# Fix email authentication for zoom.us

You are working on the DNS and mail configuration for zoom.us.
Measured by MailAuthWatch on 17 Oct 2026 from public DNS. Grade A (100/100).
Report: https://www.mailauthwatch.com/check/zoom.us

## What is published right now (do not assume anything else)
- SPF (TXT zoom.us): v=spf1 include:%{ir}.%{v}.%{d}.spf.has.pphosted.com include:_spf.google.com include:amazonses.com ip4:52.38.191.241 include:servers.mcsv.net include:_spf.salesforce.com ip4:13.110.78.0/24 ~all   — valid, 6 of 10 lookups
- DMARC (TXT _dmarc.zoom.us): v=DMARC1;p=reject;ri=3600;rua=mailto:sesbounce@zoom.us,mailto:dmarc_rua@emaildefense.proofpoint.com;
- DKIM: google._domainkey (1024-bit), k1._domainkey (1024-bit), s1._domainkey (2048-bit), s2._domainkey (1024-bit), mx._domainkey (1024-bit), mandrill._domainkey (1024-bit), m1._domainkey (1024-bit), smtpapi._domainkey (1024-bit)
- MX: mxa-00569201.gslb.pphosted.com, mxb-00569201.gslb.pphosted.com  → Proofpoint
- Nameservers: ns-1137.awsdns-14.org, ns-1772.awsdns-29.co.uk …  → records are managed in Amazon Route 53

## Tasks, in order of impact
### 1. 7 DKIM keys are 1024-bit.
Why: Selectors google._domainkey, k1._domainkey, s2._domainkey, mx._domainkey, mandrill._domainkey, m1._domainkey, smtpapi._domainkey are under 2048 bits, which some receivers already downgrade. 
Rotate to a 2048-bit key at the sending service.

## Rules
- Publish exactly one SPF record; never add a second v=spf1 TXT.
- Do not remove any include: or ip4: you cannot account for; mail may depend on it.
- Do not set DMARC to p=reject in one step; stage through p=none → quarantine → reject.
- Show the planned DNS changes as a diff (record, old value, new value) before applying them.
- If you cannot access Amazon Route 53 or Proofpoint, stop and say exactly what access you need.

## Verify
  dig +short TXT zoom.us
  dig +short TXT _dmarc.zoom.us
Then open https://www.mailauthwatch.com/check/zoom.us?fresh=1 and confirm:
  the grade is unchanged and no new issues appear. Target grade: A.

## Report back
List each record you changed (name, type, old value, new value), what you verified, and anything you could not do.