Mailjet lets you send before your domain is authenticated. Verifying a single sender address only proves you can receive mail at that address — it does not sign anything and does not satisfy DMARC. The setup that matters is domain-level: SPF authorisation, DKIM signing, then a policy that enforces both.
Mailjet's sending infrastructure is authorised with a single include in your SPF record:
v=spf1 include:spf.mailjet.com ~allKeep the surrounding mechanisms you already need and do not create a second v=spf1 record — two records on one name is a syntax error, and receivers treat the whole lookup as failed. Every include costs one of the 10 DNS lookups SPF allows, so check the total with the SPF Checker before adding more senders.
Start with a monitoring policy and a reporting address:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1Aggregate reports show which IPs sent as your domain. For Mailjet traffic you should see DKIM pass with your own domain in d=. If the signature carries a Mailjet domain instead, domain authentication was never completed — the sender address was verified, nothing more.
After a full week of clean reports, move to p=quarantine; pct=10, confirm the quarantined volume matches sources you recognise, then raise pct and finally move to reject. Read the XML with the DMARC Report Analyzer and confirm the published policy with the DMARC checker.
That is the classic alignment failure. Mailjet may send the envelope from its own bounce domain, so SPF passes against Mailjet while the visible From domain is yours. DKIM is what closes the gap, which is why domain authentication is not optional.
Check whether every campaign uses the same authenticated domain. A campaign sent from a different verified address, or through a subaccount with its own settings, can bypass the setup entirely.
Authentication settings apply per sending domain. Confirm the message was actually sent through the domain you authenticated rather than through a legacy stream.
No. It confirms ownership of the mailbox. DKIM signing and DMARC alignment require domain authentication.
Yes, and it is often preferable. Authenticate the subdomain, publish its own SPF and DMARC records, and keep transactional and marketing reputation separate.
No. DMARC is per-domain, not per-provider. One record governs every sender using that domain, which is exactly why every sender must be authenticated before you enforce.