Inbox mail from an AI-built app (2026)

Who this is for

You shipped from Lovable, Bolt, Replit, v0, Cursor, or another AI builder. People who are not you can create an account. The app already sends a confirm mail, a reset mail, or a receipt. The From line still looks like the builder host, or you pasted one SPF line from chat and stopped. You want those messages in the inbox, not in spam, before you buy ads.

You are not this page if the app still lives only on a laptop, if only the founder can log in, or if you cannot take the live URL down tonight. Open the domain page if you do not own the registrar. Open the backup page if you have no restore file.

What landing mail means

Landing mail means a real inbox shows the message, not the junk folder, and not a bounce. A bounce is a notice that the mailbox would not take the message. The product path is the proof: a new user gets the confirm mail, opens it, and finishes the click. A reset mail that never arrives is a lockout. A receipt that lands in spam looks like a failed charge.

Mailboxes do not trust a builder From line. They trust a name you publish proofs for. DNS is the phone book of the internet. A DNS record is one public line on that name. A TXT record is a public text line. The three mail proofs are TXT records: SPF, DKIM, and DMARC. SPF is a public list of servers allowed to send as you. DKIM is a signature that proves the message was not swapped. DMARC is a public rule for mail that fails those checks.

Pick the sending name

The sending name is the domain in the From line. The From line is the address people see as the sender. Pick a name you own. Do not send product mail from a shared builder host. Alignment is the rule that the From name must match the SPF name or the DKIM name. Gmail’s sender guidelines require that match for bulk senders. Yahoo requires the same match. A leftover noreply on the builder host will fail alignment the day you change From to your name.

Resend will not send until you add and verify a domain you own. It asks you to send from a subdomain such as mail.example.com instead of the bare name, so you can split reputation and say what kind of mail it is. You can verify more than one subdomain of the same name. Keep password resets on one subdomain. Keep a newsletter on another if you send both.

M3AAWG’s sender practices, updated August 2026, say the customer’s sending name should not share fate with a marketing stream. Yahoo’s hub is blunt too: do not send bulk mail from the same IPs you use for user mail, receipts, and alerts. If you only send product mail, one sending name is enough. If you later add a newsletter, give it its own subdomain.

Write the From address on a card: hello@mail.yourname.com, or reset@yourname.com. Search the project for leftover builder hosts in templates. A confirm mail that still prints a lovable.app From is a second identity. One name. One shop. One set of proofs.

SPF

SPF is Sender Policy Framework. It is a public list of servers allowed to send mail as you. You publish it as a TXT record on the sending name. RFC 7208 is the protocol. The receiving server looks up that list and checks the sending IP. If the IP is not on the list, SPF fails.

Gmail requires SPF or DKIM for every sender to personal Gmail. Bulk senders need both. Yahoo matches that split. Twilio SendGrid stores SPF as a TXT record that lists which IPs may send as you. Copy the shop’s include line. Do not invent one from chat.

RFC 7208 caps how many DNS lookups one SPF check may make. Ten is the limit. Two SPF records on the same name is a fail. If Workspace, the mail shop, and a ticket tool all want an include, merge them into one TXT.

Postmark does not ask you to paste Postmark into your root SPF. Receivers check SPF on the Return-Path name. Return-Path is the envelope address where bounces go. Postmark’s default sits on its own name. A custom Return-Path CNAME on your subdomain, pointing at pm.mtasv.net, is how SPF aligns with From. DKIM can still pass DMARC without that CNAME.

DKIM

DKIM is DomainKeys Identified Mail. It is a signature that proves the message was not swapped in flight. You publish a public key as a DNS record. The shop signs each message. The mailbox checks the key. RFC 6376 is the protocol. Yahoo’s hub asks for a DKIM key of at least 1,024 bits. Gmail requires 1,024 bits or longer for personal Gmail, and recommends 2,048 bits if your DNS host supports it.

Postmark’s DKIM setup publishes a TXT record you copy into DNS. Postmark signs with 1,024-bit keys. After DNS is live, Postmark verifies within 48 hours. You can hit Verify sooner. Once it is green, the whole domain can send. You do not add each mailbox as a separate signature.

SendGrid can hold DKIM for you with CNAME records when automated security is on. That also removes the via sendgrid.net tag next to From. If your DNS host rejects underscores in CNAME names, turn automated security off and paste TXT records yourself. Verification can take up to 48 hours. Wait one DNS wait, then check again.

DMARC

DMARC is Domain-based Message Authentication, Reporting, and Conformance. It is a public rule for mail that fails SPF or DKIM. You publish it as a TXT record on _dmarc.yourname. RFC 7489 defines it. The mailbox reads the policy, then decides. A starting policy of none tells the mailbox to send you reports and still deliver. Quarantine and reject come later, after the reports look clean.

Gmail lets bulk senders start at policy none. Yahoo wants a valid DMARC policy of at least none, and DMARC must pass. Relaxed alignment is acceptable. Yahoo also wants a rua tag so reports have somewhere to go. Microsoft accepts none, quarantine, or reject for high-volume senders, and still requires the message to pass DMARC. Publishing none does not skip the pass. The message still needs an aligned SPF or DKIM pass.

Alignment is the usual miss after an AI builder. SPF can pass on the shop’s Return-Path while From is your name. That SPF pass does not help DMARC. DKIM must sign as your name, or the Return-Path must sit on your name. M3AAWG wants an SPF record, a DKIM signature, a DMARC policy on From, and a pass that aligns one of those with From. A green SPF badge in the shop is not a DMARC pass.

Gmail and Yahoo bulk rules

A bulk sender is a shop that sends close to 5,000 messages a day to personal Gmail. Gmail’s FAQ counts every message from the same primary name. Two subdomains that each send 2,500 still make you bulk. Once Gmail marks you bulk, that status does not expire. The rules started on 1 February 2024. Starting November 2025, Gmail ramps up enforcement on mail that misses the list. Failures can be temporary, permanent, or a trip to spam.

Gmail’s sender guidelines split the floor. Every sender to personal Gmail needs SPF or DKIM, valid forward and reverse DNS, TLS, RFC 5322 formatting, and a Postmaster Tools spam rate below 0.3%. Reverse DNS, also called a PTR record, maps the sending IP back to a host name. TLS is encrypted transport, so the path is not plain text. RFC 5322 is the internet message format. Bulk senders need SPF and DKIM, plus DMARC, From alignment, and one-click unsubscribe on marketing mail. One-click unsubscribe is a header that lets the mailbox drop the person from that list in one click.

The spam complaint rate is the share of people who mark your mail as junk. Gmail wants that rate below 0.3% in Postmaster Tools. The FAQ is tighter on the habit: keep it below 0.10%, and never reach 0.30%. The rate is daily. Above 0.3%, bulk senders lose mitigation until the rate stays under 0.3% for seven days. Set up Postmaster Tools on the DKIM name or the SPF Return-Path name.

Yahoo’s sender hub began the same month. All senders need SPF or DKIM and a spam rate below 0.3%. Bulk senders need SPF and DKIM, a DMARC policy of at least none that passes, From alignment, one-click unsubscribe, a visible unsubscribe link in the body, and unsubscribes honored within two days. Yahoo’s spam rate is based on mail that reached the inbox. Yahoo also wants a Complaint Feedback Loop on each DKIM name so junk reports come back to you.

Outlook’s 2025 high-volume rules

Microsoft joined the same 5,000-a-day shape in 2025. Outlook’s postmaster policies say that from 5 May 2025, domains sending more than 5,000 messages a day to Outlook.com must meet SPF, DKIM, and DMARC. Mail that misses those proofs goes to junk. Later, Microsoft will reject it. The reject code is 550 5.7.515. Microsoft’s NDR page defines a high-volume sender as 5,000 or more messages a day to Microsoft consumer mail, all using the same From domain.

After you hit that threshold, every message from that From name must pass SPF and DKIM, publish a DMARC record, and pass DMARC with alignment. Microsoft’s example DMARC line is policy none. The 2025 announcement is the policy post the NDR page points at. If a third-party shop sends as you, Microsoft wants your domain in From, DKIM signed as you, and DMARC using your name.

An AI-built app can hit 5,000 a day without a newsletter. Sign-up confirms, resets, and receipts add up. Treat Gmail, Yahoo, and Outlook as one floor: three proofs, alignment, TLS, PTR on the sending IPs, and a spam rate you can read. The mail shop owns the IPs. You own the name.

Use a mail shop, not the builder From

A transactional provider is a mail shop built to send product mail: confirms, resets, receipts. The builder’s default sender is a shared From on a host you do not own. Gmail says a shared IP’s reputation is shared. A blocklist hit on that IP hits you. The shop holds PTR and TLS for those IPs. You cannot paste a PTR onto a builder you do not run.

Resend makes the split a product rule: you must verify a domain you own. You can turn on enforced TLS so mail only leaves encrypted. You can set a custom Return-Path subdomain. SendGrid treats domain authentication as the step that proves you own the name, you permit the sending servers, and the message was not swapped. Until that is green, Gmail still sees via sendgrid.net.

Put the shop’s API key on the host secrets list, not in the builder chat. Keep a sealed copy of the mail key off the host. Point templates at the verified From. Then send one test, not a blast.

One-click unsubscribe where it applies

One-click unsubscribe is a pair of headers that lets the mailbox drop the person from that list in one click. RFC 8058 is the protocol. You add List-Unsubscribe with an HTTPS URL, and List-Unsubscribe-Post set to List-Unsubscribe=One-Click. The mailbox then POSTs to that URL. A page that asks the user to confirm is not one-click. A mailto-only header is not enough for Gmail.

Gmail’s FAQ is plain: one-click is required only for marketing and subscribed mail. Transactional mail is out. Password resets, reservation confirms, and form confirms are the examples Google lists. If you mix a promo into a receipt, people will mark it junk. Honor marketing unsubscribes within 48 hours. Yahoo wants the same headers, a visible body link, and honor within two days. mailto is acceptable at Yahoo. It is not enough at Gmail.

If you only send confirms, resets, and receipts, you do not need one-click on those messages. If you add a launch newsletter, put one-click on that stream the same week. Do not wait until you cross 5,000 a day. New marketing mail should ship with the headers.

Test before launch

Do not tweet the first user until three inboxes have landed a real message. Send a confirm, a reset, and a receipt to Gmail, Yahoo, and Outlook.com. Open each as a stranger. Check the From name. Check that the click hits your live host, not a builder preview. This page asks whether the mail still prints the builder host.

Read the headers on one landed message. You want SPF pass, DKIM pass, and DMARC pass. Microsoft’s NDR page tells you to confirm Return-Path aligns with From if you need SPF to carry DMARC. If DKIM already aligns, that is enough for a DMARC pass. If both fail, fix the shop before you send more. M3AAWG wants the platform to refuse a send that will fail authentication. Your test is that refusal, done by hand, once.

A founder inbox is not the test. Gmail personal accounts are the accounts the 5,000-a-day rule counts. Send to a Gmail address, a Yahoo consumer address, and Outlook.com. If any of the three files the message, stop. Wait one DNS wait if you just published records, then debug the failing proof.

Watch bounces and complaints after launch

After launch, two rates matter. Bounces tell you the address is dead or the mailbox refused you. Complaints tell you a person marked you as junk. M3AAWG splits SMTP replies: 4xx is a temporary fail, retry later. 5xx is a permanent fail, do not retry. A permanent user-unknown bounce should leave the list. The same paper’s best practice is to remove an address that bounces on at least two consecutive campaigns over two weeks or more, so a short receiver outage does not wipe a real user.

Yahoo tells you to watch hard bounces, soft bounces, and quiet users, and to drop invalid recipients promptly. M3AAWG’s complaint paper says FBL reports should not exceed 0.1%, one complaint per 1,000 sends. A low complaint rate can hide mail that never reached the inbox. Do not wait for 0.3% to act.

Name who reads the shop’s bounce log and the Postmaster Tools spam rate. A Saturday reset storm that bounces is an incident. A complaint spike after a promo in a receipt is an incident. Stop the promo. Keep the reset path. Product mail and marketing mail must not share one From if a promo can poison the reset.

What to do this week

Keep the week small. You need a name you own, a shop that signs as you, and three inboxes that already landed a real message.

1. Pick the sending name. Company-owned. Search templates for leftover builder hosts. One From for product mail.
2. Open a mail shop. Resend, Postmark, SendGrid, or another shop that verifies your name. Put the API key on the host secrets list, with a sealed copy off-host.
3. Publish SPF, DKIM, and DMARC on that name. Start DMARC at policy none. Add a rua mailbox you actually read.
4. Align From. DKIM must sign as you, or Return-Path must sit on your name. A green SPF badge on the shop is not enough.
5. Send three tests to three inboxes. Confirm, reset, receipt. Gmail, Yahoo, Outlook. Read the headers.
6. Turn on Postmaster Tools for the sending name. Enroll in Yahoo’s complaint loop if you send marketing.
7. Name who reads bounces this week. Permanent fails leave the list. Do not retry 5xx.

If a door is still red — builder From, no DKIM, no test to Outlook — stop buying ads that trigger mail. A confirm mail in spam is a sign-up that never finished.

Next steps

Own the From name. Put a mail shop behind it. Publish SPF, DKIM, and DMARC. Align them. Test Gmail, Yahoo, and Outlook. Watch bounces and junk reports. Customers should not be the first people who notice that sign-up mail is spam.

CodeCross is a product studio. The week after an AI-built launch is a live host, a name you own, and mail that already lands. If the From line is still a builder host and you want a second pair of eyes, book a conversation.

FAQ

If the AI builder sends from a lovable.app address, will Gmail treat it as my app?

No. Gmail authenticates the sending name in From. Bulk senders must align that name with SPF or DKIM. A builder host in From is a different identity from your custom name. Search templates for leftover builder hosts after you verify the shop. One From. One set of proofs.

Do password-reset emails need one-click unsubscribe?

No. Gmail’s FAQ excludes transactional mail. Password resets, reservation confirms, and form confirms are the listed examples. Marketing and subscribed mail still need RFC 8058 headers. Yahoo’s hub matches that split for marketing and subscribed messages. Do not mix a promo into a reset if you want to keep the exclusion.

Is SPF enough if I send fewer than 5,000 messages a day to Gmail?

For low volume, Gmail requires SPF or DKIM, plus PTR, TLS, RFC 5322, and a spam rate below 0.3%. Over 5,000 a day to personal Gmail you need SPF and DKIM, plus DMARC. The FAQ counts every message from the same primary name, and bulk status does not expire. Publish all three proofs before the first ads that trigger mail.

Do Outlook’s 2025 rules apply before I hit 5,000 messages a day?

The high-volume floor starts at 5,000 a day to Microsoft consumer mail. Microsoft then requires SPF and DKIM to pass, a DMARC record, and a DMARC pass with alignment. Outlook postmaster began that enforcement on 5 May 2025. Below the floor, publish the same proofs anyway. Crossing 5,000 with a builder From is a hard reject, not a warning.

Should receipts share a subdomain with a launch newsletter?

No if you can split them. Resend recommends subdomains so you can isolate reputation. Yahoo says not to send bulk mail from the same IPs as user mail, receipts, and alerts. Gmail wants the same category to share a From, and not to mix promos into receipts. A promo that draws junk reports will stain the reset path if they share one name.

What bounce should I stop retrying?

A 5xx reply. M3AAWG says 4xx is temporary and should be retried, and 5xx is permanent and should not. Drop user-unknown addresses. Remove an address that bounces on at least two consecutive campaigns over two weeks or more, so a short outage does not wipe a real user. Yahoo’s hub wants invalid recipients removed promptly.