email-deliverability-securitylisted

# Email Authentication & Deliverability Security Email security has two faces — inbound (don't get phished) and outbound (don't get spoofed, don't land in spam). This skill is about the **outbound** posture: configuring SPF, DKIM, DMARC, and friends so your real mail authenticates and impostors are rejected. Done right, this is a one-evening project per domain that pays off forever. Done wrong, your password reset emails land in junk and attackers send invoices to your customers from `accounting@yourdomain.com`. ## When to invoke - Launching a new sending domain - Your domain is being spoofed (you see bounce reports for mail you didn't send) - Transactional mail (password reset, receipts) consistently lands in spam - Consolidating from multiple ESPs to one - An auditor asks about your DMARC posture - After a phishing wave that abused your domain ## The pieces — what each record does | Record | Purpose | Required? | |---|---|---| | **SPF** | Lists which servers are *allowed* to send for the domain | Yes | | **DKIM** | Signs each message with a key in DNS; receiver verifies signature | Yes | | **DMARC** | Tells receivers what to do when SPF or DKIM fails, and where to send reports | Yes | | **MTA-STS** | Forces TLS between sending and receiving MTAs | Recommended | | **TLS-RPT** | Receives reports of TLS failures | Recommended | | **BIMI** | Shows your brand logo in supporting mail clients | Optional, requires DMARC enforcement + VMC | | **ARC** | Preserves auth state whe