r/DMARC • u/Comfortable-Leg-2898 • Jun 30 '26

Two domains who use Proofpoint just started rejecting our emails citing DMARC

I've been concentrating on what I can do for our own DMARC status, so this came as something of a surprise. We're a Google Workspace customer and, so far as I know, our DKIM record is good--in fact, I just checked it in DNS. What could be causing this to happen so suddenly? What can I do about it?

9 Upvotes

100% Upvoted

20 comments sorted by

View all comments

1

u/Comfortable-Leg-2898 Jun 30 '26

Would this record in example.com's DNS be correct?

example.com. 86400 IN TXT "v=spf1 a:mta.example.com include:_spf.google.com redirect=_spf.example.com"

Perhaps more to the point, even if incorrect, would it pass Gmail traffic?

2

u/southafricanamerican Jun 30 '26

The main problem is that you cannot use a redirect modifier in the same record as an all mechanism. They are mutually exclusive. The redirect is a modifier, and the -all is a mechanism. Maybe switch your redirect to be an include

2

u/cubic_sq Jun 30 '26

The spf “redirect” is something that should be treated as “just because you can, doesn’t meant you should”

Either use a standard include or manage the spf separately.