Topic

Authentication

SPF, DKIM, DMARC, alignment, and the traps that pass a checker but fail in the wild.

Who should care. Anyone whose mail goes to Gmail, Yahoo, Outlook, or Apple — i.e. almost everyone.

If you are new. Authentication is how inboxes check you are really you: SPF (who may send), DKIM (signature), DMARC (policy). DNS is the public phone book where those records live.

Common mistake. Green ticks inside the ESP that do not mean the From domain is aligned.

6 rules below · Glossary · Filter to your desk

SharedNew on siteAuth · Global

SPF stops evaluating after ten DNS lookups and returns permerror

Every include: is a lookup, and you get ten.

Skip if Your record contains three or four includes and has not changed in a year.

SharedNew on siteAuth · Global

An empty p= in a DKIM record is a revoked key, not a published one

p= with nothing after it does not mean the key is missing.

Skip if You have never rotated a key and publish exactly the selectors your platform gave you.

SharedAuth · Global · Microsoft

Outlook rejects unauthenticated mail from high-volume senders

Microsoft will bounce mail that is not authenticated — often with error 550 5.7.515.

Skip if You send under 5,000 messages a day to Microsoft consumer addresses.

SharedAuth · Global

DKIM passing is not DKIM aligned

A green “ pass” can still mean spam folder if the signature is not for the brand in the .

Skip if You have a branded sending domain configured in everything that sends as you, and somebody has actually read a aggregate report this quarter.

SharedUpdatedAuth · Global

BIMI shows a logo after DMARC — it is not a bulk-sender mandate

can show your logo after strong — it is not on Gmail/Yahoo’s bulk “must do” list.

Skip if You do not care about logos in the inbox chrome and your auth/complaints are already clean.

YoursNew on siteAuth · Global

DMARC p=none is monitoring, not enforcement

p=none means watch and report — it does not tell receivers to block impostors.

Skip if You already run p=quarantine or p=reject with clean reports and no unknown senders.