DMARC, SPF and DKIM guides

DMARC setup: from p=none to p=reject Every step from no record to p=reject: the record to publish at each step, the checks I run before moving on, and what to do when a sender won't align. Moving DMARC to p=reject: the checks before each step The checks to run against your reports before you tighten DMARC, the record change for each step, and how to roll back fast when a step catches real mail. How to read a DMARC aggregate report Open a DMARC aggregate report, read each field, and tell your own mail, forwarding, an unauthenticated platform and spoofing apart. Covers RFC 9990 reports. SPF's 10-lookup limit: what counts and how to get under it SPF permerror from too many DNS lookups: what counts toward the 10-lookup limit, an example record counted term by term, and four fixes up to SPF flattening. DMARC alignment: why SPF can pass while DMARC fails DMARC passes when the From domain matches a domain that SPF or DKIM authenticated. Relaxed and strict alignment, and why forwarding breaks SPF. What is DMARC What a DMARC record is, why you publish it at p=none first, and how p=reject stops forged mail that uses your exact domain. SPF record syntax, term by term SPF record syntax and format checked against RFC 7208: example records, every mechanism, modifier and macro, its lookup cost, and the typos that break it. Multiple SPF records: why a second one breaks both Two v=spf1 records on the same name is a permerror, and permerror fails every sender in both. How to tell if you have two, and how to merge them into one. SPF with multiple includes: how many one record can hold Nothing caps how many include: terms an SPF record holds. The 10 DNS lookups they spend between them is the cap, and your record does not show that number. Hard bounce vs soft bounce: 5xx refusals and 4xx retries A hard bounce is a 5xx refusal, a soft bounce is a 4xx retry. Which codes mean the address is gone, which mean your authentication is broken, and how to tell. Domain reputation: checking Gmail, Microsoft and the blocklists There is no single domain reputation score. Gmail, Microsoft and the blocklists each keep their own. How to check each one, starting with Postmaster Tools. Spamhaus delisting: each list and its removal path Spamhaus runs five lists and each has its own removal path. Read the return code to see which one has you, fix the cause, then request removal once. Barracuda delisting: the IP list and its removal form Barracuda lists IPs, not domains, from spam traps and its own appliances. How to check the list, what the form asks, and why a second request is ignored. SPF, DKIM and DMARC: what each one checks and how they fit together SPF lists your servers, DKIM signs your mail, and in DMARC you set what a receiver does with mail that fails. How the three fit, and where alignment comes in. Email spoofing: how a forged From works, and what stops it The From address on an email is text the sender types. How spoofing works, why the reader can't tell, what DMARC at p=reject stops, and what it doesn't. DKIM fail: finding the cause in the email's headers Fix dkim=fail from the email's headers: body hash did not verify, no key for signature, dkim=none, and a DKIM pass that still fails DMARC. NCSC Mail Check is retired: move your DMARC reports Mail Check stopped DMARC reporting in March 2025 and closed in March 2026. Check your rua address, choose a free report reader and change that tag only. Direct Send spoofing: block it in Microsoft 365, then fix DMARC Attackers use Direct Send to mail Microsoft 365 users as their own domain. Turn on Reject Direct Send, add connectors, and move DMARC off p=none. Emails going to spam: causes at Gmail, Outlook and Yahoo Why your emails go to spam at Gmail, Outlook and Yahoo even when SPF, DKIM and DMARC pass. Check complaints, consent, reputation and content, in that order. SPF softfail: what it means, and when to change ~all spf=softfail means the sending server isn't in your SPF record and the record ends in ~all. What receivers do with it, what DMARC does, and which fix applies. What is SPF? How the record works and what it can't do SPF is a DNS record listing the servers allowed to send mail for your domain. How receivers check it, why it fails on forwards, and what DMARC needs from it. What is DKIM, and what does the selector do? DKIM signs each message with a private key and publishes the public key in DNS. How the selector finds the key, what the record holds, and how to set it up. DMARC policy: what none, quarantine and reject do at the receiver The p= tag tells receivers what to do with mail that fails DMARC. What Gmail and Microsoft 365 do with each value, plus the sp, np and pct tags. DMARC monitoring pricing, vendor by vendor What Valimail, PowerDMARC, EasyDMARC, dmarcian and the rest charge for DMARC monitoring, including vendors with no public price. Every figure has a source. Check an SPF change in a pull request before it reaches DNS Fail a DNS pull request when an SPF change drops a sender or breaks the record. A free GitHub Action, with recipes for octoDNS, DNSControl and Terraform. Check your domain from ChatGPT or Claude Add the DomainCanary connector to Claude or ChatGPT by its URL, then ask it to check a domain, build an SPF record, explain a bounce or read a DMARC report. 35,050 domains list a DMARC report address without authorization In our October 2026 scan, 35,050 domains named an outside DMARC report address with no authorization record. See which setups cause it and the fix.