For outbound agencies

14% of outbound agencies can't authenticate their own mail.

We scanned 99. Fourteen are losing mail right now and don't know it. We find it, fix it, and stay behind your brand.

Get a free teardown See the data ↓
9 can't authenticate 5 partial failure 63 weak, delivering 22 clean

99 AGENCY SENDING DOMAINS · SEPT 2026 · ONE SQUARE EACH

14.1%have a live authentication defect
9can't authenticate mail at all
76.8%send through Google Workspace
13on Microsoft 365 — throttled from this month

The scan

Fourteen in ninety‑nine.

Public DNS records only — nothing touched a server. Resolver timeouts were counted as unknown, never as failures. That is why this reads 14%, not 54%.

Live defect — 14 (14.1%) Weak, delivering — 63 (63.6%) Clean or unmeasured — 22 (22.2%) 14.1% 14 OF 99
Live defect — losing mail today14
Weak — delivering, worth fixing63
Clean or unmeasured22

Where it breaks

Four defects. Almost all of the fourteen.

SPF · RFC 7208 §4.6.4

More than 10 lookups

v=spf1 include:… ×11 → permerror

Fails silently — only for whichever tool was added last. Usually the cold-email one.

SPF · RFC 7208 §3.2

Two SPF records

2 × "v=spf1 …" → permerror

Not additive. Both senders fail. Happens when a new tool is added instead of merged.

DMARC · RFC 7489 §6.3

No reporting address

p=none; (no rua)

Enforces nothing, reports nothing. The most common record in the corpus.

DMARC · RFC 7489 §6.3

No subdomain policy

p=reject; (sp absent)

Parent policy inherits down. An unsigned sending subdomain gets rejected by its own domain.

Why now

Receivers stopped forgiving. Then stopped telling you.

FEB 2024
Google & Yahoo bulk rules
SPF, DKIM, DMARC required above 5k/day.
MAY 2025
Microsoft rejects, not junks
550 5.7.515 — mail no longer lands in spam. It doesn't land.
SEP 2025
Google hides reputation
Postmaster dashboards removed. Self-diagnosis gone.
NOV 2025
Gmail: permanent rejects
5.7.x failures. No retry, no queue.
SEP 2026 · NOW
M365 throttles new tenants
10% of quota for 30 days. Trials 5,000 → 500/day. 550 5.7.233

Provider mix

Thirteen of them are on Microsoft 365.

A fresh tenant spun up for a client this month is capped at 10% of its sending quota. The only visible symptom is a volume number that won't move.

Throttled from Sept 2026  MC1454397

What we do

Three things, in this order.

01

Teardown

Free

Your sending domains and your clients'. Findings with the records and the RFC. No call required.

02

Fix

Fixed fee, quoted from the teardown

SPF flattened. DKIM to 2048-bit. DMARC enforced with reporting live. Verified with real headers.

03

White‑label

Monthly, under your brand

Infrastructure and monitoring for your whole client book, delivered as your team.

We work behind agencies, not in front of them.

No campaigns for end clients. No lead gen. No reason to ever contact your list. Your clients stay yours.

Send us one domain.

You get the teardown back whether or not anything is wrong with it. No form, no sequence.

Send a domain →