# Fix email authentication for office.com

You are working on the DNS and mail configuration for office.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade D (35/100).
Report: https://www.mailauthwatch.com/check/office.com

## What is published right now (do not assume anything else)
- SPF (TXT office.com): none published
- DMARC (TXT _dmarc.office.com): v=DMARC1; p=quarantine; pct=100; rua=mailto:rua@dmarc.microsoft; ruf=mailto:ruf@dmarc.microsoft; fo=1
- DKIM: no key found under 79 common selectors
- MX: none (domain does not receive mail)
- Nameservers: ns1-05.azure-dns.com, ns2-05.azure-dns.net …  → records are managed in Azure DNS

## Tasks, in order of impact
### 1. No SPF record. Receivers cannot tell who may send as this domain.
Why: Without SPF, every message is judged on DKIM alone, and Gmail and Yahoo require at least one of the two.
Add TXT record:
  office.com  TXT  v=spf1 -all
List every service that sends mail for this domain (each provider documents its include:) before ~all.
Azure DNS CLI/API (adjust identifiers):
  az network dns record-set txt add-record -g $RESOURCE_GROUP -z office.com -n @ -v "v=spf1 -all"

### 2. No DKIM key found under 79 common selectors.
Why: Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.
Turn on DKIM signing at the mail provider and at every third-party service that sends as this domain (CRM, newsletter tool, help desk).
Publish the selector records each service shows. If DKIM is already on with a selector not in the common list, add that selector to the MailAuthWatch check instead.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Azure DNS, stop and say exactly what access you need.

## Verify
  dig +short TXT office.com
  dig +short TXT _dmarc.office.com
Then open https://www.mailauthwatch.com/check/office.com?fresh=1 and confirm:
  SPF present and valid; DKIM found. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.