# Fix email authentication for github.com

You are working on the DNS and mail configuration for github.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade A (95/100).
Report: https://www.mailauthwatch.com/check/github.com

## What is published right now (do not assume anything else)
- SPF (TXT github.com): v=spf1 ip4:192.30.252.0/22 include:spf.protection.outlook.com include:_netblocks.google.com include:_netblocks2.google.com include:mail.zendesk.com include:_spf.salesforce.com include:servers.mcsv.net include:mktomail.com include:sendgrid.net ip4:62.253.227.114 ip4:166.78.69.169 ip4:166.78.69.170 ip4:166.78.71.131 ~all   — valid, 10 of 10 lookups
- DMARC (TXT _dmarc.github.com): v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1
- DKIM: selector1._domainkey (1024-bit), google._domainkey (2048-bit), k1._domainkey (1024-bit), k2._domainkey (2048-bit), k3._domainkey (2048-bit), s1._domainkey (2048-bit), s2._domainkey (2048-bit), cm._domainkey (1024-bit), zendesk1._domainkey (2048-bit), zendesk2._domainkey (2048-bit), mailo._domainkey (1024-bit), smtpapi._domainkey (1024-bit)
- MX: github-com.mail.protection.outlook.com  → Microsoft 365
- Nameservers: dns1.p08.nsone.net, dns2.p08.nsone.net …  → records are managed in Amazon Route 53

## Tasks, in order of impact
### 1. 5 DKIM keys are 1024-bit.
Why: Selectors selector1._domainkey, k1._domainkey, cm._domainkey, mailo._domainkey, smtpapi._domainkey are under 2048 bits, which some receivers already downgrade. 
Rotate to a 2048-bit key at the sending service.

### 2. SPF uses 10 of 10 lookups. One more include breaks it.
Why: Nothing is failing yet. This is the warning you want before it does.
Trim an unused include now, or monitor so the next addition is caught the same day.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Amazon Route 53 or Microsoft 365, stop and say exactly what access you need.

## Verify
  dig +short TXT github.com
  dig +short TXT _dmarc.github.com
Then open https://www.mailauthwatch.com/check/github.com?fresh=1 and confirm:
  the grade is unchanged and no new issues appear. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.