monday.com

Email deliverability is determined almost entirely by a handful of DNS records and SMTP policies that your team controls — and the difference between getting it right and wrong is the difference between a campaign that lands in the primary inbox and one that silently disappears into the spam folder or gets rejected outright before it ever reaches a user. com.

com — every major mailbox provider uses SPF as a primary spam signal and its absence sharply increases the probability of rejection or spam-folder placement. No DKIM selector was detected. No DMARC record was found for this domain. com) TLS-RPT (failure alerts for that TLS enforcement) BIMI (brand logo displayed in the inbox) and DNSSEC (cryptographic zone integrity for everything above).

Since Gmail and Yahoo's bulk-sender requirements rolled out anyone sending more than five thousand messages a day to either provider must publish SPF DKIM and a DMARC policy of at least p=none — without all three mail is silently rejected or routed to spam before the user ever sees it.

com: a record ending in -all (hard fail) is the strictest and most protective setting; ~all (soft fail) is common during migrations but leaves room for spoofing; +all is functionally open and should never be published. com and wasn't tampered with in transit. A 2048-bit RSA key is the current practical minimum; 1024-bit keys are deprecated by most providers and some now reject them outright.

MTA-STS is not configured: without it inbound SMTP connections can be downgraded from TLS to plaintext by an attacker positioned between the sender's server and your MX host.

A grade-A email authentication configuration in 2026 combines six layers each reinforcing the others. First SPF must end in -all and resolve in ten or fewer DNS lookups — many include chains from ESP integrations and transactional providers quietly push the lookup count over the limit causing legitimate mail to soft-fail unexpectedly.

Flatten SPF includes using tools like dmarcian or MXToolbox's SPF Flattener when you are over the limit. Second DKIM must publish at least one active selector with a 2048-bit RSA key or an Ed25519 key plus a second selector staged for zero-downtime key rotation — rotating without a standby selector causes a gap during which outbound messages cannot be verified.

Third DMARC escalates over six to twelve weeks: start at p=none with aggregate reports (rua=) flowing to an address you actually read watch for legitimate senders missing from SPF or DKIM add them then move to p=quarantine and finally p=reject once the reports show no false positives for two or three consecutive weeks.

Fourth MTA-STS in enforce mode with a max-age of at least 604800 seconds eliminates SMTP TLS downgrade attacks on inbound mail. com. Sixth BIMI with a Verified Mark Certificate (VMC) from Entrust or DigiCert activates the brand logo in Gmail and Yahoo inboxes — a visible trust signal that lifts open rates in high-volume sending programmes.

Re-run this report after every DNS change — DMARC escalations new DKIM selectors and SPF include additions each benefit from a same-day re-check to confirm propagation completed correctly.

Email authentication adoption is bimodal and the gap between the two clusters is widening. Roughly 90% of active mail-sending domains now publish some form of SPF record — but fewer than half publish a syntactically valid DMARC record and only about one in five enforce p=quarantine or p=reject.

That gap is exactly where brand impersonation lives: a domain with SPF and DKIM but a DMARC policy of p=none is freely spoofable from any attacker's infrastructure because the protocol tells receivers to observe and report failures without acting on them. com in this state and it will be delivered as if it were genuine.

The domains at the top of the deliverability distribution — those landing consistently in the primary inbox at Gmail Outlook and Yahoo — share a common profile: SPF ending in -all under the ten-lookup limit DKIM with 2048-bit keys rotated on a quarterly schedule DMARC at p=reject with rua aggregate reports collected and reviewed MTA-STS in enforce mode and TLS-RPT monitoring active.

com sends any volume of transactional or marketing mail the highest-leverage sequence is: (1) fix SPF to end in -all and stay under the DNS lookup limit — flatten includes if needed; (2) sign outbound mail with DKIM using a 2048-bit key and stage a second selector for zero-downtime rotation; (3) publish DMARC at p=none with an rua address read the aggregate reports for two to four weeks to identify every legitimate sending source then escalate to p=quarantine and finally p=reject; (4) add MTA-STS in enforce mode and TLS-RPT once the core three are stable.

The entire sequence amounts to a handful of DNS records and a fortnight of aggregate-report reading — no paid infrastructure is required on the critical path. com to re-run this audit and alert when its overall score crosses your configured threshold. Review the stored result to identify DKIM DMARC SPF MX or blacklist changes.