Skip to content
emailrules.today

Authentication history · 1 day observed

patagonia.com

Observed from 4 Aug 2026 to 4 Aug 2026. Nothing published in DNS has moved in that window.

Where it stands today

Live lookup, 5 Aug 2026. The same check /check/patagonia.com runs.

  • 3worth a look
  • 2fine
  • 1context

  • Worth a look

    present with p=none

    This satisfies Gmail and Outlook, and protects nothing. p=none only asks for reports; it never tells a receiver to act, so anyone can still send as this domain and nothing happens.

    v=DMARC1; p=none; rua=mailto:Reports.DMARC@patagonia.com,mailto:dmarc_agg@vali.email

    From DMARC p=none is monitoring, not enforcementSee what this looks like →

    This one needs you

    Move to p=quarantine with pct=5 once a week of shows no unaligned sender you cannot name. No platform can choose your policy. This one has never been anybody else's.

  • Worth a look

    Klaviyo signs your mail, and nothing you publish names it

    2 of Klaviyo's selectors carry live keys here, so Klaviyo is signing mail as you. Neither your record nor any of the subdomains bulk mail is normally sent from mentions Klaviyo; your SPF names Microsoft 365 and Salesforce. That is not automatically wrong: if Klaviyo sends with its own return-path domain, which is the default on every major platform, your SPF is never consulted on those messages and they pass on alone. What it does mean is that this channel has no SPF to fall back on — one key rotated, revoked or mis-copied and there is nothing underneath it.

    v=spf1 ip4:216.245.185.197/32 ip4:20.66.44.240/30 ip4:98.152.10.66/32 ip4:151.106.133.162/32 include:spf.protection.outlook.com include:smp.ne.jp include:_spf2.patagonia.com include:_spf.salesforce.com a:production.na02.patagonia.demandware.net ~all
kl._domainkey, kl2._domainkey

    From Gmail enforces authentication, PTR, TLS and a 0.30 percent spam rateSee what this looks like →

    Part platform, part you

    Send one campaign through Klaviyo to yourself and read the Authentication-Results header. If it says =pass, the envelope is on Klaviyo's domain and there is nothing to do. If it says spf=fail or softfail, you are sending with your own domain as the envelope and Klaviyo's include: belongs in your SPF.

  • Worth a look

    SendGrid signs your mail, and nothing you publish names it

    2 of SendGrid's selectors carry live keys here, so SendGrid is signing mail as you. Neither your record nor any of the subdomains bulk mail is normally sent from mentions SendGrid; your SPF names Microsoft 365 and Salesforce. That is not automatically wrong: if SendGrid sends with its own return-path domain, which is the default on every major platform, your SPF is never consulted on those messages and they pass on alone. What it does mean is that this channel has no SPF to fall back on — one key rotated, revoked or mis-copied and there is nothing underneath it.

    v=spf1 ip4:216.245.185.197/32 ip4:20.66.44.240/30 ip4:98.152.10.66/32 ip4:151.106.133.162/32 include:spf.protection.outlook.com include:smp.ne.jp include:_spf2.patagonia.com include:_spf.salesforce.com a:production.na02.patagonia.demandware.net ~all
s1._domainkey, s2._domainkey

    From Gmail enforces authentication, PTR, TLS and a 0.30 percent spam rateSee what this looks like →

    Part platform, part you

    Send one campaign through SendGrid to yourself and read the Authentication-Results header. If it says =pass, the envelope is on SendGrid's domain and there is nothing to do. If it says spf=fail or softfail, you are sending with your own domain as the envelope and SendGrid's include: belongs in your SPF.

  • Looks fine

    present, ending ~all

    Soft fail. Accepted everywhere, though -all is stronger once your sender list is complete.

    v=spf1 ip4:216.245.185.197/32 ip4:20.66.44.240/30 ip4:98.152.10.66/32 ip4:151.106.133.162/32 include:spf.protection.outlook.com include:smp.ne.jp include:_spf2.patagonia.com include:_spf.salesforce.com a:production.na02.patagonia.demandware.net ~all

    See what this looks like →

  • Looks fine

    keys published on 6 selectors

    A key existing is not the same as working. Read a real received header and check the d= value matches your before you call this done.

    selector2._domainkey (Microsoft 365), kl._domainkey (Klaviyo), selector1._domainkey (Microsoft 365), kl2._domainkey (Klaviyo), s2._domainkey (SendGrid), s1._domainkey (SendGrid)

    From DKIM passing is not DKIM alignedSee what this looks like →

    Part platform, part you

    The key is your platform's to publish and it has. Whether it signs the domain in your is yours to confirm, and cannot show it — send one campaign to yourself and look for =pass header.d=patagonia.com in the Authentication-Results header.

  • Context

    Receiving mail via Microsoft 365

    Where you receive mail says nothing about where you send it. Marketing sends usually leave through a different platform entirely.

    patagonia-com.mail.protection.outlook.com

    See what this looks like →

What has moved

One entry per day a published record actually changed. Days we looked and found nothing different are counted, not listed.

  1. First observation — what was already published

    SPF published.

    v=spf1 ip4:216.245.185.197/32 ip4:20.66.44.240/30 ip4:98.152.10.66/32 ip4:151.106.133.162/32 include:spf.protection.outlook.com include:smp.ne.jp include:_spf2.patagonia.com include:_spf.salesforce.com a:production.na02.patagonia.demandware.net ~all

    DMARC published.

    v=DMARC1; p=none; rua=mailto:Reports.DMARC@patagonia.com,mailto:dmarc_agg@vali.email

    DKIM keys on selectors we probe.

    kl._domainkey (Klaviyo), kl2._domainkey (Klaviyo), s1._domainkey (SendGrid), s2._domainkey (SendGrid), selector1._domainkey (Microsoft 365), selector2._domainkey (Microsoft 365)

    MX records present.

    patagonia-com.mail.protection.outlook.com
Where this comes from. Public DNS, and nothing else. We read the same TXT and MX records any mail server reads before accepting a message, on the days someone looked. There is no scan, no login, no mail, and no score here — only what was published and the date we saw it. Gaps are days we did not get a clean answer from a resolver, and we would rather leave those blank than guess at them.
Run the full checkSee which rules are yours

FAQ

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.