01DMARCbis (RFC 9989): What Changed in DMARCRFC 9989 replaced the original DMARC specification in May 2026. The pct, rf and ri tags are gone, t= and np= are standard, and the Public Suffix List is out.dmarcbest-practicesOct 4, 20264 min read02DMARC at Scale: A Playbook for MSPs Managing 50+ Client DomainsRunning DMARC across 50, 100, or 1,000 client domains is a process, not a project. A repeatable per-client SOP, multi-tenant monitoring, and how to package it as recurring MSP revenue.mspdmarcbest-practicesAug 31, 20264 min read03Forwarders & Mailing Lists: ARC, and Why Legitimate Mail Fails DMARCForwarding and mailing lists break SPF and sometimes DKIM, so your own mail can fail DMARC. What is happening, what ARC does about it, and why it is usually safe to enforce through.dmarcarcforwardingAug 17, 20264 min read04Third-Party Senders: Getting DMARC Alignment Right for Mailchimp, SendGrid & HubSpotYour ESP authenticates your mail — so why does DMARC fail? Because 'authenticated' and 'aligned to your domain' are not the same. How to fix alignment for Mailchimp, SendGrid & HubSpot.dmarcespalignmentAug 3, 20264 min read05DMARC for Healthcare: HIPAA, Email Security, and What Auditors Actually CheckHIPAA does not name DMARC, but auditors increasingly expect enforced email authentication for ePHI. How DMARC maps to the Security Rule, and how to roll it out in a clinic.compliancehealthcaredmarcJul 27, 20265 min read06DMARC Passes but Email Still Lands in SpamPassing SPF, DKIM and DMARC is the entry ticket to the inbox, not a guarantee. Why aligned mail still gets filtered, and how to find the real cause.deliverabilitydmarctroubleshootingJul 20, 20265 min read07How to Set Up SPF, DKIM & DMARC for Microsoft 365The exact SPF record, the two DKIM CNAMEs and the DMARC record Microsoft 365 needs, plus the Defender step that actually turns DKIM signing on.dmarcmicrosoft-365setupJul 13, 20265 min read08SPF, DKIM & DMARC Setup for Google WorkspaceThe exact SPF, DKIM and DMARC records Google Workspace needs, in the right order, plus the gotchas that quietly break authentication.dmarcgoogle-workspacesetupJun 30, 20265 min read09Subdomain DMARC: Why the sp= Tag MattersDoes p=reject cover your subdomains? Usually, but one tag can silently undo it. How policy inheritance works and how to lock down dormant subdomains.dmarcbest-practicessubdomainsJun 30, 20266 min read10Reading DMARC Aggregate Reports: the XMLAggregate reports show who is sending as your domain. How to read the XML, what each field means, and how to tell spoofing from a broken forwarder.dmarcreportsbest-practicesJun 2, 20264 min read11DMARC Rollout Playbook: p=none to p=rejectMoving from p=none to p=reject is where most DMARC projects stall. A staged, evidence-driven path to enforcement that will not block legitimate mail.dmarcdeliverabilitybest-practicesMay 26, 20266 min readrev Oct 2026
Field notes, twice a month.
When a mailbox provider changes the rules, you hear it here with the record you need to change. No digest, no roundup, no product news.
DMARC field notes, twice a month, from PlatOps Security, LLC (Gaithersburg, MD). We use your address only to send it. Unsubscribe with one click in any issue. Privacy policy.