transactional-emaillisted

# Transactional Email Email breaks in ways the code never shows you. A send can return `delivered: true` and still be refused three hops later. **Diagnose before you change anything** — run `scripts/diagnose.py` first, every time. Most "our email is broken" reports are a DNS or reputation fact, not a bug. ## The one thing to internalise **Sending and receiving are two different systems.** A relay (Brevo, Resend, SES, Postmark) sends and cannot receive. A mailbox or forwarder (Google Workspace, Zoho, ImprovMX, Cloudflare Email Routing) receives. A domain that only sends looks disposable to filters, and you cannot complete a blocklist-removal request without a working `postmaster@`. Nearly every "which provider should we use?" question is really two questions. ## Start here ```bash python scripts/diagnose.py example.com # DNS + blocklists python scripts/diagnose.py example.com --sending-ip 1.2.3.4 # also check the sending IP python scripts/diagnose.py example.com --scan ./src # also scan code for stub leaks ``` It reports, in severity order: blocklist listings, missing/duplicate SPF, SPF lookup overflow, missing DKIM/DMARC, no MX, missing `postmaster@`/`abuse@`, and dev-stub credential leaks in code. Read [references/interpreting-results.md](references/interpreting-results.md) for what each finding means and the exact fix. Then **prove it with one real send** — a clean `diagnose.py` does not mean mail arrives: ```bash python scripts/send_t