Solve the finding—then publish DNS you can defend.

22 October 2026

Organized by the job you need done after a static audit—not by protocol acronym. Each article maps to Sender Identity findings (stable rule ids) and to Hosted DMARC when reports or staged policy matter.

Quickstarts

Five-minute compliance paths: copy values, publish DNS, re-run the free audit.

How to configure Hosted DMARC CNAME on Cloudflare (DNS-only proxy mode)Orange-cloud must stay off on _dmarc—receivers need a real CNAME answer, not a proxied HTTP host.
Configuring SPF, DKIM, and DMARC for Google Workspace and Microsoft 365Office-suite includes, google._domainkey, selector1/selector2, then one org-domain DMARC.
Transactional email authentication: Amazon SES, SendGrid & Postmark with DMARCEasy DKIM / Domain Authentication CNAMEs without blowing the SPF 10-lookup budget.
How to safely delegate DMARC records via CNAME without modifying your root zoneOnly _dmarc changes; apex SPF and MX stay yours. Hosted DMARC publishes the TXT.

More provider checklists

Cloudflare (full mail-auth checklist)SPF, DKIM, and DMARC records in the Cloudflare DNS UI.
GoDaddyHost fields and common _domainkey mistakes.
AWS Route 53Hosted zones, alias vs CNAME, TXT quoting.
NamecheapAdvanced DNS host fields.
Alibaba Cloud DNS解析记录; keep proxy off for mail names.
Tencent Cloud DNSPod记录类型 and 主机记录.
Google Workspace (detail)Authenticate email → google._domainkey.
Microsoft 365 (detail)selector1 / selector2 and Outlook SPF.
SendGridDomain Authentication CNAMEs.
Amazon SESEasy DKIM per identity.
PostmarkDKIM and Return-Path CNAMEs.
Mailchimp / MandrillAuthenticated domain.
HubSpotEmail domain authentication.
KlaviyoBranded sending domain.

Troubleshooting & Fixes

High-intent error strings operators paste into search—and the audit finding that matches.

Fixing SPF PermError: too many DNS lookups (10-lookup limit)Finding SPF_LOOKUP_LIMIT. Flatten, drop dead includes, or split subdomains.
DMARC alignment failed: why DKIM/SPF passed but DMARC failedPass ≠ aligned. Fix From vs envelope / d= mismatch.
From p=none to p=reject: a step-by-step plan without dropping legitimate mailUse aggregate reports and Hosted DMARC stages—never jump on fear alone.
BIMI logo not showing in Gmail or Apple Mail: SVG & VMC checklistEnforcement, SVG Tiny PS, VMC, pct=100.
Deploying MTA-STS and TLS-RPT: securing in-transit email encryptionPolicy HTTPS host, DNS TXT, and Hosted MTA-STS on paid plans.
DMARC policy is still p=noneWhat monitor-only means, and when to leave it.
Gmail 550 5.7.26 authentication missingGoogle refusal when auth is absent or misaligned.
DKIM body hash did not verifyGateways that rewrite MIME after signing.

Compliance & Protocols

Enterprise checklists: bulk-sender rules, PCI DSS anti-phishing, and deeper protocol notes.

Google & Yahoo bulk sender requirements: complete 2026 audit checklistSPF, DKIM, DMARC, one-click unsubscribe, spam-rate thresholds.
PCI DSS 4.0 Requirement 5.4.1: anti-phishing & DMARC for payment domainsEvidence you can attach to ROC / SAQ narratives.
MTA-STS and TLS-RPT protocol deploy guideIn-transit encryption policy for MX hosts.
BIMI display requirementsWhen logos qualify after DMARC enforcement.
BEC: from domain protocols to executive private mailWhere DMARC stops—and when Finmail fits.

Prefer a flat error index? See Troubleshoot. Whitepaper landing page: Whitepapers.