Why your DMARC reports never arrive (and why Gmail can't be your rua address)There is a failure mode in DMARC that is worse than a misconfiguration, because a misconfiguration at least shows up somewhere. Your record is valid. Every checker says it's fine. And you receive nothAug 7 · 4 min readnotspoofed.hashnode.dev
Every DKIM checker is guessing — including mineAlmost every DNS record you care about can be looked up. Ask for the SPF record, you get it. Ask for _dmarc, it's there. DKIM doesn't work that way, and almost nobody building tooling around it says sAug 7 · 5 min readnotspoofed.hashnode.dev
SPF passed. DKIM passed. DMARC failed. Nothing is broken.This header block is where most people's understanding of email authentication falls apart: Authentication-Results: mx.google.com; spf=pass smtp.mailfrom=bounce@esp-vendor.net; dkim=pass header.d=Aug 6 · 5 min readnotspoofed.hashnode.dev
Your SPF record can be valid, published, and completely ignoredThere's a failure mode in SPF that produces no error anywhere you'd think to look. Your record is syntactically valid. dig returns it. Your DNS provider is happy. Your own test mail arrives fine. And Aug 3 · 6 min readnotspoofed.hashnode.dev
