SPF passes, DKIM passes, DMARC still fails: build an email and see why

An explorable lesson on email authentication. Flip the envelope sender, the DKIM signing domain and the alignment mode, guess six cases, and break the SPF 10-lookup limit. Built from RFC 7489, 7208 and 6376 and Microsoft's Outlook.com sender rules, with the unconfirmed Nov 2026 rejection report labelled as such.