email-infrastructure

# Email Infrastructure Production email delivery requires DNS authentication, domain isolation, and provider-agnostic architecture. A single misconfiguration can land your entire domain in spam. ## GOOD vs BAD: Domain Strategy ``` BAD: Send bulk marketing from example.com → Spam complaints tank your main domain reputation → Transactional emails (password reset, receipts) start landing in spam → Recovery takes weeks of warmup GOOD: Subdomain isolation with separate reputations → mail.example.com for transactional (password reset, receipts, 2FA) → notify.example.com for product notifications (comments, mentions) → marketing.example.com for bulk campaigns (newsletters, promotions) → Each subdomain has independent reputation — one bad campaign does not poison the rest ``` ## DNS Authentication: SPF + DKIM + DMARC ``` # SPF — declare which servers can send from your domain mail.example.com TXT "v=spf1 include:_spf.provider.com ~all" # DKIM — cryptographic signature on every email selector._domainkey.mail.example.com TXT "v=DKIM1; k=rsa; p=MIGf..." # DMARC — policy for failed authentication (progressive rollout) # Week 1-2: monitor only _dmarc.mail.example.com TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.com" # Week 3-4: quarantine suspicious emails _dmarc.mail.example.com TXT "v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@example.com" # Week 5+: reject after confidence builds _dmarc.mail.example.co...