Notes on DMARC, email authentication and keeping domains safe from spoofing.
Every guide says a broad SPF record widens your attack surface. Almost none of them says by how much, and the arithmetic is harder than adding up the ip4 ranges. Here are the four ways a naive count lies — worked on real ESP records, resolved and counted rather than remembered.
You published the record, you pointed rua= at a mailbox, and a week later there is still nothing to read. The checks that find the cause have a natural order, and most published lists give them in no order at all. Here is the sequence — including the cause almost nobody mentions: the reports exist, and they are going to someone else.
Your first DMARC dashboard shows a wall of "fail" and the obvious question is whether someone is forging your domain. Usually not: "fail" in an aggregate report means two different things, and the alarming one is much rarer than the harmless one. Here is the rule that separates them, applied to real report rows.