What are email feedback loops and how do you set them up?

When someone clicks "Report spam" or "Junk" on your message, their mailbox provider counts it against you. A feedback loop is how you find out. Set them up and process them properly, and you remove unhappy recipients before their complaints damage your delivery. Ignore them, and the provider eventually stops accepting your mail.

This guide explains how feedback loops work, what each major provider offers at the time of writing (October 2026), and how to build the process that acts on them. For the complaint rate thresholds themselves, see spam complaint rate explained.

What is a complaint feedback loop?

RFC 6449, which records industry practice and was adapted from a MAAWG document, describes a complaint feedback loop as a way to "provide Feedback Consumers with information necessary to mitigate Spam." A recipient complains. The mailbox provider (the feedback provider) automatically forwards a report to the sender or network that sent the message (the feedback consumer).

Feedback loops are separate from DMARC reports. DMARC aggregate reports tell you who sent mail using your domain and whether it authenticated. Feedback loops tell you who complained about mail you sent.

What does a feedback report look like?

Most per-complaint loops use the Abuse Reporting Format (ARF), defined in RFC 5965. A report is a MIME multipart/report message with report-type=feedback-report and three parts:

1. A human-readable description. RFC 5965 says it "MUST be included."
2. A machine-readable part of type message/feedback-report.
3. The original message, as message/rfc822, or only its headers as text/rfc822-headers.

The machine-readable part has three required fields: Feedback-Type, User-Agent and Version (currently 1). Optional fields include Original-Mail-From, Original-Rcpt-To, Arrival-Date, Source-IP, Reported-Domain and Authentication-Results.

Feedback-Type tells you what kind of report it is. RFC 5965 registered abuse, fraud, other and virus, and later RFCs added auth-failure (RFC 6591) and not-spam (RFC 6430) to the IANA registry. A spam complaint is abuse.

A trimmed example of the second part:

Feedback-Type: abuse
User-Agent: ExampleFBL/1.0
Version: 1
Original-Mail-From: <bounces+12345@mail.example.com>
Arrival-Date: Thu, 8 Oct 2026 14:02:11 +0000
Source-IP: 192.0.2.25
Reported-Domain: example.com

Why the recipient address may be missing

RFC 6449 warns that some providers remove private data, such as the recipient's address, before forwarding a report. You need your own way to identify who complained. Its advice is to embed an identifier in a part of the message providers are unlikely to strip: the Message-ID, the envelope sender (return path) or the unsubscribe link. Then map it back to the recipient through a database key or encryption.

Which providers offer feedback loops?

Yahoo Complaint Feedback Loop

Yahoo's CFL "only supports DKIM-signed email and is a domain based service." Reports go out when mail signed with an enrolled DKIM domain (the d= value) is marked as spam. Yahoo's FAQ adds:

• "Yahoo no longer offers IP or CIDR-based CFL reporting."
• Reports are ARF and "include the full email headers and some additional machine readable meta-data."
• You'll get reports for AOL too: "we will send ARF reports for any of the thousands of domains we host and support."
• The reporting address can be any address you control. It doesn't need to match your DKIM domain, but you verify it with a code.
• Reports come from feedback@arf.mail.yahoo.com and are DKIM-signed by arf.mail.yahoo.com.

To enroll, create a Sender Hub profile, add and verify your domain, then enroll it under Manage Services > Complaint Feedback Loop. Enrollments from Yahoo's old form stopped working after August 1, 2024, so re-enroll if you signed up years ago.

Microsoft JMRP

Microsoft's Junk Mail Reporting Program "returns the full message with headers of any email marked as 'junk' or 'phishing'" by Outlook.com users. You enroll through Smart Network Data Services, and feedback typically starts "within as little as 72 hours" (Outlook.com Postmaster). JMRP is tied to sending IPs, so you need IPs you can prove you own. Our Outlook.com deliverability guide covers SNDS and JMRP setup step by step.

Gmail Feedback Loop

Gmail's Feedback Loop is for "large volume" senders and covers only @gmail.com recipients. You add a header:

Feedback-ID: CampaignID:CustomerID:MailType:SenderId

The first three fields are optional identifiers you choose. SenderId is required, 5 to 15 characters, and "should be consistent across the mail stream." Google's rules:

• The mail must be DKIM-signed, after the header is added, by a domain you own and have verified in Google Postmaster Tools.
• Use only one such header per message.
• Your sending IPs must be in the signing domain's SPF record and have valid PTR records.
• Don't use a value that's unique to every message, such as the Message-ID.
• Reports appear only when an identifier reaches a certain volume and enough distinct spam reports on a day.

The result is a spam rate per identifier in the Postmaster Tools Feedback Loop dashboard. It tells you which campaign, customer or mail type is drawing complaints, not who complained.

The CFBL-Address header

RFC 9477 (September 2023) defines a CFBL-Address header that lets a sender name its feedback address inside the message, so it doesn't have to register with every provider. For example, CFBL-Address: fbl@example.com; report=arf. The header must be covered by a valid DKIM signature that matches the rules in the RFC, or the provider "SHALL NOT send a report message." It's an Experimental RFC. Adding it does no harm, but don't rely on it in place of the enrollments above.

How do you set up feedback loops?

1. Sign with DKIM using your own domain. Yahoo and Gmail key their loops on the DKIM domain. If a platform signs with its own domain, complaints go to it, not you. Check your selector with the DKIM Checker.
2. Create a dedicated reporting address, such as fbl@ on a subdomain. RFC 6449 suggests a unique address per feedback loop, so you can tell which provider sent each report.
3. Enroll at Yahoo Sender Hub for every DKIM domain you sign with.
4. Enroll in JMRP through SNDS if you send from your own IPs.
5. Add a Feedback-ID header and verify your DKIM domain in Postmaster Tools if you send bulk mail to Gmail.
6. Embed a recipient identifier in the return path, Message-ID or unsubscribe link, so redacted reports still map to a person.
7. Automate processing: parse the ARF, find the recipient, suppress them.
8. Watch the volume. Track complaints per campaign and per source, and alert on spikes.

What should you do with each complaint?

RFC 6449 is direct: senders "should treat the Feedback Message similar to an unsubscribe request" and assume the recipient doesn't want more email.

• Suppress immediately for that list, brand or customer. RFC 6449 says suppressing across a whole email service provider "is likely too broad", but suppressing across all of one sender's segmented lists "is probably a good idea."
• Never email the complainer to ask why or to confirm.
• Look for patterns. One campaign or one signup source with high complaints usually means a consent problem, not bad luck.
• Make leaving easier. Many complaints come from people who couldn't find the unsubscribe link. Add one-click unsubscribe.
• Keep watching. RFC 6449 warns that if a feedback consumer ignores its feedback stream, the provider "may block or otherwise filter" its mail, treating the reports as sufficient notice.

Common mistakes

• Enrolling the wrong domain. Yahoo matches the DKIM d= domain, not the From address. If your platform signs as mail.example.com, enroll that domain.
• Signing up with a personal address. RFC 6449 says administrative messages about a feedback loop should go to a role account, not an individual, because they "may be lost if that person is on vacation, changes position within the company, or leaves the company."
• Parsing only the recipient field. Providers may redact it. Fall back to the identifier you embedded.
• Forgetting new IPs or domains. Every new sending IP needs adding to JMRP, and every new DKIM domain to the CFL.

What if you don't send bulk mail?

Everyday staff mail sent through Microsoft 365 or Google Workspace leaves from the provider's shared IPs, so JMRP isn't available to you for it. Yahoo's CFL works on your DKIM domain instead, so enrolling it costs little. Enroll in everything above if you run your own mail server or send newsletters from your own domain. A sudden stream of complaints about mail you didn't send can mean a compromised account or someone spoofing your domain. Check your SPF, DKIM and DMARC with the DMARC Checker.

Next steps

• List every platform that sends mail as your domain and check each one signs with your DKIM domain.
• Enroll your DKIM domains in Yahoo's CFL, your own IPs in JMRP, and add Feedback-ID for bulk mail to Gmail.
• Route all reports to one parser that suppresses complainers automatically.
• Track your rate against the published limits in spam complaint rate explained, and test new campaigns with the Deliverability Test.
• For the wider picture, work through the email deliverability checklist.

Browse more guides on running email day to day.