# Fix email authentication for youtube.com

You are working on the DNS and mail configuration for youtube.com.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade B (75/100).
Report: https://www.mailauthwatch.com/check/youtube.com

## What is published right now (do not assume anything else)
- SPF (TXT youtube.com): v=spf1 include:google.com mx -all   — valid, 3 of 10 lookups
- DMARC (TXT _dmarc.youtube.com): v=DMARC1; p=reject; rua=mailto:mailauth-reports@google.com
- DKIM: no key found under 79 common selectors; revoked: selector1
- MX: smtp.google.com  → Google Workspace
- Nameservers: ns2.google.com, ns4.google.com …  → records are managed in Google Cloud DNS

## Tasks, in order of impact
### 1. The only DKIM selector found (selector1) is revoked.
Why: A selector published with an empty key tells receivers to fail any mail signed with it, and no active key was found under common selectors.
Add TXT record:
  google._domainkey.youtube.com  TXT  <value from Google Admin>   (value comes from the provider step below)
Publish a new key under an active selector:
Google Admin → Apps → Google Workspace → Gmail → Authenticate email → select the domain → Generate new record (2048-bit, selector "google").
Publish the TXT record it shows, then click "Start authentication".
Where: Cloud DNS → the zone → Add standard.

### 2. No DKIM key found under 79 common selectors.
Why: Either DKIM signing is off, or it uses a selector we did not probe. Without DKIM, forwarded mail and anything that breaks SPF fails DMARC.
Add TXT record:
  google._domainkey.youtube.com  TXT  <value from Google Admin>   (value comes from the provider step below)
Google Admin → Apps → Google Workspace → Gmail → Authenticate email → select the domain → Generate new record (2048-bit, selector "google").
Publish the TXT record it shows, then click "Start authentication".
Where: Cloud DNS → the zone → Add standard.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Google Cloud DNS or Google Workspace, stop and say exactly what access you need.

## Verify
  dig +short TXT google._domainkey.youtube.com
  dig +short TXT youtube.com
  dig +short TXT _dmarc.youtube.com
Then open https://www.mailauthwatch.com/check/youtube.com?fresh=1 and confirm:
  DKIM found. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.