SPF, DKIM and DMARC so your email reaches the inbox

Paste into any coding agent: Claude Code, Cursor, Codex, Copilot, Windsurf or Cline.

# SPF, DKIM and DMARC so your email reaches the inbox

Sign-up confirmations, password resets and launch emails from the production site go to spam, or are rejected outright by Gmail and Yahoo, when the domain is not authenticated. Work out everything that sends email as the domain and give me the exact DNS records to add, with a safe path from monitoring to enforcement.

Site: not given. Find the production URL in the project config, or ask me.

## Ground rules

1. Read before you write. Explore the parts of the codebase this job touches and tell me what is already in place.
2. Plan, then stop. Give me a numbered plan: what you will change, in which files, and why. Wait for my approval before editing anything.
3. Fix things at their source (the shared layout, the config, the generator), not with one-off patches page by page.
4. Keep the project's conventions: its framework APIs, file layout, naming and code style. Add no new dependency without asking.
5. Where something is already done well, say so and leave it alone.

## You will not

- Edit `.env` files, secrets or API keys, or print their values.
- Deploy, push, merge or publish anything.
- Delete data, or run migrations or scripts against a production database.
- Add tracking, third-party scripts or links to any site I did not ask for.
- Change copy, design or behaviour that this job does not need.
- Change DNS records: I add them.
- Send test emails to anyone but me.

## Your stack

- Framework: Work out the framework, router and build output from the project files (package.json, lockfiles, framework config) before planning, and say which you found.
- Host: Work out where the site is hosted from the config files (vercel.json, netlify.toml, wrangler config, Dockerfile, fly.toml) and say which you found.

## Steps

### 1. Find every sender

From the code and config, list every service that sends email as the domain: the transactional provider, the newsletter tool, support desk, billing receipts, the auth provider and any SMTP settings. Ask me about senders outside the code (Google Workspace, a CRM).

### 2. SPF

Write one `v=spf1` TXT record for the root domain that includes each sender (for example `include:_spf.google.com`), ending in `~all` (or `-all` once confirmed). Keep it under the limit of 10 DNS lookups; if senders push it over, propose sending some from a subdomain instead.

### 3. DKIM

For each sender, list the DKIM records it asks for (usually CNAME or TXT records under `selector._domainkey`) and where in its dashboard to find them. Make sure every sender signs with the site's domain, not its own.

### 4. DMARC

Write a `_dmarc` TXT record starting at monitoring: `v=DMARC1; p=none; rua=mailto:<reports address>; adkim=r; aspf=r`. Explain the path: read the reports for a couple of weeks, then move to `p=quarantine`, then `p=reject` once every legitimate sender passes.

### 5. Check the code side

Make sure every email the app sends uses a From address on the authenticated domain, a working Reply-To, and a plain-text part as well as HTML.

## Done means

- [ ] Every service that sends as the domain is listed.
- [ ] I have one SPF record under 10 lookups, the DKIM records per sender, and a DMARC record.
- [ ] I have a dated plan to move DMARC from p=none to quarantine and reject.
- [ ] Every email the app sends uses the authenticated domain and has a plain-text part.

## Report back

When you finish, give me:

- what you changed, file by file;
- anything you skipped, and why;
- anything I must do by hand (DNS records, dashboards, accounts, deploys);
- how to check each change on the live site.