The authserv_id pin now matches the topmost Authentication-Results host exactly; main also accepted a subdomain of the pin. Operators who pinned a parent domain for a provider that stamps from changing MX hostnames would see every message dropped with no guidance (gate 2c Medium finding).