Set up DMARC with Gandi

Gandi is both a registrar and a mailbox provider. Its setup is simple, with one surprise: DKIM relies on three records, and the SPF example in Gandi’s own documentation ends with a mechanism that asserts nothing.

SPF

One TXT record for the domain:

v=spf1 include:_mailcust.gandi.net ~all

The include authorises all of Gandi’s outbound servers. Watch the ending: Gandi’s documentation shows the example with ?all, the neutral mechanism — it asserts nothing about unlisted servers and therefore protects nothing. Prefer ~all while you observe, then -all once every sender is accounted for.

DKIM

Three CNAMEs, not one:

gm1._domainkey  CNAME  gm1.gandimail.net.
gm2._domainkey  CNAME  gm2.gandimail.net.
gm3._domainkey  CNAME  gm3.gandimail.net.

The three selectors let Gandi rotate keys without interrupting signing. Publishing only one works… until the next rotation, when messages stop being verifiable with nothing having changed on your side.

DMARC

Publish the monitoring policy on _dmarc.yourdomain.com:

v=DMARC1; p=none; rua=mailto:your-address@yourdomain.com

Only tighten once every sender is identified. The progression, step by step.

Common mistakes with Gandi

• The ?all copied from the documentation. It makes the record harmless: an unlisted server is neither refused nor even flagged as suspicious.
• Only one of the three DKIM CNAMEs published. Signing holds as long as Gandi uses that particular selector.
• Domain at Gandi, DNS zone elsewhere. Gandi then cannot publish anything for you: all four records have to be copied by hand.
• A trailing dot left out of the CNAME values. Some zone editors require it, others add it; without it the target is read as relative to your domain.

Once it is in place, Clarsend reads your reports and shows you what passes, what fails, and who is sending without your knowledge.