Use this skill when optimizing email deliverability, sender reputation, or authentication. Triggers on SPF record setup, DKIM signing configuration, DMARC policy deployment, IP warm-up planning, bounce handling strategy, sender reputation monitoring, inbox placement troubleshooting, email infrastructure hardening, DNS TXT record configuration for email, and diagnosing why emails land in spam. Acts as a senior email infrastructure advisor for engineers and marketers managing transactional or marketing email.
Use this skill when optimizing email deliverability, sender reputation, or authentication. Triggers on SPF record setup, DKIM signing configuration, DMARC policy deployment, IP warm-up planning, bounce handling strategy, sender reputation monitoring, inbox placement troubleshooting, email infrastructure hardening, DNS TXT record configuration for email, and diagnosing why emails land in spam. Acts as a senior email infrastructure advisor for engineers and marketers managing transactional or marketing email.
When this skill is activated, always start your first response with the 🧢 emoji.
Email Deliverability
The discipline of ensuring emails reach the recipient's inbox rather than the
spam folder or void. Email deliverability sits at the intersection of DNS
configuration, cryptographic authentication, sender behavior, and mailbox
provider algorithms. This skill covers the full stack - from DNS records (SPF,
DKIM, DMARC) through IP warm-up strategy, bounce management, and long-term
reputation maintenance. Designed for engineers setting up email infrastructure
and marketers diagnosing delivery problems.
When to use this skill
Trigger this skill when the user:
Sets up SPF, DKIM, or DMARC records for a domain
Plans an IP warm-up schedule for a new sending IP or domain
Diagnoses why emails are landing in spam or being rejected
Configures DNS TXT records for email authentication
Evaluates an ESP (Email Service Provider) or sending infrastructure
Troubleshoots email delivery failures, deferrals, or blocklisting
Do NOT trigger this skill for:
Email content/copywriting or subject line optimization (use a marketing skill)
Building email templates with HTML/CSS (use a frontend skill)
Key principles
Authenticate everything, no exceptions - Every sending domain must have
SPF, DKIM, and DMARC configured. Missing any one of these is enough for
major mailbox providers (Gmail, Outlook) to treat your mail as suspicious.
Authentication is table stakes, not a nice-to-have.
Reputation is earned slowly and lost instantly - Sender reputation is
built over weeks of consistent, low-complaint sending. A single spam trap
hit or complaint spike can tank your reputation overnight. Treat every send
decision as a reputation decision.
Bounces are signals, not noise - Every bounce carries information about
your list health, infrastructure, or content. Hard bounces must be removed
immediately. Soft bounces must be tracked and acted on. Ignoring bounces
is the fastest path to blocklisting.
Warm up before you scale up - New IPs and domains have zero reputation.
Mailbox providers throttle unknown senders aggressively. A proper warm-up
plan ramps volume gradually over 2-6 weeks, proving you are a legitimate
sender before asking for high throughput.
Monitor continuously, not reactively - By the time users report "emails
aren't arriving," the damage is done. Monitor bounce rates, complaint rates,
and inbox placement proactively. Set alerts on thresholds, not symptoms.
Core concepts
Email deliverability is governed by three layers: authentication (proving
you are who you claim to be), reputation (proving you send mail people
want), and behavior (proving your sending patterns are consistent and
trustworthy).
Authentication uses three DNS-based protocols that work together. SPF
declares which IPs may send on behalf of your domain. DKIM attaches a
cryptographic signature to each message that receivers verify against a public
key in your DNS. DMARC ties SPF and DKIM together with a policy that tells
receivers what to do when authentication fails - and sends you reports about it.
Reputation is a score maintained by each mailbox provider independently.
It is influenced by complaint rates (users clicking "spam"), bounce rates,
spam trap hits, engagement signals (opens, clicks, replies), and sending
volume consistency. There is no single universal reputation score - Gmail,
Outlook, and Yahoo each maintain their own.
Behavior covers sending patterns: volume consistency, warm-up adherence,
list hygiene practices, and how you handle bounces and unsubscribes. Sudden
volume spikes, sending to stale lists, or ignoring unsubscribe requests all
signal spammer behavior to mailbox providers.
Common tasks
Configure SPF
SPF (Sender Policy Framework) declares which mail servers may send email for
your domain via a DNS TXT record.
example.com. IN TXT "v=spf1 include:_spf.google.com include:sendgrid.net ip4:203.0.113.5 -all"
Rules:
Only one SPF record per domain (multiple records cause permerror)
Use include: for ESPs, ip4:/ip6: for your own servers
End with -all (hard fail) for production, ~all (soft fail) only during testing
Stay under 10 DNS lookups total (each include: and a: costs one lookup)
Use SPF flattening tools if you hit the 10-lookup limit
The 10-lookup limit is the most common SPF misconfiguration. Each include:
triggers recursive lookups. Monitor with dig TXT example.com and count.
Configure DKIM
DKIM (DomainKeys Identified Mail) signs outgoing messages with a private key.
Receivers verify the signature against a public key published in DNS.
selector1._domainkey.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBA..."
Setup checklist:
Generate a 2048-bit RSA key pair (1024-bit is deprecated)
Publish the public key as a TXT record at <selector>._domainkey.<domain>
Configure your mail server or ESP to sign outgoing mail with the private key
Use a unique selector per ESP so you can rotate keys independently
Test with dig TXT selector._domainkey.example.com to verify publication
Rotate keys annually - publish new key, wait 48h for propagation, then switch
If your TXT record exceeds 255 characters, split it into multiple strings
within a single TXT record. Most DNS providers handle this automatically.
Deploy DMARC
DMARC tells receivers what to do when SPF and DKIM fail, and sends you reports.
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; ruf=mailto:dmarc-forensic@example.com; adkim=s; aspf=s; pct=100"
Deployment phases:
Start with p=none - monitor only, collect reports for 2-4 weeks
Move to p=quarantine; pct=10 - quarantine 10% of failures, increase gradually
Graduate to p=reject - full enforcement, only after all legitimate mail passes
Complaint rate > 0.1%: investigate content and list source
Soft bounce rate > 5%: check infrastructure and recipient domains
Process feedback loops (FBLs) from major providers. Gmail uses Postmaster
Tools. Yahoo/AOL use the standard ARF format.
Monitor sender reputation
Key metrics and thresholds:
Metric
Healthy
Warning
Critical
Bounce rate
< 1%
1-2%
> 2%
Complaint rate
< 0.05%
0.05-0.1%
> 0.1%
Spam trap hits
0
1-2/month
> 2/month
Inbox placement
> 95%
85-95%
< 85%
Monitoring tools: Google Postmaster Tools (domain reputation for Gmail),
Microsoft SNDS (IP reputation for Outlook), Sender Score by Validity
(third-party IP score 0-100), MXToolbox (blocklist and DNS health checks).
Diagnose spam folder placement
When emails land in spam, investigate in this order:
Check engagement - low open rates signal recipients don't want your mail
Check infrastructure - verify PTR record, confirm TLS for SMTP
Anti-patterns / common mistakes
Mistake
Why it's wrong
What to do instead
No DMARC record
Domain open to spoofing, providers distrust unauthenticated mail
Deploy DMARC in monitor mode, graduate to reject
Multiple SPF records
RFC violation causes permerror, all SPF checks fail
Merge into single TXT record with multiple includes
Skipping warm-up
Sudden volume from unknown IP triggers throttling and blocks
Follow 2-6 week graduated warm-up plan
Ignoring hard bounces
Repeated sends to dead addresses signal spammer behavior
Remove hard bounces on first occurrence
Buying email lists
Purchased lists contain spam traps and uninterested recipients
Build organic lists with double opt-in
Shared IP without vetting
Other senders on shared IP can ruin your deliverability
Use dedicated IPs for volume > 50K/month
No unsubscribe link
Violates CAN-SPAM/GDPR, forces users to report spam instead
Include one-click unsubscribe (RFC 8058) and visible link
Sending from no-reply address
Discourages replies which are a positive engagement signal
Use a monitored reply-to address
Gotchas
SPF over 10 DNS lookups silently fails - and many senders don't know they've hit the limit - Each include:, a:, and mx: mechanism in an SPF record triggers recursive DNS lookups counted toward the 10-lookup limit. Many companies hit this limit after adding a third or fourth ESP. The result is a permerror that causes SPF to fail for all mail, silently. Use an SPF flattening tool and monitor lookup counts.
Jumping straight to p=reject DMARC breaks legitimate mail you forgot about - CRMs, invoicing tools, support platforms, marketing automation, and third-party senders often send on behalf of your domain without proper DKIM signing. Deploy p=none first, monitor aggregate reports for at least 2-4 weeks, and only graduate to p=reject after all legitimate sources are authenticated.
Sending to a re-engagement segment before warming up a new IP causes blocklisting - Dormant subscribers are more likely to mark mail as spam. During IP warm-up, send only to your most engaged subscribers (opened in the last 30 days). Bringing stale addresses into a new IP's warm-up period can tank the IP reputation before it's established.
DKIM keys in DNS must not exceed 255 characters per string without splitting - A 2048-bit RSA public key in base64 exceeds 255 characters. DNS TXT records must split values into multiple quoted strings within the record. Some DNS providers handle this automatically; others require manual splitting. Test with dig TXT selector._domainkey.yourdomain.com and verify the key assembles correctly.
Feedback loop (FBL) complaint data requires separate registration per provider - Gmail uses Google Postmaster Tools, Yahoo/AOL uses their FBL program, and Outlook uses Microsoft SNDS. These are separate registrations with separate dashboards. Many senders set up SPF/DKIM/DMARC and assume they'll receive complaint data automatically - they won't.
References
For detailed implementation guidance on specific sub-domains, read the relevant
file from the references/ folder:
references/spf-dkim-dmarc.md - complete DNS record syntax, alignment modes,
troubleshooting authentication failures, BIMI setup
references/bounce-handling.md - bounce code reference, FBL setup per provider,
suppression list management, list hygiene automation
Only load a references file if the current task requires it - they are long and
will consume context.
Companion check
On first activation of this skill in a conversation: check which companion skills are installed by running ls ~/.claude/skills/ ~/.agent/skills/ ~/.agents/skills/ .claude/skills/ .agent/skills/ .agents/skills/ 2>/dev/null. Compare the results against the recommended_skills field in this file's frontmatter. For any that are missing, mention them once and offer to install:
