Author: Jon Morby

DKIM keys are supposed to be rotated periodically. Almost nobody does it. The ones who try often break their email for a few hours doing it. There’s a correct procedure that avoids both problems, and it’s surprisingly unglamorous.

Selling DMARC monitoring to a client who’s never heard of it is one of the easiest sales conversations you can have in professional services, assuming you frame it correctly. The problem is that most agencies frame it wrong.

In October 2023, Google and Yahoo jointly announced new requirements for anyone sending more than 5,000 emails a day to their users. The rules were to take effect in February 2024. They were, at the time, the biggest change to bulk email deliverability in more than a decade.

The domain owner is baffled. Everything is “correct.” Nothing is working. Legitimate transactional mail is being rejected by receiving servers and landing in nobody’s inbox.

One rule in RFC 7208 breaks more domains than anything else in email authentication: the 10-lookup limit, how records go over it, and what actually fixes it.

11/15 of the top UK digital marketing agencies had no DMARC policy at all, three had p=none and only one had it right. If that’s the state of the agency’s email security, imagine how badly configured their clients are!

This is a productised service that any web or digital agency can start selling this week. It generates £500-1,500 per engagement, takes about 3-4 hours of actual work, and has an extremely high conversion rate from the first conversation because the value is obvious and the price is low. It also leads directly into a £50-150/month recurring monitoring service, which is where the real margin is.

Three records. Three different jobs. Most guides treat them as a checklist. This one explains what actually happens when each one fails — and why all three must work together.