Tagged “dmarc” (page 3)

23 April 2026 · 12 min read

Email authentication for Zoho Mail: SPF, DKIM and DMARC

A Zoho Mail-specific guide to SPF, DKIM and DMARC: the exact Zoho SPF include, how to generate and publish DKIM selectors in the Admin Console, the return-path and alignment quirks that decide whether DMARC passes, and a safe sequence from p=none to p=reject.

20 April 2026 · 12 min read

Fix: BIMI logo not showing in Gmail

Gmail shows a grey initial instead of your BIMI logo and never says why. Here is every reason it fails, in the order Gmail checks them: DMARC not at enforcement, a missing VMC, an SVG that breaks the Tiny PS profile, a logo-to-certificate mismatch, and cached negative results, plus how to fix each.

19 April 2026 · 12 min read

Fix: DKIM fails after forwarding

Forwarders and mailing lists break DKIM by changing the message body and headers, not the connection. Here is exactly what fails, what survives, where ARC helps, how to spot forwarding failures in your DMARC reports, and how to reduce the impact without parking at p=none.

18 April 2026 · 13 min read

Fix: DKIM public key not found in DNS

The "DKIM public key not found in DNS" error is almost always a naming or publishing problem, not a broken key. Here is exactly which name receivers query, why it returns nothing, how CNAME and TXT publishing differ, and how to confirm the key resolves end to end.

17 April 2026 · 13 min read

Fix: DKIM signature did not verify

"DKIM signature did not verify" is at least six different problems wearing one error string: body hash mismatch, no key in DNS, malformed record, key mismatch after rotation, expired signature, or a key too short. Here is how to read the exact reason in the brackets and apply the one correct fix for each.

16 April 2026 · 13 min read

Fix: MTA-STS policy not found

"MTA-STS policy not found" is never one problem: it is a five-link chain (DNS TXT, HTTPS host, certificate, file path, file content) plus the MX-coverage trap, and it fails silently because senders fall back to opportunistic TLS rather than bounce. Walk the discovery the way a sending MTA does, with real dig, curl and openssl checks, and fix the first broken link.

15 April 2026 · 11 min read

Fix: multiple DMARC records

Two TXT records at _dmarc do not make DMARC stricter; they switch it off entirely, silently. Here is why RFC 7489 mandates that, the exact ways duplicates sneak into a zone, how to detect them and how to consolidate down to one correct record without losing your settings.

14 April 2026 · 11 min read

Fix: multiple SPF records

Two SPF records on one domain force a permanent PermError that silently strips a DMARC route. Here is why it happens, how receivers treat it, and how to merge two records into one compliant record without losing a sender or blowing the 10-lookup limit.

13 April 2026 · 11 min read

Fix: SPF TempError

An SPF TempError is a transient DNS failure, not a broken record. Here is what it means, why it differs from PermError, how Google, Yahoo and Microsoft treat it under SPF and DMARC, and the concrete steps that make your SPF resolution reliable.

12 April 2026 · 12 min read

Fix: SPF too many DNS lookups

SPF caps you at ten DNS-querying mechanisms, counted after every include expands into its provider's nested netblocks, which is why a record with five includes can spend fifteen lookups and PermError. Here is how to count the budget, prune the includes that overspend it, and flatten or consolidate back under the limit before enforcement makes the failure bite.

11 April 2026 · 13 min read

Free checkers vs paid DMARC platforms

Free DMARC checkers read the current state of your DNS in one lookup, and they do that job completely. Enforcement is different: getting a domain from p=none to p=reject without dropping legitimate mail is a multi-week process driven by the continuous aggregate-report stream, which no one-shot tool can ever surface. This guide draws the exact line between what free checkers do well, where they structurally stop, and what a managed platform adds, plus an honest account of who needs the paid side and who does not.

6 April 2026 · 12 min read

Header-From vs envelope-from: the two From addresses

Every email carries two different From addresses: the header-from (RFC5322.From) that humans see and the envelope-from (RFC5321.MailFrom) used for bounces. SPF checks one, DMARC checks the other, and the gap between them explains alignment, forwarding breakage and spoofing.

4 April 2026 · 12 min read

Hosted vs do-it-yourself DMARC

DIY DMARC looks free, but the real cost lives in senior time, the risk of breaking your own mail on the way to enforcement, and the monitoring tail nobody keeps up. Here is how to price hosted versus do-it-yourself honestly, and decide which your domain actually needs.

27 March 2026 · 12 min read

Relaxed vs strict DMARC alignment

DMARC does not check whether SPF or DKIM passed, it checks alignment. The aspf and adkim tags decide how exact that match must be. Here is when strict alignment is worth it, when relaxed is right, and exactly how the choice reshapes subdomain sending.

24 March 2026 · 12 min read

RFC 7489: the DMARC standard explained

A close reading of RFC 7489, the document that defines DMARC: the From-header trust model, identifier alignment, the record tags, policy discovery and application, the two report types, and the clauses people consistently misread.