mode, and np covers subdomains that do not exist (RFC 9989).

Reports to another domain need its consent

When rua points at another domain, that domain must publish a TXT record such as yourdomain._report._dmarc.vendor.com, or receivers send nothing (RFC 9990).

FAQ

Questions people ask before they book

Our emails land in spam. Can you fix it?
I fix the part you control. Start with the free Email Test: send one campaign email and get one‑click unsubscribe, SPF, DKIM, DMARC and an AI spam review in one report. I fix authentication, unsubscribe and suppression first, list quality and content after. I do not sell warm‑up or promise inbox placement: reputation takes weeks to rebuild and some lists are beyond saving.
Can you make one signature for the whole company?
Yes. For a team that pastes it, use the free Signature Desk. For signatures set centrally on every mailbox in Google Workspace or Microsoft 365, that is a project I do.
Can I check my list before sending?
Yes, free: List Desk checks syntax, dead domains, null MX, disposable providers, typos and duplicates in your browser.
Can you build an email client?
Yes. I was the principal engineer of Patriot Mail at Sanddev, an AI‑native client for web, iOS and macOS that passed Google’s CASA Tier 2 assessment in January 2026 and again in October 2026, both led by me: IMAP sync, OAuth, prompt injection through untrusted email treated as a design constraint, WCAG 2.2 AA behind an automated gate. Mobile delivery is covered on the mobile and desktop page.
Transactional email for our SaaS?
Templates in React Email or MJML, one provider adapter so you can switch senders, every send logged as an event in PostHog, bounces and complaints handled from day one. The rest of the product side is on the SaaS page.
Is BIMI worth it?
Only after DMARC is at quarantine or reject, which is the real work. The verified mark certificate costs money every year. I will tell you when the logo in Gmail is not worth that bill.
Can an AI read our mail safely?
An LLM that reads mail reads attacker-controlled text. Patriot Mail was designed around that: tools with narrow scopes, no action on email content without a human, evaluation data from real mailboxes. More on the AI and agents page.
Who owns the setup, and who gets access?
You do. DNS records, templates and the suppression list stay on your accounts and in your repository. I work through access you grant and can revoke, alone, with no subcontractors. Liability cover depends on the engagement: for high‑risk sending, extra cover for that contract can be arranged before work starts, with its cost reflected in the rate. Details in the trust center.
What does it cost?
I bill by the hour: base rate 45 USD, 36 to 54 USD by difficulty, excl. VAT, with no minimum, so you can stop at any time. Not sure yet? Start with the one‑week code audit: a fixed price range, with the final number in writing within 24 hours of the call. Details on pricing. The configurator shows hours and a price range for your case before the call.
How soon can you start?
From 3 November 2026. Book the call and bring the domain that worries you.
Why doesn’t Gmail show the unsubscribe button on our emails?
Both List-Unsubscribe headers must be DKIM‑signed and the URL must accept the POST without a redirect (RFC 8058). Gmail requires it for marketing mail only (Google).
Why am I not getting DMARC reports?
If rua points at another domain, that domain must authorize it with a TXT record (RFC 9990). Gmail IMAP also has daily limits of 2,500 MB down and 500 MB up, which matters if you read reports from a mailbox (Google).
How long will our templates have to work in classic Outlook?
Microsoft supports classic Outlook until at least 2029 and promises 12 months’ notice before forcing the new one (Microsoft). Apple Mail also loads images on arrival, so open rates from it are inflated (Apple).
Outlook bouncing our emails with 550 5.7.515?
Since 5 May 2025 Microsoft rejects mail from domains that send over 5,000 messages a day to Outlook.com, Hotmail and Live unless SPF and DKIM pass and DMARC is in place. Rejected mail comes back as 550 5.7.515, and each bounce is an invoice, a password reset or a newsletter your customer never saw. I list every service that sends as your domain, add DKIM to each one and align SPF and DMARC with the From address. I check the result with my free SPF, DKIM and DMARC checker before and after the change. In September 2026 an email app told people to check their password when Comcast and Microsoft were in fact rejecting a shared cloud IP on reputation (code 4.7.650). I traced it from a session replay, added an alert and made the case for clean sending IPs.

Bonus · #suchar

A dad joke, on the house

Free, like the first call. Same sense of humor, included in every project.

What do you call an email template that renders the same in Outlook?Punchline

A miracle. Ba‑dum‑tss.

Why was the email so confident?Punchline

It passed SPF, DKIM and DMARC on the first try. Ba‑dum‑tss.

Why did the email go to therapy?Punchline

Too much baggage in the attachments. Ba‑dum‑tss.

In 30 minutes you will know if we are a fit

You bring the problem, I bring the questions. Want a number first? The configurator shows hours, a price range and the start date.

Book a free 30‑min call Email me instead

or write to ciunkos@gmail.com

After you book you get a calendar invite. Nothing else to fill in.

My pledge

  • Reply within 24 hours. I reply within 24 hours on working days, personally, not a bot. Weekend messages: by Monday noon.
  • Late means free. If I am late, the first hour of work is free. You do not have to ask.
  • Scope in writing within 24 hours. A free 30‑minute call with no company deck, then the scope and the price in writing within 24 hours. You decide.
  • The person who does the work. You talk to the person who does the work. No sales layer, no handoff.
  • Follow‑up only with news. I follow up only when I have something new for you. Never a “did you see my offer”.
  • Honest “not a fit”. If I am not the right person, I say so on the call and point you to someone who is.

Calls this week · work starts 3 November 2026 · B2B contract · Wrocław, Poland (CET), remote

You own the code, domain and accounts from day one. Nothing is held hostage.

More

Related services

The same engineer, a different angle.

SaaS & MVPFrom first commit to paying users: billing, tenants, stores.Live demo TypeScript & Node.jsTyped APIs, Postgres at scale, tests that encode security.Live demo AI & agentsAgents in production: tools, MCP, evals, cost caps.Live demo See all services16 pages, one engineerBrowse all

Specific offers on this stack