Google Workspace users are experiencing issues receiving authentication emails from major payment service provider Viva.com due to missing Message-ID
Major European Payment Processor Can't Send Email to Google Workspace Users | The Ian Atha Museum of Internet Curiosities
https://atha.io/blog/2026-02-12-viva
In a blog post dated February 12, 2026, Ian Atha reported that after following the Viva.com sign-up instructions and entering his email address, he never received a verification email. The email was not in the spam folder, and when he checked the email delivery log search feature for Google Workspace administrators, 'Email Log Search,' it was treated as a 'bounce' returned to the sender.
The bounce reason given was 'Emails without a valid Message-ID header will not be accepted,' indicating that Google Workspace was refusing the email in order to comply with RFC 5322 , a standard that defines the basic format of emails, including how email headers such as From and Subject should be written.
On the other hand, RFC 5322 states that 'all messages SHOULD have a Message-ID field,' but does not require it to be included. However, 'SHOULD' is a strong recommendation that 'there may be reasons to remove it, but the decision should be made carefully after understanding the impact.'
Atha said that as a workaround, he received the verification email if it was sent to a personal address with '@gmail.com.' In other words, even though it's the same Gmail system, there are cases where emails sent to Google Workspace's own domain are rejected, but emails sent to personal Gmail addresses are accepted.
Atha contacted Viva.com support and reported the missing Message-ID, explaining the reason for the bounce, but was told that the email was now authenticated and there was no problem.
Viva.com claims on its website that it 'provides payment and banking services for European businesses,' and its developer documentation clearly states that it provides services in 24 European countries. However, the fact that the sign-up process for such businesses does not include Google Workspace, a standard corporate email environment, has attracted attention.
This issue has also been discussed on Hacker News , with various opinions being exchanged, including questions such as, 'The RFC strongly recommends, not mandates, Message-ID. Is it really fair to say that a SHOULD statement is a requirement?', comments such as, 'SHOULD statements should be followed unless there is a good reason not to. Message-IDs are sometimes added by the sending server, so they are designated as SHOULD, but it is normal to add one if you are going to send something,' and a post based on experience working in standards documents saying, 'SHOULD statements are recommendations, not requirements. In practice, they are sometimes ignored for convenience.'
Related Posts:
in Web Service, Security, Posted by log1b_ok