# Fix email authentication for stagewest.org

You are working on the DNS and mail configuration for stagewest.org.
Measured by MailAuthWatch on 18 Oct 2026 from public DNS. Grade B (80/100).
Report: https://www.mailauthwatch.com/check/stagewest.org

## What is published right now (do not assume anything else)
- SPF (TXT stagewest.org): v=spf1 a mx include:_spf.mlsend.com include:_spf.google.com ~all   — valid, 4 of 10 lookups
- DMARC (TXT _dmarc.stagewest.org): v=DMARC1; p=none; fo=1; rua=mailto:dmarc@stagewest.org; sp=none;
- DKIM: google._domainkey (2048-bit), litesrv._domainkey (1024-bit)
- MX: aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com, alt4.aspmx.l.google.com, alt3.aspmx.l.google.com  → Google Workspace
- Nameservers: dns4.p04.nsone.net, dns3.p04.nsone.net …  → records are managed in Squarespace Domains

## Tasks, in order of impact
### 1. DMARC is sitting at p=none.
Why: You are collecting reports and enforcing nothing, so anyone can still send as you. Gmail and Yahoo accept p=none from bulk senders, but it protects nobody.
Replace TXT record:
  _dmarc.stagewest.org  TXT  v=DMARC1; p=quarantine; pct=25; fo=1; rua=mailto:dmarc@stagewest.org; sp=none;
Only after DKIM is verified working (see the DKIM task if present). Hold for 14 days, review reports, then pct=100, then p=reject.
Where: Squarespace → Domains → DNS settings.

### 2. One DKIM key is 1024-bit.
Why: Selector litesrv._domainkey is under 2048 bits, which some receivers already downgrade. 
Rotate to a 2048-bit key at the sending service.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Squarespace Domains or Google Workspace, stop and say exactly what access you need.

## Verify
  dig +short TXT _dmarc.stagewest.org
  dig +short TXT stagewest.org
Then open https://www.mailauthwatch.com/check/stagewest.org?fresh=1 and confirm:
  DMARC p=quarantine. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.