email-infrastructure-setup

Email Infrastructure Setup

Establish the deliverability foundation every other email skill depends on: dedicated outbound domains, DNS authentication (SPF+DKIM+DMARC), RFC 8058 one-click unsubscribe, and 14+ day warmup. Emits the binary readiness_flag that gates cold-email-sequence.

Clarification Protocol

When you encounter any of the following, STOP and ask the user — do NOT make a silent assumption, and do NOT flatly refuse:

• Ambiguous or missing input
• A fork in approach (multiple valid frameworks, segments, scopes, or sources)
• A rule that would block progress
• An assumption that materially shapes the output
• Unverified data that a downstream step depends on

Present 2–4 concrete options with trade-offs and your recommendation.

Format:

Decision needed: <what's being decided> Options:

• A) <option> — trade-off
• B) <option> — trade-off
• C) <option> — trade-off My recommendation: <X> because <reason>. Confirm or pick a different option before I continue.

Refusing to proceed is NEVER the final answer. Every "block" must come with an override option. If the user picks an override, honor it on the first request — do not re-prompt the same block multiple times in one run.

Scope

This skill ONLY produces outbound email infrastructure setup checklist (DNS, SPF/DKIM/DMARC, warmup schedule, deliverability monitoring). Do not expand into adjacent topics. If the user's request implies adjacent scope, trigger Clarification Protocol with options to (A) stay in scope, (B) note the adjacent need as a follow-up, (C) hand off to a different skill.

When to Use

• New outbound program needs email infrastructure from scratch
• Deliverability tanked — audit and fix existing setup
• Migrating sending platforms (Outreach.io → Smartlead, etc.)
• Google/Microsoft sent a bulk-sender warning
• Adding a second outbound domain to scale volume
• Recovery after complaint-rate spike or blacklist event
• Domain warmup score below 70 — need to complete ramp

Quick Reference

Concept	Value
Reputation isolation	Cold outbound from brand-mail.com variant, NEVER brand domain
DNS records required	SPF, DKIM (≥2048-bit), DMARC (start p=none), MX, rDNS
One-click List-Unsubscribe	RFC 8058 — mandatory for >5k/day (Google/MS 2024)
DMARC ramp	p=none → p=quarantine (Day+30 if clean) → p=reject (high-stakes)
Warmup duration	21–30 days new/cold; 14-day floor aged domains; 30-day floor >200/day
Warmup score threshold	≥70 to flip readiness flag
Domain age threshold	≥14 days
Daily ramp caps	5/day → +5 every 5 days → 30/day after 14 days
Postmaster gate	"High" or "Medium" only; "Low"/"Bad" → extend warmup
Complaint thresholds	Target 0.10%; Google enforcement ceiling 0.30%
Bulk-sender mode	>5,000/day → mandatory DMARC + 0.3% complaint cap

Procedure

0. Test Mode prompt (pre-procedure) — Before full setup, ask the user: "Do you want a dry run on a single domain first to validate the setup, or full setup across all domains? (A) Single-domain dry run (B) Full setup (C) Cancel." Honor the choice on first reply; do not re-prompt within the same run.
1. Audit existing infrastructure — If migrating, pull current SPF/DKIM/DMARC via ${HERMES_SKILL_DIR}/references/dns-frameworks.md. Surface mis-configs before new setup.
2. Choose dedicated outbound domain(s) — Propose 2–3 brand variants (<brand>-mail.com, get<brand>.com). NOT the brand domain. For >200/day plan 2+ domains for rotation.
3. Register + configure DNS — Per outbound domain: publish SPF, DKIM (≥2048-bit from sending platform), DMARC (p=none; rua=...), MX, rDNS. Watch SPF 10-lookup limit. See ${HERMES_SKILL_DIR}/references/dns-frameworks.md for record formats.
4. Configure RFC 8058 one-click List-Unsubscribe — Both headers on every send. Process unsub within 24h. Mandatory under Google/MS 2024 for >5k/day senders.
5. Configure jurisdiction-aware footers — US: physical address (CAN-SPAM). EU/UK: LIA + opt-out + DPO (GDPR). CA: identification + opt-out (CASL). Templates in ${HERMES_SKILL_DIR}/references/compliance-footers.md.
6. Initiate warmup ramp — Day 0: enable platform warmup, cap 5/day. Ramp +5 every 5 days. No shortcuts. Schedule detailed in ${HERMES_SKILL_DIR}/references/warmup-schedule.md.
7. Run reputation baseline (Day+14) — Pull Google Postmaster, Microsoft SNDS, TalosIntel, MXToolbox. Cross-check; want Postmaster High/Medium, SNDS green/yellow.
8. Emit readiness flag — All gates pass → readiness_flag: true + ready_for_sends_per_day. Any gate fails → default readiness_flag: false + failed_gates + remediation. If the user explicitly chooses to proceed despite failed gates, trigger Clarification Protocol (A) remediate now, (B) proceed with readiness_flag: false + lower-confidence and reduced sends/day, (C) cancel — and honor the override on first request.
9. Push to CRM — Run ${HERMES_SKILL_DIR}/scripts/push_to_crm.py with the setup record. Infrastructure is system-state (not entity-state) — pushes as interaction:research only.

Pitfalls

• Sending from the brand domain — reputation contamination is unrecoverable
• Skipping warmup — Day-1 cold-blast = instant blacklist
• DMARC straight to p=reject — breaks transactional + reply email
• 1024-bit DKIM keys — Yahoo treats as deprecated; Google deprioritizes
• No List-Unsubscribe header — auto-spam under Google 2024 rules
• No physical address (CAN-SPAM US) — legal violation

Verification

1. Every DNS record resolves correctly via MXToolbox + dig; one-click unsubscribe processes test request within 24h; physical address renders in test emails
2. Postmaster Tools and SNDS both show valid baseline (not "Bad"/red); warmup score climbs per ramp schedule
3. Test send to real Gmail and real Outlook inboxes both land in primary tab

Output Format

• Sections required: Setup Checklist (per domain), DNS Record Plan, Warmup Schedule, Compliance Notes
• Tables / fields: DNS Record Plan = Record type | Hostname | Value | Status [pending/active/verified]; Warmup Schedule = Day | Volume | Notes
• Length target: ≤800 words per domain
• File type: markdown
• Mandatory closing sections: Verification Notes, Next Step