Symptoms#
- Messages landing in spam despite previously good placement
- Bounces mentioning policy, authentication, or reputation
- Provider dashboards showing a drop in reputation or authentication pass rate
Diagnosis steps#
- Confirm the configuration is live: query DNS from an external resolver and check the sending platform's settings page.
- Send to a seed mailbox and read the full headers, especially Authentication-Results.
- Compare the domains in From, Return-Path, and DKIM d= for alignment.
- Check provider dashboards (Google Postmaster Tools, Microsoft SNDS) for reputation and error rates.
- Review recent changes: new vendors, DNS edits, list imports, volume spikes.
Likely causes#
- Delegating the whole zone to a vendor via NS records, giving them control over more than mail.
- Forgetting sp= in DMARC, leaving delegated subdomains unenforced.
Fix and re-verify#
- List every vendor that sends as your brand.
- Assign each a subdomain and delegate DNS or publish its records directly.
- Publish SPF and DKIM per subdomain using the vendor's values.
- Set the organizational DMARC record with sp= to cover all subdomains.
Frequently asked questions#
Does using a subdomain hurt brand recognition?
The visible From can still show your brand name; recipients rarely notice the subdomain, and providers reward the isolation.