Learn about DMARC, SPF, and DKIM

When a printer, scanner, badge system, alarm panel, ERP, PSA, or random "notification appliance" sends mail as example.com, the problem is almost never the visible From: header by itself. The problem is what happens underneath it.

DMARC only passes when the From: domain aligns with either:...

Secure email gateways sit in an awkward place in mail flow. They inspect, rewrite, wrap, detonate, banner, and sometimes re-route messages for good security reasons. But those same changes are exactly what can make SPF fail, DKIM fail, and then DMARC fail at the final receiver.

That is why admins...

If you troubleshoot mail into Microsoft 365 long enough, you eventually hit a header that makes the normal SPF, DKIM, and DMARC story feel incomplete:

Authentication-Results: ... compauth=pass reason=130

Or this one:

Authentication-Results: ... dmarc=fail action=none header.from=example.com; c...

If you set up Microsoft 365 DKIM for a custom domain from muscle memory, there is a good chance the DNS targets you expect are now wrong.

Microsoft updated the DKIM CNAME format for new custom domains in May 2025. The selectors no longer always point to the older selector1-example-com._domainke...

Yes, this really happens.

A message can leave the sender with one clean-looking authentication story, then land at Provider A with a DMARC pass and at Provider B with a DMARC fail, or with the same DMARC result but a very different final disposition. That is not necessarily evidence that one recei...

Publishing DMARC is an important milestone, but it is not the finish line for deliverability.

After SPF, DKIM, and DMARC are in place, mailbox providers still make inbox and spam decisions based on sender reputation, user complaints, list quality, traffic consistency, and overall message quality.

Microsoft 365 email authentication gets confusing faster than it should, mostly because every tenant has at least two domain stories happening at once:

• your real public domain, like example.com
• the tenant's built-in .onmicrosoft.com domain

And those two do not behave the same way.

T...