# Fix email authentication for mailship.com

You are working on the DNS and mail configuration for mailship.com.
Measured by MailAuthWatch on 18 Oct 2026 from public DNS. Grade D (35/100).
Report: https://www.mailauthwatch.com/check/mailship.com

## What is published right now (do not assume anything else)
- SPF (TXT mailship.com): v=spf1 include:spf.protection.outlook.com -all   — valid, 1 of 10 lookups
- DMARC (TXT _dmarc.mailship.com): none published
- DKIM: no key found under 79 common selectors
- MX: mailship-com.mail.protection.outlook.com  → Microsoft 365
- Nameservers: ns-1006.awsdns-61.net, ns-1283.awsdns-32.org …  → records are managed in Amazon Route 53

## Tasks, in order of impact
### 1. No DMARC record. Nothing ties SPF and DKIM to the visible From address.
Why: Without DMARC, a passing SPF or DKIM on some other domain is enough to reach the inbox as you, and you receive no reports about who is sending as your domain.
Add TXT record:
  _dmarc.mailship.com  TXT  v=DMARC1; p=none; rua=mailto:dmarc@mailship.com
Start at p=none to collect reports. After 2 to 4 weeks of reports showing legitimate mail aligned, move to p=quarantine, then p=reject.
Amazon Route 53 CLI/API (adjust identifiers):
  aws route53 change-resource-record-sets --hosted-zone-id $ZONE_ID --change-batch '{"Changes":[{"Action":"UPSERT","ResourceRecordSet":{"Name":"_dmarc.mailship.com.","Type":"TXT","TTL":3600,"ResourceRecords":[{"Value":"\"v=DMARC1; p=none; rua=mailto:dmarc@mailship.com\""}]}}]}'

### 2. No DKIM key found under 79 common selectors.
Why: Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.
Add CNAME record:
  selector1._domainkey.mailship.com  CNAME  selector1-mailship-com._domainkey.<tenant>.onmicrosoft.com   (value comes from the provider step below)
Add CNAME record:
  selector2._domainkey.mailship.com  CNAME  selector2-mailship-com._domainkey.<tenant>.onmicrosoft.com   (value comes from the provider step below)
Microsoft 365 Defender → Email & collaboration → Policies & rules → Threat policies → DKIM → select the domain → Create DKIM keys.
Publish the two CNAME records it shows, then return and turn signing on.
Where: Route 53 console → Hosted zones → the zone → Create record.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Amazon Route 53 or Microsoft 365, stop and say exactly what access you need.

## Verify
  dig +short TXT _dmarc.mailship.com
  dig +short CNAME selector1._domainkey.mailship.com
  dig +short CNAME selector2._domainkey.mailship.com
  dig +short TXT mailship.com
Then open https://www.mailauthwatch.com/check/mailship.com?fresh=1 and confirm:
  DKIM found; DMARC present. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.