The DDMARC BlogOctober 2026Field notes
Start with the problem you have.
Eighteen field notes on DMARC and deliverability, sorted by what you are trying to do, not by when we happened to write them. Every one is written for the person who has to make the change.
Dated field notes: what changed, and the record to change. Looking for reference instead? See the Learn library.
In force now — not upcoming
Three mailbox providers have already begun enforcing sender requirements. If mail of yours is being rate-limited or junked, these are the rules it is being measured against.
Everything, newest first
18 of 18
01DKIM Key Rotation: Moving to 2048-bit Keys Without Breaking MailMove DKIM from 1024-bit to 2048-bit keys without failed signatures: new selectors, split TXT strings, overlap windows, and the Google and Microsoft quirks.deliverabilitybest-practicessetupOct 14, 20268 min read02SPF Too Many DNS Lookups: Fixing the 10-Lookup LimitOne include can cost seven of SPF's ten DNS lookups. What counts toward the limit, what a permerror does to DMARC, and how to get back under it safely.deliverabilitydmarcbest-practicesOct 14, 20267 min read03DMARCbis (RFC 9989): What Changed in DMARCRFC 9989 replaced the original DMARC specification in May 2026. The pct, rf and ri tags are gone, t= and np= are standard, and the Public Suffix List is out.dmarcbest-practicesOct 4, 20264 min read04DMARC at Scale: A Playbook for MSPs Managing 50+ Client DomainsRunning DMARC across 50, 100, or 1,000 client domains is a process, not a project. A repeatable per-client SOP, multi-tenant monitoring, and how to package it as recurring MSP revenue.mspdmarcbest-practicesAug 31, 20264 min read05The 0.3% Spam Rate: How to Monitor and Stay Under Google's ThresholdGoogle requires bulk senders to keep their user-reported spam rate under 0.3% — and really under 0.1%. Where the number comes from, how to watch it in Postmaster Tools, and what to do when it climbs.deliverabilitygooglepostmasterAug 24, 20264 min read06Forwarders & Mailing Lists: ARC, and Why Legitimate Mail Fails DMARCForwarding and mailing lists break SPF and sometimes DKIM, so your own mail can fail DMARC. What is happening, what ARC does about it, and why it is usually safe to enforce through.dmarcarcforwardingAug 17, 20264 min read07Lookalike Domains & BEC: Why DMARC on Your Real Domain Is Not the Whole StoryDMARC stops attackers forging your exact domain — not one that looks like it. How lookalike domains and display-name tricks drive business email compromise, and how to defend the gap.securitybecphishingAug 10, 20264 min read08Third-Party Senders: Getting DMARC Alignment Right for Mailchimp, SendGrid & HubSpotYour ESP authenticates your mail — so why does DMARC fail? Because 'authenticated' and 'aligned to your domain' are not the same. How to fix alignment for Mailchimp, SendGrid & HubSpot.dmarcespalignmentAug 3, 20264 min read09DMARC for Healthcare: HIPAA, Email Security, and What Auditors Actually CheckHIPAA does not name DMARC, but auditors increasingly expect enforced email authentication for ePHI. How DMARC maps to the Security Rule, and how to roll it out in a clinic.compliancehealthcaredmarcJul 27, 20265 min read10DMARC Passes but Email Still Lands in SpamPassing SPF, DKIM and DMARC is the entry ticket to the inbox, not a guarantee. Why aligned mail still gets filtered, and how to find the real cause.deliverabilitydmarctroubleshootingJul 20, 20265 min read11How to Set Up SPF, DKIM & DMARC for Microsoft 365The exact SPF record, the two DKIM CNAMEs and the DMARC record Microsoft 365 needs, plus the Defender step that actually turns DKIM signing on.dmarcmicrosoft-365setupJul 13, 20265 min read12Anatomy of a Domain Spoofing AttackA spoofed email is just a forged From: header. How the attack is staged, what the target sees, and exactly how it surfaces in your DMARC reports.securityspoofingreportsJul 6, 20266 min read13SPF, DKIM & DMARC Setup for Google WorkspaceThe exact SPF, DKIM and DMARC records Google Workspace needs, in the right order, plus the gotchas that quietly break authentication.dmarcgoogle-workspacesetupJun 30, 20265 min read14Subdomain DMARC: Why the sp= Tag MattersDoes p=reject cover your subdomains? Usually, but one tag can silently undo it. How policy inheritance works and how to lock down dormant subdomains.dmarcbest-practicessubdomainsJun 30, 20266 min read15Microsoft 365 Sender Requirements EnforcedMicrosoft now requires SPF, DKIM and an aligned DMARC record for bulk mail to Outlook.com. Who is affected and how it compares to Google and Yahoo's rules.deliverabilitycompliancemicrosoftJun 30, 20264 min read16Reading DMARC Aggregate Reports: the XMLAggregate reports show who is sending as your domain. How to read the XML, what each field means, and how to tell spoofing from a broken forwarder.dmarcreportsbest-practicesJun 2, 20264 min read17DMARC Rollout Playbook: p=none to p=rejectMoving from p=none to p=reject is where most DMARC projects stall. A staged, evidence-driven path to enforcement that will not block legitimate mail.dmarcdeliverabilitybest-practicesMay 26, 20266 min readrev Oct 202618Google & Yahoo Sender Requirements 2026The 2026 Yahoo & Google bulk-sender rules — SPF, DKIM, DMARC alignment, one-click unsubscribe, and the 0.3% spam-rate limit — in one checklist to confirm you comply.deliverabilitycompliancegoogle-yahooMay 12, 20264 min readrev Jul 2026
Field notes, twice a month.
When a mailbox provider changes the rules, you hear it here with the record you need to change. No digest, no roundup, no product news.
DMARC field notes, twice a month, from PlatOps Security, LLC (Gaithersburg, MD). We use your address only to send it. Unsubscribe with one click in any issue. Privacy policy.