Tagged “standards”
11 articles
DNSSEC and email security: what it does and does not do
DNSSEC turns up in almost every conversation about hardening email, usually as a vague recommendation: "you should enable DNSSEC". The advice is rarely wrong, but it is almost never explained.
Read more
DKIM canonicalisation: simple vs relaxed
The DKIM c= tag decides whether your signature survives the journey to the inbox. Here is exactly what simple and relaxed canonicalisation do to headers and body, why relaxed tolerates the reformatting that real mail servers perform, and where simple still causes intermittent body-hash failures.
Read more
DMARC external destination verification
Sending DMARC reports to an address outside your own domain is an external destination, and RFC 7489 requires the receiving domain to authorise it first. Here is exactly which DNS record to publish, where, and why reports silently vanish without it.
Read more
DMARC reporting: mailto vs https URIs
The rua and ruf tags accept both mailto: and https: URIs, but almost every working DMARC record uses mailto: only. Here is why HTTPS delivery is dead in practice, how the size-limit suffix and external destination verification work, and how analysers ingest the gzipped XML.
Read more
Header-From vs envelope-from: the two From addresses
Every email carries two different From addresses: the header-from (RFC5322.From) that humans see and the envelope-from (RFC5321.MailFrom) used for bounces. SPF checks one, DMARC checks the other, and the gap between them explains alignment, forwarding breakage and spoofing.
Read more
RFC 6376: the DKIM standard explained
A line-by-line tour of the DKIM specification: how a message is signed and canonicalised, what every tag in the DKIM-Signature header means, how the public key record is published in DNS, and exactly what a verifier does on the way in.
Read more
RFC 7208: the SPF standard explained
The SPF specification in plain British English: the record format, every mechanism, the four qualifiers, the eight result codes, the 10-lookup and void-lookup limits, and the macro language. Real example records throughout, plus exactly why SPF speaks for the return-path and never the visible From.
Read more
RFC 7489: the DMARC standard explained
A close reading of RFC 7489, the document that defines DMARC: the From-header trust model, identifier alignment, the record tags, policy discovery and application, the two report types, and the clauses people consistently misread.
Read more
RFC 8461: the MTA-STS standard explained
A precise walk through RFC 8461: why server-to-server mail needed MTA-STS, the _mta-sts DNS signal, the HTTPS-hosted policy file, the none, testing and enforce modes, and exactly how a sending MTA fetches and applies a policy.
Read more
RFC 8617: the ARC standard explained
Forwarding breaks SPF alignment and DKIM signatures, so DMARC fails on mail you legitimately sent. ARC, defined in RFC 8617, lets a trusted intermediary vouch for the authentication verdict it saw before it touched the message. This is a hop-by-hop walk through the three ARC header fields, how sealing works, how chain validation runs, and what a final receiver actually does with an ARC result after forwarding.
Read more
SPF macros explained
SPF macros turn a record into a small evaluated language, substituting live transaction data like the connecting IP into DNS queries. Here is the %{...} syntax, the macro letters and modifiers, the real use cases that justify them, and the lookup-count and security trade-offs you take on when you publish one.
Read more