The test newsletter went to spam. Not the folder you check occasionally — the folder you never check.
I’d set up email authentication before sending anything, so this felt wrong. DKIM records in place, SPF record present, DMARC policy active. Everything looked configured. “Configured” and “working” are different things, and the difference lives in the details.
What Was Actually There
A MXToolbox lookup and a DNS record check, maybe twenty minutes of work.
SPF was set to ~all. That tilde means “softfail” — if a sender doesn’t match the authorized list, the receiving server gets a suggestion to be suspicious, not an instruction. Most spam filters treat it as noise.
DMARC was set to p=none. That’s monitoring mode. It collects data about who’s sending from your domain, but it doesn’t tell receiving servers to do anything about unauthorized mail. Surveillance without enforcement.
DKIM was correctly configured. But DKIM alone can’t carry the authentication load. It proves a message was signed by your sending platform. Without a DMARC policy with teeth, that signature sits in a policy vacuum — present, verified, and ignored.
DNS authentication is a chain. DKIM proves the signature. SPF lists who’s allowed to send. DMARC tells receivers what to do when those checks fail. If any link is weak, the chain doesn’t hold — and p=none with ~all is two weak links at once.
The Fix
Hardened SPF to -all (hard fail — unauthorized senders are rejected outright, not questioned). Upgraded DMARC to p=quarantine with aggregate reporting. Applied both changes across the root domain and the sending subdomains.
Test email sent ten minutes later. Landed in inbox.
Monitoring Mode Is a Deferred Decision
p=none is the right starting point when you’re first setting up DMARC and learning what’s sending from your domain. It’s not a permanent posture.
The instinct when debugging is to ask “is it configured?” The better question is “what is it actually doing?” A p=none DMARC record is doing exactly what it says: nothing.
Every monitoring-mode setting is a deferred decision. Worth checking which ones are still sitting in your DNS.