# Fix email authentication for gandi.net

You are working on the DNS and mail configuration for gandi.net.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade C (55/100).
Report: https://www.mailauthwatch.com/check/gandi.net

## What is published right now (do not assume anything else)
- SPF (TXT gandi.net): v=spf1 include:_spf.gandi.net -all   — valid, 2 of 10 lookups
- DMARC (TXT _dmarc.gandi.net): v=DMARC1; p=none; rua=mailto:dmarc@gandi.net
- DKIM: no key found under 79 common selectors
- MX: mail12.gandi.net, mail8.gandi.net  → a custom mail host
- Nameservers: e.gandi-ns.fr, dns3.gandi.net …  → records are managed in Gandi

## Tasks, in order of impact
### 1. No DKIM key found under 79 common selectors.
Why: Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.
Turn on DKIM signing at the mail provider and at every third-party service that sends as this domain (CRM, newsletter tool, help desk).
Publish the selector records each service shows. If DKIM is already on with a selector not in the common list, add that selector to the MailAuthWatch check instead.

### 2. DMARC is sitting at p=none.
Why: You are collecting reports and enforcing nothing, so anyone can still send as you. Gmail and Yahoo accept p=none from bulk senders, but it protects nobody.
Replace TXT record:
  _dmarc.gandi.net  TXT  v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@gandi.net
Only after DKIM is verified working (see the DKIM task if present). Hold for 14 days, review reports, then pct=100, then p=reject.
Where: Gandi → Domain → DNS Records.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Gandi, stop and say exactly what access you need.

## Verify
  dig +short TXT _dmarc.gandi.net
  dig +short TXT gandi.net
Then open https://www.mailauthwatch.com/check/gandi.net?fresh=1 and confirm:
  DKIM found; DMARC p=quarantine. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.