TL;DR: Viva.com, one of Europe's largest payment processors, sends verification emails without a Message-ID header — a recommendation of RFC 5322 since 2008. Google Workspace rejects them outright. Their support team's response to my detailed bug report: "your account has a verified email, so there's no problem."
A few days ago, I tried to create an account on viva.com, one of Europe's largest payment processors. It should have taken five minutes. Instead, it turned into a small investigation — and left me with some bigger questions about the state of European fintech infrastructure.
The verification email that never arrived
The signup flow is standard: enter your email, receive a verification link, click it, move on with your life. Except the verification email never showed up. Not in my inbox, not in spam, not anywhere. I waited. I retried. I waited some more.
My email is hosted on Google Workspace — a corporate email on a custom domain. Not exactly an exotic setup. After a couple of days of retrying, I decided to dig into Google Workspace's Email Log Search to see what was happening on the receiving end.
Here's what I found:
Status: Bounced.
The bounce reason:
550 5.7 .1 [ 209.85 .220 .69 ] Messages missing a valid Message - ID header are not 550 - 5.7 .1 accepted . For more information , go to 550 - 5.7 .1 https : / / support . google . com / mail / ? p = RfcMessageNonCompliant and review 550 5.7 .1 RFC 5322 specifications .
Viva.com's outgoing verification emails lack a Message-ID header, a requirement that has been part of the Internet Message Format specification (RFC 5322) since 2008, and was already suggested by its predecessor RFC 2822 back in 2001.
... continue reading