How do I set up Jira and Jira Service Management (Atlassian) so its email passes DMARC?

What does Jira and Jira Service Management (Atlassian) ask me to publish?

Emails that are sent out using a custom email address other than the atlassian.net domain from Jira cloud can be rejected by DMARC if without a domain-specific DKIM signature.

Jira and Jira Service Management (Atlassian) prints these values in its own documentation, the same for every customer.

Jira and Jira Service Management (Atlassian) makes the other values for your account, so we do not print them here.

include:_spf.atlassian.net

Where in Jira and Jira Service Management (Atlassian) are my values shown?

Go to Atlassian Administration . Select your organization if you have more than one. Select Oganization settings , then Emails . Select the Email domains tab. Select See DNS records for the domain you want to manage.

In Atlassian Administration, select your organization, then Organization settings, then Emails, then the Email domains tab, and choose See DNS records.

Copy each value from there exactly as shown, and add each record at your DNS host.

How do I add Jira and Jira Service Management (Atlassian) to the SPF record I already have?

SPF implementations MUST limit the total number of those terms to 10 during SPF evaluation, to avoid unreasonable load on the DNS. If this limit is exceeded, the implementation MUST return "permerror".

Add include:_spf.atlassian.net inside the one SPF record you have, before its last word, and keep every service already in it. Never add a second SPF record: two make the check fail for every message.

Will p=reject block Jira and Jira Service Management (Atlassian) email?

A message satisfies the DMARC checks if at least one of the supported authentication mechanisms: 1. produces a "pass" result, and 2. produces that result based on an identifier that is in alignment

Not once Jira and Jira Service Management (Atlassian) signs your email with your domain's DKIM key. DMARC passes when a message passes DKIM or SPF for your own domain, and the DKIM records Jira and Jira Service Management (Atlassian) gives you are on your domain.

Mail sent from a custom address can be rejected under DMARC if it has no DKIM signature for your own domain.

Atlassian says to keep a single SPF record on the domain and merge any others into it.

Before you raise your policy, read your DMARC reports and check that email from Jira and Jira Service Management (Atlassian) passes.