p=reject on day one rejects your own Workspace mail too

DMARC governs the whole domain it's published on -- jumping straight to p=reject on a root domain with other senders (Workspace, a CRM) silently rejects their mail too.

This is one of the things Transactional Email Deliverability Core already handles. Send transactional email that actually lands, and stop emailing people who bounce or complain.

Buy for $793 of 3 clean-room builds passed · full refund if it fails on your machine

Is this you?

Setting _dmarc.yourdomain.com straight to p=reject looks like the secure move -- reject anything that fails authentication. But DMARC governs the entire domain the record is published on, not just the new app sending mail. If Google Workspace, a CRM, or a billing tool also sends as your domain, they now get rejected by mailbox providers too, the moment this record goes live, with no staging period to notice authentication gaps first.

Why this one is easy to get wrong

"Reject unauthenticated mail" reads as the obviously correct security posture for a new mail-sending feature, and most DMARC tutorials that focus on a single app's deliverability don't dwell on the fact that the record is domain-wide, not app-specific -- the interaction with other senders on the same root domain is a fact about DNS scope, not about the new code being written.

What you get instead

The pack's DMARC staging plan is pre-decided operational policy, not a code default: p=none with rua reporting for 2+ weeks, then p=quarantine ramping 25% to 100% over 2-4 weeks, then p=reject only after 2 clean weeks at full quarantine -- and the sending domain is a dedicated subdomain (mail.yourdomain.com) specifically so the whole staged rollout, including any eventual reject, can run there without ever touching the root record other senders depend on.

Source: ARCHITECTURE.md 'DNS + DMARC staging' — checkable in the pack you receive

How you actually use this

You don’t install a library or wire up an SDK. Your own coding agent builds the code in your project, and you keep it — no runtime dependency on us.

Step 1
Download and unzip
You get a folder: the docs that tell an agent what to build, a starting skeleton, and the test suite that decides when it's done.
Step 2
Open it in Claude Code or Cursor
Point your coding agent at the folder. Nothing to install, no account with us, no API key.
Step 3
Paste one prompt
The pack contains the exact prompt. Paste it as your first message and leave it alone — it works through the build itself, choosing a cheaper or stronger model per task.
Step 4
Run ./verify.sh
One command. It prints a pass or fail for every check. Green means the build is done — the same script we ran to produce the receipt on this page.

Typical build: about 13 minutes of your agent working, mostly unattended. Then you integrate the working module into your app the way you would any code you’d written yourself.

Why you can believe this

3 of 3 runs passed

We ran this pack from an empty folder 3 times and published exactly what happened — every check, the model, the token cost, the wall time. Not a testimonial, and not our opinion: the same verify.sh you run yourself. Read the full receipt →

Buy for $79 14-day refund if verify.sh fails →