01SPF Too Many DNS Lookups: Fixing the 10-Lookup LimitOne include can cost seven of SPF's ten DNS lookups. What counts toward the limit, what a permerror does to DMARC, and how to get back under it safely.deliverabilitydmarcbest-practicesOct 14, 20267 min read02DMARCbis (RFC 9989): What Changed in DMARCRFC 9989 replaced the original DMARC specification in May 2026. The pct, rf and ri tags are gone, t= and np= are standard, and the Public Suffix List is out.dmarcbest-practicesOct 4, 20264 min read03DMARC at Scale: A Playbook for MSPs Managing 50+ Client DomainsRunning DMARC across 50, 100, or 1,000 client domains is a process, not a project. A repeatable per-client SOP, multi-tenant monitoring, and how to package it as recurring MSP revenue.mspdmarcbest-practicesAug 31, 20264 min read04Forwarders & Mailing Lists: ARC, and Why Legitimate Mail Fails DMARCForwarding and mailing lists break SPF and sometimes DKIM, so your own mail can fail DMARC. What is happening, what ARC does about it, and why it is usually safe to enforce through.dmarcarcforwardingAug 17, 20264 min read05Third-Party Senders: Getting DMARC Alignment Right for Mailchimp, SendGrid & HubSpotYour ESP authenticates your mail — so why does DMARC fail? Because 'authenticated' and 'aligned to your domain' are not the same. How to fix alignment for Mailchimp, SendGrid & HubSpot.dmarcespalignmentAug 3, 20264 min read06DMARC for Healthcare: HIPAA, Email Security, and What Auditors Actually CheckHIPAA does not name DMARC, but auditors increasingly expect enforced email authentication for ePHI. How DMARC maps to the Security Rule, and how to roll it out in a clinic.compliancehealthcaredmarcJul 27, 20265 min read07DMARC Passes but Email Still Lands in SpamPassing SPF, DKIM and DMARC is the entry ticket to the inbox, not a guarantee. Why aligned mail still gets filtered, and how to find the real cause.deliverabilitydmarctroubleshootingJul 20, 20265 min read08How to Set Up SPF, DKIM & DMARC for Microsoft 365The exact SPF record, the two DKIM CNAMEs and the DMARC record Microsoft 365 needs, plus the Defender step that actually turns DKIM signing on.dmarcmicrosoft-365setupJul 13, 20265 min read09SPF, DKIM & DMARC Setup for Google WorkspaceThe exact SPF, DKIM and DMARC records Google Workspace needs, in the right order, plus the gotchas that quietly break authentication.dmarcgoogle-workspacesetupJun 30, 20265 min read10Subdomain DMARC: Why the sp= Tag MattersDoes p=reject cover your subdomains? Usually, but one tag can silently undo it. How policy inheritance works and how to lock down dormant subdomains.dmarcbest-practicessubdomainsJun 30, 20266 min read11Reading DMARC Aggregate Reports: the XMLAggregate reports show who is sending as your domain. How to read the XML, what each field means, and how to tell spoofing from a broken forwarder.dmarcreportsbest-practicesJun 2, 20264 min read12DMARC Rollout Playbook: p=none to p=rejectMoving from p=none to p=reject is where most DMARC projects stall. A staged, evidence-driven path to enforcement that will not block legitimate mail.dmarcdeliverabilitybest-practicesMay 26, 20266 min readrev Oct 2026
Field notes, twice a month.
When a mailbox provider changes the rules, you hear it here with the record you need to change. No digest, no roundup, no product news.
DMARC field notes, twice a month, from PlatOps Security, LLC (Gaithersburg, MD). We use your address only to send it. Unsubscribe with one click in any issue. Privacy policy.