SPF, DKIM and DMARC: fix authentication without promising inbox placement

Inventory who really sends for the domain

Include normal staff email, the website, invoicing systems, support tools and approved marketing services. A domain can have legitimate senders that its owner forgot about. Editing authentication for only the main mailbox host can disrupt those other flows.

• Keep the sending service and intended From domain for each flow.
• Inspect a redacted received test message's Authentication-Results.
• Do not send a full customer email or private message body for diagnosis.

Understand what each mechanism checks

SPF identifies authorised sending sources for the envelope MAIL FROM domain; it does not by itself validate the visible From domain. DKIM verifies signed message elements using a signing domain. DMARC checks alignment with the visible From domain through the qualifying authentication result and supplies policy and reporting. A bare SPF pass or DKIM pass is therefore not enough to infer aligned DMARC success.

• Use the provider's actual DNS values, not copied generic records.
• Check both direct and important forwarded paths.
• Treat reports as sensitive operational data.

Do not enforce a policy against unidentified senders

A stricter DMARC policy can affect legitimate mail if sender inventory and alignment are incomplete. Have the account holder review reports and test the important sources before enforcing the agreed policy. Forwarding and message modification complicate authentication; Microsoft documents ARC and other controls for specific situations, not a universal instruction to bypass checks.

• Preserve the previous records and authorised rollback plan.
• Avoid a blanket allowlist as an unexplained repair.

What success does and does not mean

The agreed synthetic messages should show the intended authentication and alignment results for named sources. Microsoft explicitly says authenticated mail is not guaranteed delivery: reputation, content and recipient filtering still matter. Request authentication repair with providers and redacted header results, not a promise that every future message reaches the inbox.