The DDMARC Blogbest-practices
Field notes tagged best-practices
7 field notes tagged best-practices. Back to everything.
01DKIM Key Rotation: Moving to 2048-bit Keys Without Breaking MailMove DKIM from 1024-bit to 2048-bit keys without failed signatures: new selectors, split TXT strings, overlap windows, and the Google and Microsoft quirks.deliverabilitybest-practicessetupOct 14, 20268 min read02SPF Too Many DNS Lookups: Fixing the 10-Lookup LimitOne include can cost seven of SPF's ten DNS lookups. What counts toward the limit, what a permerror does to DMARC, and how to get back under it safely.deliverabilitydmarcbest-practicesOct 14, 20267 min read03DMARCbis (RFC 9989): What Changed in DMARCRFC 9989 replaced the original DMARC specification in May 2026. The pct, rf and ri tags are gone, t= and np= are standard, and the Public Suffix List is out.dmarcbest-practicesOct 4, 20264 min read04DMARC at Scale: A Playbook for MSPs Managing 50+ Client DomainsRunning DMARC across 50, 100, or 1,000 client domains is a process, not a project. A repeatable per-client SOP, multi-tenant monitoring, and how to package it as recurring MSP revenue.mspdmarcbest-practicesAug 31, 20264 min read05Subdomain DMARC: Why the sp= Tag MattersDoes p=reject cover your subdomains? Usually, but one tag can silently undo it. How policy inheritance works and how to lock down dormant subdomains.dmarcbest-practicessubdomainsJun 30, 20266 min read06Reading DMARC Aggregate Reports: the XMLAggregate reports show who is sending as your domain. How to read the XML, what each field means, and how to tell spoofing from a broken forwarder.dmarcreportsbest-practicesJun 2, 20264 min read07DMARC Rollout Playbook: p=none to p=rejectMoving from p=none to p=reject is where most DMARC projects stall. A staged, evidence-driven path to enforcement that will not block legitimate mail.dmarcdeliverabilitybest-practicesMay 26, 20266 min readrev Oct 2026
Field notes, twice a month.
When a mailbox provider changes the rules, you hear it here with the record you need to change. No digest, no roundup, no product news.
DMARC field notes, twice a month, from PlatOps Security, LLC (Gaithersburg, MD). We use your address only to send it. Unsubscribe with one click in any issue. Privacy policy.