Stop guessing. Safely enforce p=reject without dropping legitimate email.

Every time marketing or support adds a tool (Google Workspace, SendGrid, Zendesk, Mailchimp), your SPF record adds nested include: statements. Once lookups exceed 10, mailbox servers return a hard PermError — treating legitimate corporate emails as spam or outright dropping them.

When your team connects Stripe for invoices, HubSpot for outreach, or Zendesk for support, these services sign emails with their own domain keys. If DKIM alignment isn't mapped to your apex domain in authoritative DNS, setting p=reject causes receiving mailboxes to drop customer receipts and invoices.

Most teams publish v=DMARC1; p=reject; and assume they are protected. But without an explicit sp=reject tag, attackers simply spoof unmanaged subdomains (e.g. security-alert.yourcompany.com). RFC 7489 allows recipient mailboxes to fall back to p=none for undeclared subdomains.