I build and operate high-volume email delivery infrastructure — from raw SMTP and MTA tuning to authentication, reputation and inbox placement — and the full-stack products that sit on top of it. Right now that's Sendpilots — and I build it AI-native, with a fleet of coding agents and hard engineering guardrails.
arun:
role: Email Infrastructure Engineer · Full-Stack Developer
building: Sendpilots — email delivery + AI-native outreach
timezone: IST (UTC+05:30)
mta: [Postal, Postfix, Haraka, PowerMTA, KumoMTA, OpenSMTPD, Exim]
auth: [SPF, DKIM, DMARC, BIMI, ARC, MTA-STS, TLS-RPT, DANE]
filtering: [Rspamd, SpamAssassin, Amavis, Postscreen, ClamAV, Milter]
product: [Laravel, Livewire, FastAPI, Next.js, Nuxt, TypeScript, Python]
infra: [Docker, Nginx, Caddy, Redis, Celery, PostgreSQL, Linux]
cloud: [AWS, Hetzner, DigitalOcean, Cloudflare]
ai: [Claude Code, Cursor, Codex, Gemini CLI, Hermes, Kiro, MCP]
motto: "If it didn't land in the inbox, it wasn't delivered."
📑 The checklist I run before any domain sends at volume — with sources
| # | Check | Why it matters in 2026 |
|---|---|---|
| 1 | SPF and DKIM pass, DMARC published and aligned | Required by Gmail, Yahoo and Outlook for 5,000+/day senders. Outlook rejects non-compliant mail with 550 5.7.515 (since 5 May 2025). |
| 2 | DMARC with rua= reporting, then ramp p=none → quarantine → reject |
p=none is the minimum; enforcement is what unlocks BIMI and stops spoofing. |
| 3 | User-reported spam rate < 0.1%, never ≥ 0.3% | Google escalated from spam-foldering to permanent 5xx rejects in Nov 2025. My own ceiling is 0.08%. |
| 4 | One-click unsubscribe (List-Unsubscribe + List-Unsubscribe-Post, RFC 8058), honoured within 2 days |
Required for marketing mail at Gmail and Yahoo. |
| 5 | Valid PTR / forward-confirmed rDNS that matches HELO, TLS on every hop | Cheapest reputation win; missing rDNS is still a top rejection cause. |
| 6 | Split transactional vs marketing IP pools and domains; warm new IPs on a schedule | One bad campaign shouldn't take password resets down with it. |
| 7 | BIMI: DMARC at enforcement + VMC (trademark) or CMC (no trademark, Gmail supports it) | Verified logo = trust signal in the inbox. |
Sources: Google sender guidelines · Google sender guidelines FAQ · Microsoft: Outlook requirements for high-volume senders · Microsoft: fix NDR 550 5.7.515 · BIMI Group: Common Mark Certificates · RFC 8058 · Red Sift 2026 bulk-sender guide
I'm a vibe-coder with a senior engineer's checklist: agents write a lot of the code, but specs, tests, CI and review decide what ships. Every repo carries its own agent context (
CLAUDE.md,AGENTS.md,GEMINI.md,.cursor/,.kiro/,.mcp.json) so any agent can pick up the work cold.
| Project | Role | What I'm doing with it |
|---|---|---|
| Mailu/Mailu | fork → Mailu_sp | Containerised mail-server stack research |
| Billionmail/BillionMail | fork → BilemailPL | Studying a self-hosted mail + newsletter platform |
| sendx/email-skills | fork → email-skills | Deliverability & compliance skills for AI agents |
| KumoCorp/kumomta | ⭐ watching | High-performance open-source MTA |
| postalsys/emailengine | ⭐ watching | Headless email client / IMAP API |
| maileroo/email-specter | ⭐ watching | KumoMTA delivery-log monitoring |
| MTAs |
|
| Authentication |
|
| Filtering |
|
| ESP APIs |
|
| Reputation |
|
| AI agents |
|
| Also |
|
🧊 Deep metrics — 3D calendar, coding habits, achievements
- Now — LeadQ v2: finishing phases 6–8 on top of the Go SMTP/IMAP engine
- Now — FlowMail AI agents: reply triage, A/B recommendations and flow optimisation on Claude
- Next — Mailcore: hardening the Rust mail server (242 tests today) toward a real pilot
- Next — multi-MTA failover with per-ISP throttling and automatic IP-pool rotation
- Later — open-source IP-warming toolkit · multi-region MTA infrastructure · BIMI + CMC for every sending domain
🗄️ Production email DNS cheat-sheet
; Complete production email DNS setup
@ MX 10 mail.yourdomain.com.
mail A <SERVER_IP>
; PTR <SERVER_IP> → mail.yourdomain.com. (set at your host; must match HELO)
@ TXT "v=spf1 ip4:<SERVER_IP> -all"
sp1._domainkey TXT "v=DKIM1; k=rsa; p=<PUBKEY>" ; 2048-bit, rotate yearly
_dmarc TXT "v=DMARC1; p=reject; adkim=s; aspf=s; rua=mailto:dmarc@yourdomain.com"
_mta-sts TXT "v=STSv1; id=<TIMESTAMP>"
_smtp._tls TXT "v=TLSRPTv1; rua=mailto:tls@yourdomain.com"
default._bimi TXT "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem"
Operating rules I ship by
- Warm new IPs on a schedule (0 → 1M+/day), segment transactional vs. marketing pools
- Soft bounces (4xx) retry with exponential backoff; hard bounces (5xx) and FBL complaints suppress permanently
- Keep complaint rate under 0.08%; watch Google Postmaster + Microsoft SNDS daily
- Seed-list placement tests across 100+ mailbox providers before every major send
- Parse DMARC aggregate (RUA) reports and alert on new unauthenticated sources
- CAN-SPAM, GDPR and CASL compliance baked into the product, not bolted on
