email-deliverability

Files (3)

• SKILL.md
• _claude-frontmatter-extras.yaml · references/
• dmarc-rollout-playbook.md · references/

SKILL.md (first lines)

# Email Deliverability

Get email into inboxes, not spam folders. Set up authentication. Monitor reputation. Diagnose problems before they hurt the business.

---

## When to use

- Setting up email for a new domain
- A meaningful percentage of email is going to spam
- Customers report they're not receiving emails
- Setting up DMARC, SPF, or DKIM
- Hardening against domain spoofing
- Migrating email service providers
- Sender reputation has dropped
- Pre-launch audit before sending volume increases

## When NOT to use

- Writing the email content itself (use `email-sequences`)
- Designing the email program strategy (use `email-sequences`)
- DNS records in general (use `domain-strategy`)
- Outbound spam coming FROM your account (different problem; investigate compromised credentials)

---

## Required inputs

- The sending domain(s)
- The email service provider (ESP, transactional service, mail server)
- Current DNS records (or access to them)
- Email volume (transactional vs marketing, daily volume)
- Current deliverability state (if known: bounce rate, spam complaints)

---

## The framework: 3 pillars

Email deliverability rests on three pillars. Weakness in any one limits the others.

### Pillar 1: Authentication

Mailbox providers verify email is actually from who it claims to be from. Three records.

**SPF (Sender Policy Framework)**

Lists which servers are authorized to send mail for the domain. Published as a TXT record at the apex.

```
v=spf1 include:_spf.mailprovider.com -all
```

- `include:` adds another sender's authorized list
- `-all` (hard fail): mail from unlisted senders fails authentication
- `~all` (soft fail): unlisted senders are suspicious but pass; useful during rollout
- `+all`: never use; allows anyone to send

Only one SPF record per domain. Multiple SPF records break SPF entirely. Combine senders into a single record.

SPF has a 10-DNS-lookup limit. Each `include:` may use multiple lookups. Hit the limit and SPF stops working. Watch this carefully.

**DKIM (DomainKeys Identified Mail)**

A cryptographic signature on each outgoing email. The mail server signs with a private key; the public key is published in DNS.

```
selector1._domainkey.example.com    TXT    "v=DKIM1; k=rsa; p=MIGfMA0G..."
```

Selectors differ by ESP. Some use `default._domainkey`, some use unique selectors per service. Most ESPs walk you through publishing the records.

DKIM proves the message wasn't modified in transit and that the sender controls the domain.

**DMARC (Domain-based Message Authentication, Reporting, and Conformance)**

The policy layer. Tells receivers what to do when SPF or DKIM fails, and where to send reports.

```
_dmarc.example.com    TXT    "v=DMARC1; p=reject; rua=mailto:dmarc-aggregate@example.com; ruf=mailto:dmarc-forensic@example.com; pct=100; adkim=s; aspf=s"
```

Components:
- `p=`: policy. `none`, `quarantine`, or `reject`.
- `rua=`: aggregate reports (daily, summary). Always set this.
- `ruf=`: forensic reports (per-message). Optional, can be high volume.
- `pct=`: percentage of failing mail subject to the policy. Useful for gradual rollout.
- `adkim=`, `aspf=`: alignment mode. `s` (strict), `r` (relaxed). Strict means From: domain must match exactly.

DMARC is the most important record. It's what makes spoofing your domain hard.

### Pillar 2: Reputation

Mailbox providers (Gmail, Outlook, Yahoo) score every sender. Reputation drives delivery.

Reputation factors:
- **Authentication pass rates** (SPF, DKIM, DMARC)
- **Engagement signals** (opens, replies, marking as not-spam)
- **Negative signals** (spam complaints, deletions without opens, blocking)
- **List hygiene** (low bounce rates, no spam traps)
- **Volume consistency** (sudden spikes look like spam)
- **Content patterns** (link reputation, attachment patterns)
- **IP and domain history**

Reputation is per (sending domain × mailbox provider). Gmail's view of you is independent of Outlook's.

### Pillar 3: List quality and engagement

Authentication and reputation rest on list quality. Bad list = bad reputation eventually.

- Only send to people who explicitly opted in
- Confirmed (double) opt-in for marketing wherever feasible
- Honor unsubscribes immediately and reliably
- Remove hard bounces immediately
- Sunset disengaged contacts (no opens in 6 months: reduce frequency or remove)
- Avoid third-party lists, scraped emails, or "purchased opt-ins"

The single biggest deliverability lever for most senders is list hygiene.

---

From rampstackco/claude-skills, MIT.

More from rampstackco/claude-skills