A marketing firm fixes an SPF record over the 10‑lookup limit and reads DMARC reports to find unknown senders before moving to reject
A marketing and communications firm of about 110 staff in Miami, a leader in its segment.
- Scale
- About 110 mailboxes, 2 primary domains and 6 campaign subdomains, 23 sending services found (9 expected), 1 SPF record cut from 14 lookups to 7, 3 DKIM keys per major sender
- Engagement
- Two weeks to fix SPF, then about three months in monitoring and quarantine before reject
The challenge
Over the years the firm had added every email tool a client or a campaign needed: a newsletter platform, a CRM, a survey tool, an invoicing system, an events app and the mailbox platform itself. Each one asked the firm to add an include to the SPF record, and nobody removed the old ones. SPF allows at most 10 DNS lookups while it is being evaluated (RFC 7208), and the record had reached 14, so receivers returned a permanent error and treated SPF as failed for every message. Some mail still got through on DKIM, but a client's mail filter had begun sending the firm's proposals to junk, and DMARC was published at p=none with reports going to a mailbox no one read.
Two problems hide in a record like this one. SPF has a hard limit of 10 DNS lookups, and past it a receiver may treat the record as an error, so mail fails for a reason no one sees. And DMARC at p=none only reports; it protects no one until the reports have been read and the real senders are signed and aligned.
The reports were the most useful part. They showed who was sending as the firm, including tools the firm had forgotten and a client's agency it had never approved. Moving to reject only after each of those had an owner meant the policy blocked impostors and not the firm's own marketing.
What our team delivered
- A count of the real lookups, by walking each include, redirect, a, mx and exists term, which showed 14 in total and two vendors whose records pulled in many more addresses than the firm needed. Terms that do not count (ip4 and ip6) were kept out of the tally
- A cleanup, not just a workaround: includes for six retired tools were removed, two services were moved to their own subdomains with their own SPF and DKIM so they stopped sharing the main record, and one stable address range was written as ip4 entries. The record ended at 7 lookups and ended in -all only after the rest of the work was complete, with ~all kept until then. Automatic flattening was considered and rejected for the main record because a flattened record goes stale when a vendor changes its addresses
- DMARC aggregate reports (RFC 7489) pointed to a processing service that groups them by sending source, instead of a mailbox. In the first two weeks it showed 23 sending sources, against the 9 the firm expected: a former employee's survey account, a freelancer's scheduling tool, a client's agency using the firm's domain in a campaign without telling anyone, and a webform plugin sending as the CEO
- A triage of each unknown source into authorize, move to a subdomain or stop. Each authorized sender received DKIM signing with the firm's own domain (so DMARC aligns on DKIM and does not depend on SPF alone), and the freelancer and the client's agency were given their own subdomains with a written agreement on who owns them
- A staged policy: p=none with the reports, then p=quarantine at 10 percent, then 50, then 100, each step held for at least two weeks and until the reports showed no legitimate source failing, and finally p=reject. The record's TTL was lowered before each change so a mistake could be undone in minutes
- A short owner list: who may add a sender, how it is requested and a quarterly review of the reports and the include list, so the record does not grow back
Result
After reject, aggregate reports showed 99.6 percent of the firm's legitimate mail passing DMARC, with the remainder from forwarding and mailing lists that rewrite messages, which the firm accepted and monitors. Spoofed mail using the firm's domain, which the reports had shown at about 400 messages a month from servers abroad, was rejected by receivers that enforce DMARC. The SPF record stays under the limit with room for two more services, and the proposals that had gone to junk reached the client's inbox again. Authentication does not prove that a message is honest, only that it is from the domain it claims, so the firm also kept its look-alike domain monitoring. The firm is now considering showing its logo in the inbox, which requires an enforced policy, and which our article on BIMI explains. This is an illustrative engagement that describes the kind of work our team does; details are composite.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 3 more
Email security with AI detection and DLP
Inbound and outbound protection: phishing, malware and impersonation caught by AI detection, with data loss prevention for what leaves.
Live within 7 business days
$7 per mailbox, per month
Compromised-mailbox monitoring and alerts
We watch each mailbox for signs of takeover, such as odd logins, forwarding rules and mass sending, and alert you fast.
Live within 5 business days
$4 per mailbox, per month
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Mail that keeps flowing
Incoming mail is authenticated and scanned before it reaches anyone, mailboxes are copied across three regions so a server failure goes unnoticed, and outgoing mail leaves signed and encrypted.
DMARC: from watching to rejecting
Share of mail claiming the domain that passes DMARC (SPF or DKIM aligned), week by week. In the monitoring phase (p=none) reports reveal forgotten senders; each one gets SPF and DKIM fixed. Quarantine sends failures to spam, reject refuses them at the receiving server. Illustrative figures.
A DNS change takes one TTL to settle
After you change a record, resolvers keep serving the old answer until their cached copy expires. Each cache was filled at a random moment within the last TTL, so the share still serving the old answer falls in a straight line from 100% to 0 over one TTL (the time axis is logarithmic, which bends the lines). Lower the TTL a full old-TTL before a planned change. Some resolvers ignore very low TTLs, so treat these as best case. Illustrative model.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.