# Fix email authentication for instagram.com

You are working on the DNS and mail configuration for instagram.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade A (95/100).
Report: https://www.mailauthwatch.com/check/instagram.com

## What is published right now (do not assume anything else)
- SPF (TXT instagram.com): v=spf1 include:facebookmail.com include:_spf.fb.com -all   — valid, 6 of 10 lookups
- DMARC (TXT _dmarc.instagram.com): v=DMARC1; p=reject; rua=mailto:a@dmarc.facebookmail.com; pct=100
- DKIM: smtpapi._domainkey (1024-bit)
- MX: mxa-00082601.gslb.pphosted.com, mxb-00082601.gslb.pphosted.com, mx0a-00082601.pphosted.com, mx0b-00082601.pphosted.com  → Proofpoint
- Nameservers: a.ns.instagram.com, b.ns.instagram.com …  → DNS host not recognised

## Tasks, in order of impact
### 1. One DKIM key is 1024-bit.
Why: Selector smtpapi._domainkey is under 2048 bits, which some receivers already downgrade. 
Rotate to a 2048-bit key at the sending service.

### 2. Aggregate reports are being sent to a domain that has not authorised yours.
Why: dmarc.facebookmail.com has not published instagram.com._report._dmarc.dmarc.facebookmail.com, so receivers will discard aggregate reports sent there.
Ask the report provider to publish the authorisation record, or use an address on your own domain.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access the DNS provider or Proofpoint, stop and say exactly what access you need.

## Verify
  dig +short TXT instagram.com
  dig +short TXT _dmarc.instagram.com
Then open https://www.mailauthwatch.com/check/instagram.com?fresh=1 and confirm:
  the grade is unchanged and no new issues appear. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.