Email Security

Microsoft and Google DMARC Reports Ignore Syntax Errors

Alex Shakhov

February 21, 2025

Microsoft and Google reporters overlook syntax errors in the DMARC policy, continuing to deliver aggregate reports even when faced with significant syntax inaccuracies beyond the policy tag.

Get the free Email Deliverability Guide

15 rules for reaching the inbox. Used by 450+ organizations.

Download the Guide

More from the Blog

Cloudflare DNS management dashboard showing a CNAME record and a TXT record both at _dmarc, with the TXT containing v=DMARC1; p=none and the CNAME pointing to dmarc-r.dmarc.cc

Email Security

How Cloudflare DNS Silently Breaks DMARC When ESPs Auto-Deploy Through Entri

May 5, 2026

A specific combination of Cloudflare DNS, a CNAME-based DMARC delegation, and an ESP onboarding through Entri can silently bypass p=reject — leaving domains spoofable while every dashboard reports green. Here's how the conflict happens, how to detect it with dig, and how to fix it.

Terminal output of a dig query showing a production DMARC record with rua=mailto pointing to example@third-party-example.com, the unregistered domain referenced in Cloudflare's documentation.

Email Security

I Registered the Domain in Cloudflare's DMARC Documentation. Eight Other Sites Copied It.

April 30, 2026

Cloudflare's DMARC documentation instructed administrators to send aggregate reports to a domain that had never been registered. We registered it — and within days, real DMARC reports started arriving from 22 production domains. This isn't just a Cloudflare problem.

Email Security

When ESP Setup Instructions Break Your DMARC Protection

April 16, 2026

Moving to DMARC p=reject doesn't guarantee spoofing protection if your SPF record authorizes an ESP's shared IP pool. MailerLite prescribes exactly this configuration in their setup UI — and the exposure applies to every ESP that requires a root-domain include.