What should you do if your emails use a domain in the Message-ID that you do not own and is on a blocklist?
Summary
What email marketers say10Marketer opinions
Email marketer from Mailjet Blog answers that domain authentication (SPF, DKIM, DMARC) becomes impossible if you're using a domain you don't own. Suggests switching to a domain you control and properly authenticating it to improve deliverability.
Marketer from Email Geeks suggests fixing the domain issue first and then reaching out to any blocking parties to explain what happened.
Email marketer from Stackoverflow responds that the main action to take is to immediately stop using the unowned domain and switch to one you control, then configure SPF and DKIM correctly. Monitoring your sending reputation is also key.
Email marketer from Reddit shares that using a domain you don't own can lead to deliverability issues. ISP's flag the practice and you could be added to blocklists. Immediate fix is to switch to your own domain and ensure its authenticated properly.
Email marketer from GMass shares that if a domain is blacklisted, clean up your email lists of old unengaged contacts to stop sending mail that will be blocked anyway to help your domain reputation.
Email marketer from EmailOctopus Blog shares that sender reputation is critical and using a domain you don't own negatively impacts it. Recommends aligning your 'From' address, sending domain, and Message-ID domain for best results.
Marketer from Email Geeks advises the client to stop using the problematic domain immediately, pause sending, and review list hygiene. Suggests using a subdomain of their own domain for sending in the future and to avoid anything related to Spamhaus.
Email marketer from Litmus explains that using a domain you don't control hurts your domain reputation and prevents proper authentication. Immediate steps are switching domains and implementing SPF, DKIM, and DMARC.
Email marketer from Email Marketing Forum shares that this sounds like a deliverability nightmare and you need to immediately stop using the blacklisted domain. It will only cause more issues long term and there are no legitimate reasons to continue this practice.
Email marketer from Customer.io explains the best practice is to immediately stop using the domain that you don't own, regardless of whether or not it's on a blocklist yet. Best action is to make the change and start building sender reputation on the correct domain.
What the experts say3Expert opinions
Expert from Email Geeks explains that using a domain that doesn’t belong to them in the messageID is EXTREMELY bad practice and they should stop. Also states that if you use a domain that you don’t own, you can’t be sure you’re complying with the RFCs and that parked domains can trivially be blocked. Recommends the real fix is to stop using a domain that doesn’t belong to them and to enjoy being blocked at Microsoft if they continue.
Expert from Spam Resource answers: stop using a domain you don't own. Not only does it give you no control over your reputation, but it also makes it nearly impossible to authenticate your emails correctly. Switch to a domain you own and properly set up SPF, DKIM, and DMARC.
Expert from Word to the Wise shares that using a domain you don't own, especially if it's on a blocklist, is severely detrimental to your email program. You'll need to prioritize moving to a domain you own and control in order to fix this issue.
What the documentation says5Technical articles
Documentation from Microsoft provides a warning that improper email practices, including using domains you do not own, are viewed negatively and are a factor in calculating sender reputation and filtering decisions.
Documentation from DMARC.org highlights that for DMARC to function correctly, the domain in the 'From' address must align with the domain used for SPF or DKIM authentication. Using a domain you don't own prevents this alignment.
Documentation from IETF explains the standards for email and best practices. They don't discuss what to do in this specific situation but make it clear that it is important to be compliant with sender guidelines.
Documentation from Spamhaus explains that being listed on the DBL (Domain Block List) means that the domain has been identified as being associated with spam or other malicious activity. Recommends identifying the cause of the listing and taking corrective actions before requesting delisting - which you can't do if you don't own the domain.
Documentation from RFC Editor explains that the Message-ID field should contain a globally unique identifier for a message. While not explicitly forbidding it, using a domain you don't control puts you at risk of not maintaining uniqueness and complying with the RFC.