Symptoms#
- Messages landing in spam despite previously good placement
- Bounces mentioning policy, authentication, or reputation
- Provider dashboards showing a drop in reputation or authentication pass rate
Diagnosis steps#
- Confirm the configuration is live: query DNS from an external resolver and check the sending platform's settings page.
- Send to a seed mailbox and read the full headers, especially Authentication-Results.
- Compare the domains in From, Return-Path, and DKIM d= for alignment.
- Check provider dashboards (Google Postmaster Tools, Microsoft SNDS) for reputation and error rates.
- Review recent changes: new vendors, DNS edits, list imports, volume spikes.
Likely causes#
- Blaming users while leaving the domain unprotected.
- Allow-listing vendors broadly, which bypasses filtering.
Fix and re-verify#
- Enforce DMARC p=reject so exact-domain spoofing fails.
- Register lookalike domains or monitor them for registration.
- Enable link rewriting and attachment sandboxing at the gateway.
- Run quarterly simulations and make reporting a one-click action.
- Apply BIMI so users learn what authentic mail looks like.
Frequently asked questions#
Does DMARC stop all phishing?
It stops exact-domain spoofing. Lookalike domains and display-name spoofing require additional controls.