# What are email feedback loops and how do you set them up?

URL: https://iblockspam.com/blog/email-feedback-loops-fbl
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Running email day to day
Author: iBlockSpam Team

> How complaint feedback loops work: ARF reports (RFC 5965), Yahoo CFL, Microsoft JMRP and Gmail's Feedback-ID loop, how to enroll and how to act on complaints.

## Short answer

A feedback loop (FBL) sends you a report when a recipient marks your message as spam. Yahoo's Complaint Feedback Loop and Microsoft's JMRP send one report per complaint, Yahoo's in Abuse Reporting Format (RFC 5965). Gmail's loop only gives aggregate spam rates per Feedback-ID header. Enroll, then suppress every complainer automatically.

When someone clicks "Report spam" or "Junk" on your message, their mailbox provider counts it against you. A feedback loop is how you find out. Set them up and process them properly, and you remove unhappy recipients before their complaints damage your delivery. Ignore them, and the provider eventually stops accepting your mail.

This guide explains how feedback loops work, what each major provider offers at the time of writing (October 2026), and how to build the process that acts on them. For the complaint rate thresholds themselves, see [spam complaint rate explained](https://iblockspam.com/blog/spam-complaint-rate-explained).

## What is a complaint feedback loop?

[RFC 6449](https://www.rfc-editor.org/rfc/rfc6449.html), which records industry practice and was adapted from a MAAWG document, describes a complaint feedback loop as a way to "provide Feedback Consumers with information necessary to mitigate Spam." A recipient complains. The mailbox provider (the feedback provider) automatically forwards a report to the sender or network that sent the message (the feedback consumer).

Feedback loops are separate from DMARC reports. [DMARC aggregate reports](https://iblockspam.com/blog/how-to-read-dmarc-reports) tell you who sent mail using your domain and whether it authenticated. Feedback loops tell you who complained about mail you sent.

## What does a feedback report look like?

Most per-complaint loops use the Abuse Reporting Format (ARF), defined in [RFC 5965](https://www.rfc-editor.org/rfc/rfc5965.html). A report is a MIME `multipart/report` message with `report-type=feedback-report` and three parts:

1. **A human-readable description.** RFC 5965 says it "MUST be included."
2. **A machine-readable part** of type `message/feedback-report`.
3. **The original message**, as `message/rfc822`, or only its headers as `text/rfc822-headers`.

The machine-readable part has three required fields: `Feedback-Type`, `User-Agent` and `Version` (currently `1`). Optional fields include `Original-Mail-From`, `Original-Rcpt-To`, `Arrival-Date`, `Source-IP`, `Reported-Domain` and `Authentication-Results`.

`Feedback-Type` tells you what kind of report it is. RFC 5965 registered `abuse`, `fraud`, `other` and `virus`, and later RFCs added `auth-failure` (RFC 6591) and `not-spam` (RFC 6430) to the [IANA registry](https://www.iana.org/assignments/marf-parameters/). A spam complaint is `abuse`.

A trimmed example of the second part:

```
Feedback-Type: abuse
User-Agent: ExampleFBL/1.0
Version: 1
Original-Mail-From: <bounces+12345@mail.example.com>
Arrival-Date: Thu, 8 Oct 2026 14:02:11 +0000
Source-IP: 192.0.2.25
Reported-Domain: example.com
```

### Why the recipient address may be missing

RFC 6449 warns that some providers remove private data, such as the recipient's address, before forwarding a report. You need your own way to identify who complained. Its advice is to embed an identifier in a part of the message providers are unlikely to strip: the Message-ID, the envelope sender (return path) or the unsubscribe link. Then map it back to the recipient through a database key or encryption.

## Which providers offer feedback loops?

| Provider | Program | Per-complaint reports? | Keyed on | Where to enroll |
|---|---|---|---|---|
| Yahoo (also AOL) | Complaint Feedback Loop (CFL) | Yes, ARF | DKIM `d=` domain | Yahoo Sender Hub |
| Outlook.com, Hotmail | Junk Mail Reporting Program (JMRP) | Yes, full message with headers | Sending IP | Inside SNDS |
| Gmail | Feedback Loop | No, aggregate spam rates | `Feedback-ID` header plus DKIM domain | Google Postmaster Tools |

### Yahoo Complaint Feedback Loop

Yahoo's [CFL](https://senders.yahooinc.com/complaint-feedback-loop/) "only supports DKIM-signed email and is a domain based service." Reports go out when mail signed with an enrolled DKIM domain (the `d=` value) is marked as spam. Yahoo's [FAQ](https://senders.yahooinc.com/faqs/) adds:

- "Yahoo no longer offers IP or CIDR-based CFL reporting."
- Reports are ARF and "include the full email headers and some additional machine readable meta-data."
- You'll get reports for AOL too: "we will send ARF reports for any of the thousands of domains we host and support."
- The reporting address can be any address you control. It doesn't need to match your DKIM domain, but you verify it with a code.
- Reports come from `feedback@arf.mail.yahoo.com` and are DKIM-signed by `arf.mail.yahoo.com`.

To enroll, create a Sender Hub profile, add and verify your domain, then enroll it under **Manage Services** > **Complaint Feedback Loop**. Enrollments from Yahoo's old form stopped working after August 1, 2024, so re-enroll if you signed up years ago.

### Microsoft JMRP

Microsoft's Junk Mail Reporting Program "returns the full message with headers of any email marked as 'junk' or 'phishing'" by Outlook.com users. You enroll through Smart Network Data Services, and feedback typically starts "within as little as 72 hours" ([Outlook.com Postmaster](https://substrate.office.com/ip-domain-management-snds/Postmaster/Services)). JMRP is tied to sending IPs, so you need IPs you can prove you own. Our [Outlook.com deliverability guide](https://iblockspam.com/blog/outlook-com-deliverability-snds-jmrp) covers SNDS and JMRP setup step by step.

### Gmail Feedback Loop

Gmail's [Feedback Loop](https://support.google.com/mail/answer/6254652) is for "large volume" senders and covers only `@gmail.com` recipients. You add a header:

```
Feedback-ID: CampaignID:CustomerID:MailType:SenderId
```

The first three fields are optional identifiers you choose. `SenderId` is required, 5 to 15 characters, and "should be consistent across the mail stream." Google's rules:

- The mail must be DKIM-signed, after the header is added, by a domain you own and have verified in [Google Postmaster Tools](https://iblockspam.com/blog/google-postmaster-tools-guide).
- Use only one such header per message.
- Your sending IPs must be in the signing domain's SPF record and have valid PTR records.
- Don't use a value that's unique to every message, such as the Message-ID.
- Reports appear only when an identifier reaches a certain volume and enough distinct spam reports on a day.

The result is a spam rate per identifier in the Postmaster Tools Feedback Loop dashboard. It tells you which campaign, customer or mail type is drawing complaints, not who complained.

### The CFBL-Address header

[RFC 9477](https://www.rfc-editor.org/rfc/rfc9477.html) (September 2023) defines a `CFBL-Address` header that lets a sender name its feedback address inside the message, so it doesn't have to register with every provider. For example, `CFBL-Address: fbl@example.com; report=arf`. The header must be covered by a valid DKIM signature that matches the rules in the RFC, or the provider "SHALL NOT send a report message." It's an Experimental RFC. Adding it does no harm, but don't rely on it in place of the enrollments above.

## How do you set up feedback loops?

1. **Sign with DKIM using your own domain.** Yahoo and Gmail key their loops on the DKIM domain. If a platform signs with its own domain, complaints go to it, not you. Check your selector with the [DKIM Checker](https://iblockspam.com/tools/dkim-checker).
2. **Create a dedicated reporting address**, such as `fbl@` on a subdomain. RFC 6449 suggests a unique address per feedback loop, so you can tell which provider sent each report.
3. **Enroll at Yahoo Sender Hub** for every DKIM domain you sign with.
4. **Enroll in JMRP through SNDS** if you send from your own IPs.
5. **Add a `Feedback-ID` header** and verify your DKIM domain in Postmaster Tools if you send bulk mail to Gmail.
6. **Embed a recipient identifier** in the return path, Message-ID or unsubscribe link, so redacted reports still map to a person.
7. **Automate processing**: parse the ARF, find the recipient, suppress them.
8. **Watch the volume.** Track complaints per campaign and per source, and alert on spikes.

## What should you do with each complaint?

RFC 6449 is direct: senders "should treat the Feedback Message similar to an unsubscribe request" and assume the recipient doesn't want more email.

- **Suppress immediately** for that list, brand or customer. RFC 6449 says suppressing across a whole email service provider "is likely too broad", but suppressing across all of one sender's segmented lists "is probably a good idea."
- **Never email the complainer** to ask why or to confirm.
- **Look for patterns.** One campaign or one signup source with high complaints usually means a consent problem, not bad luck.
- **Make leaving easier.** Many complaints come from people who couldn't find the unsubscribe link. Add [one-click unsubscribe](https://iblockspam.com/blog/one-click-unsubscribe-rfc-8058).
- **Keep watching.** RFC 6449 warns that if a feedback consumer ignores its feedback stream, the provider "may block or otherwise filter" its mail, treating the reports as sufficient notice.

### Common mistakes

- **Enrolling the wrong domain.** Yahoo matches the DKIM `d=` domain, not the From address. If your platform signs as `mail.example.com`, enroll that domain.
- **Signing up with a personal address.** RFC 6449 says administrative messages about a feedback loop should go to a role account, not an individual, because they "may be lost if that person is on vacation, changes position within the company, or leaves the company."
- **Parsing only the recipient field.** Providers may redact it. Fall back to the identifier you embedded.
- **Forgetting new IPs or domains.** Every new sending IP needs adding to JMRP, and every new DKIM domain to the CFL.

### What if you don't send bulk mail?

Everyday staff mail sent through Microsoft 365 or Google Workspace leaves from the provider's shared IPs, so JMRP isn't available to you for it. Yahoo's CFL works on your DKIM domain instead, so enrolling it costs little. Enroll in everything above if you run your own mail server or send newsletters from your own domain. A sudden stream of complaints about mail you didn't send can mean a compromised account or [someone spoofing your domain](https://iblockspam.com/blog/someone-sending-email-from-my-address). Check your SPF, DKIM and DMARC with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker).

## Next steps

- List every platform that sends mail as your domain and check each one signs with your DKIM domain.
- Enroll your DKIM domains in Yahoo's CFL, your own IPs in JMRP, and add `Feedback-ID` for bulk mail to Gmail.
- Route all reports to one parser that suppresses complainers automatically.
- Track your rate against the published limits in [spam complaint rate explained](https://iblockspam.com/blog/spam-complaint-rate-explained), and test new campaigns with the [Deliverability Test](https://iblockspam.com/tools/deliverability-test).
- For the wider picture, work through the [email deliverability checklist](https://iblockspam.com/blog/email-deliverability-checklist).

Browse more guides on [running email day to day](https://iblockspam.com/blog/topic/operations).

## Frequently asked questions

### What is an email feedback loop?

A feedback loop is a service run by a mailbox provider that tells a sender when recipients mark its mail as spam. RFC 6449 describes it as forwarding a recipient's complaint to the party associated with the message, without human review, so the sender can stop mailing people who don't want its mail.

### What is ARF?

ARF, the Abuse Reporting Format, is the standard format for feedback reports, defined in RFC 5965. Each report is a multipart/report message with three parts: a human-readable description, a machine-readable section with fields such as Feedback-Type, and a copy of the original message or its headers.

### Does Gmail send a report for each spam complaint?

No. Gmail's Feedback Loop is aggregate. You add a Feedback-ID header to DKIM-signed mail, and Postmaster Tools shows spam rates for identifiers that have unusual complaint levels. It never tells you which recipient complained, so pair it with one-click unsubscribe and engagement-based list cleaning.

### Do I need feedback loops if I use an email service provider?

Usually your provider enrolls and processes them for you, because it controls the sending IPs and often the DKIM domain. Yahoo's FAQ says ESPs generally enroll domains on their customers' behalf. Ask your provider which loops it processes and whether complainers are suppressed across all your lists.

### Should a complaint be treated as an unsubscribe?

Yes. RFC 6449 says senders should treat a feedback message similar to an unsubscribe request and assume the recipient doesn't want more email. Suppress the address for that list or brand right away. Don't email the complainer to ask why, and don't add them back later.

## Sources

- [RFC 5965: An Extensible Format for Email Feedback Reports](https://www.rfc-editor.org/rfc/rfc5965.html)
- [RFC 6449: Complaint Feedback Loop Operational Recommendations](https://www.rfc-editor.org/rfc/rfc6449.html)
- [RFC 9477: Complaint Feedback Loop Address Header](https://www.rfc-editor.org/rfc/rfc9477.html)
- [Yahoo Sender Hub: Complaint Feedback Loop](https://senders.yahooinc.com/complaint-feedback-loop/)
- [Yahoo Sender Hub: FAQs](https://senders.yahooinc.com/faqs/)
- [Gmail Help: Feedback Loop](https://support.google.com/mail/answer/6254652)
- [Outlook.com Postmaster: Services for Senders and ISPs](https://substrate.office.com/ip-domain-management-snds/Postmaster/Services)

## Free tools for this guide

- [DKIM Checker](https://iblockspam.com/tools/dkim-checker): Validate DKIM keys by selector, including key type and strength.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [Email Deliverability Test](https://iblockspam.com/tools/deliverability-test): Send one email and see its SPF, DKIM and DMARC results, reverse DNS, blocklists, TLS and spam verdict.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-feedback-loops-fbl (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt