Blog (page 2)
Insights on email authentication, deliverability and security.
190 articles, page 2 of 4
How to add DMARC, SPF and DKIM records on IONOS
A precise, IONOS-specific walkthrough of adding TXT and CNAME records for DMARC, SPF and DKIM in the IONOS DNS editor, covering the root-versus-host gotcha, TXT chunking, CNAME flattening, TTL and a safe sequence to p=reject.
Read more
Why your domain can be spoofed, and how to stop it
If you own a domain and have never published a DMARC record, anyone on the internet can send email that appears to come from you.
Read more
DMARC alignment explained, with examples
A message can pass SPF and verify DKIM yet still fail DMARC. The reason is alignment. This guide explains SPF and DKIM alignment, relaxed versus strict mode, and the exact DMARC pass rule, with five worked examples of messages that pass and fail.
Read more
How to add DMARC, SPF and DKIM records on Namecheap
A precise, Namecheap-specific walkthrough for adding DMARC, SPF and DKIM records in the Advanced DNS editor, covering the host-field gotchas, TXT chunking, CNAME targets, TTL and the safe path from p=none to p=reject.
Read more
The five DNS records that protect your email
Email was designed in an era of trust. The original protocol, SMTP, lets any server on the internet claim to send mail as anyone.
Read more
Ten common DMARC mistakes and how to avoid them
The configuration and rollout mistakes that most often break mail or leave domains exposed, from jumping straight to p=reject to ignoring report drift, and exactly how to avoid each one.
Read more
How to add DMARC, SPF and DKIM records on OVH
A precise, OVH-specific walkthrough for adding SPF, DKIM and DMARC records in the OVH DNS zone editor, covering the apex naming rule, TXT chunking for long DKIM keys, CNAME trailing dots and TTL behaviour.
Read more
Why email forwarding breaks SPF and DKIM
Email almost never travels in a straight line from sender to recipient. It gets redirected by university and corporate aliases, fanned out by mailing lists, scrubbed by security gateways, and quietly relayed by.
Read more
Reading your first DMARC aggregate report
A field-by-field walkthrough of a DMARC aggregate (RUA) XML report: metadata, source IPs, disposition, SPF and DKIM results, alignment, and spotting spoofers.
Read more
Protecting parked and no-mail domains
Domains that never send mail are the easiest to secure and the most commonly left wide open. Here is how to lock down parked, legacy and campaign domains with SPF -all, DMARC p=reject and a null MX so they cannot be spoofed, with zero deliverability risk.
Read more
How to add DMARC, SPF and DKIM records on AWS Route 53
A precise, Route 53-specific walkthrough for publishing SPF, DKIM and DMARC: empty Record name versus host names, TXT quoting and 255-character chunking, why DKIM CNAMEs must never become Alias records, and TTL strategy for a safe staged path to p=reject.
Read more
Mailing lists, DMARC and ARC
Mailing lists are one of the few places where correct, well-behaved email authentication still breaks for reasons that are nobody's fault.
Read more
DMARC for Google Workspace
A new Google Workspace domain ships with no DKIM signing, an SPF record you must add yourself, and no DMARC policy at all. This guide walks the exact order to fix that: get SPF right under the 10-lookup limit, switch on DKIM in the Admin console, then ratchet DMARC from monitoring to full reject without breaking a single legitimate message.
Read more
How to add DMARC, SPF and DKIM records on Squarespace
A precise, Squarespace-specific walkthrough of adding TXT and CNAME records for DMARC, SPF and DKIM in the Squarespace DNS editor, including the gotchas that actually break setups: the doubled-domain Host field, TXT chunking, CNAME-at-apex, SPF flattening and TTL.
Read more
Aliases, .forward files and DMARC
An alias looks like the most innocent thing in email. You point sales@yourcompany.com at three colleagues, you set up info@ to land in a shared mailbox, a member of staff configures their university address to drop.
Read more
DMARC for Microsoft 365
A practical, ordered guide to email authentication on Microsoft 365: build a complete SPF record for Exchange Online, enable DKIM signing with Microsoft's two selector CNAMEs, and walk DMARC safely from p=none through quarantine to p=reject without breaking your mail.
Read more
How to add DMARC, SPF and DKIM records on Wix
A precise, Wix-specific walkthrough of adding TXT and CNAME records for DMARC, SPF and DKIM in the Wix DNS editor, covering the real gotchas: relative host names, long-TXT chunking, CNAME targets without a trailing dot, the one-SPF-record rule and TTL during testing.
Read more
Amazon SES at scale: deliverability and DMARC
Amazon SES is deceptively easy to start with and deceptively hard to run well at volume. Verifying a domain, adding three DNS records and firing your first message takes an afternoon.
Read more
Do you actually need BIMI?
An honest decision guide to BIMI: what it really requires, what a VMC costs, the CMC alternative, the SVG Tiny PS rules, and who should skip it.
Read more
The DMARC pct tag and sampling, explained
The DMARC pct tag samples how often your policy is applied to failing mail, pushing the remainder down one level. Here is why pct=0 is a downgrade trap, how receivers actually apply the sample, and how to ramp pct safely from p=none to a full p=reject.
Read more
The BIMI selector explained
The selector is the label in front of _bimi that tells a receiver which logo record to fetch. Here is how the default._bimi lookup and the BIMI-Selector header actually work, and the real cases where you would publish a non-default selector for seasonal, multi-brand or test logos.
Read more
SendGrid dedicated IPs, authentication and reputation
Most teams reach for a SendGrid dedicated IP because someone told them shared IPs are bad, or because a deliverability vendor implied that owning your own IP is the professional thing to do.
Read more
p=none vs quarantine vs reject
The three DMARC policies compared: what p=none, p=quarantine and p=reject each tell receivers to do with failing mail, and how to progress between them safely without breaking your own email.
Read more
Bounce handling and the return-path
The envelope return-path is where bounces come back to and the domain SPF authenticates. Here is how a custom return-path on your own subdomain fixes SPF alignment under DMARC, and what really happens to a bounce.
Read more
DMARC for Mailchimp users: a deliverability checklist
If you send marketing email through Mailchimp, you sit in an awkward spot. You do not run your own mail servers, you do not control the IP addresses your campaigns go out on, and yet your From: address still says.
Read more
The DMARC record explained, tag by tag
A plain-English reference to every tag in a DMARC record: v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf and ri. What each one does, the exact syntax it expects and the sensible default to reach for.
Read more
CMC: BIMI for unregistered logos
A Common Mark Certificate lets brands without a registered trademark show a verified BIMI logo. Here is how a CMC is checked, how it differs from a VMC, and where it is accepted today.
Read more
DNSSEC and email security: what it does and does not do
DNSSEC turns up in almost every conversation about hardening email, usually as a vague recommendation: "you should enable DNSSEC". The advice is rarely wrong, but it is almost never explained.
Read more
How invoice fraud begins with a spoofed domain
Invoice fraud usually starts with a forged sender address. Here is how exact-domain spoofing works, what DMARC at p=reject stops, and what it does not.
Read more
What DMARC reports do and do not tell you
Passing DMARC is permission to be judged on your merits, not a guaranteed seat in the inbox. Here is how to read aggregate reports for exactly what they measure, identity and authentication, without mistaking a perfect pass rate for good deliverability or panicking at failures that do not matter.
Read more
Dangling DNS records as an email risk
Stale CNAMEs, SPF includes and DKIM selectors that point to resources you no longer own quietly delegate your sending authority to whoever claims them next. Here is how dangling DNS becomes a real spoofing and SPF risk, and how to find and close the gaps.
Read more
Automating DMARC, SPF and DKIM with the DMARC Engine API
Most teams start with email authentication as a one-off project: someone fixes the SPF record, publishes a DKIM key, sets a DMARC policy, and moves on.
Read more
DMARC aggregate vs forensic reports
DMARC sends two kinds of feedback: aggregate (rua) reports and forensic (ruf) reports. They answer different questions and carry very different privacy risks. This guide explains exactly what each contains, why forensic reports have all but vanished, the data-protection considerations on both sides, and how to turn the aggregate data into a safe path from p=none to p=reject.
Read more
Dedicated vs shared sending IPs
Dedicated and shared sending IPs carry very different reputation trade-offs, and the right choice hinges on sustained volume, not folklore. Here is who should use which, and how the decision changes SPF, DKIM and DMARC alignment, plus what your aggregate reports reveal.
Read more
Subdomain policy: the DMARC sp tag
An enforced root domain at p=reject protects exactly one address and can leave every subdomain spoofable. Here is what the DMARC sp tag does, the inheritance trap that catches teams mid-migration, and how to close the gap safely without bouncing legitimate subdomain mail.
Read more
Designing a logo that passes BIMI
A BIMI logo is not your website logo exported to SVG. It is a purpose-built coin: square canvas, solid background, the mark centred in a circular safe zone, and the SVG Tiny PS shell added by hand. Here is how to design one that reads clearly at avatar size and gets past the validators.
Read more
How email spoofing actually works
Email spoofing takes no password and no exploit: SMTP simply trusts whatever the sender types into the From field. This guide traces the mechanism from the raw SMTP conversation, through the crucial split between the envelope-from used for delivery and the header-from a human reads, to the three layered controls (SPF, DKIM and DMARC alignment) that finally make forging your domain fail.
Read more
DKIM canonicalisation: simple vs relaxed
The DKIM c= tag decides whether your signature survives the journey to the inbox. Here is exactly what simple and relaxed canonicalisation do to headers and body, why relaxed tolerates the reformatting that real mail servers perform, and where simple still causes intermittent body-hash failures.
Read more
Email transport security: STARTTLS, MTA-STS, DANE
DMARC proves who sent a message, but it does nothing to protect that message while it crosses the internet. Here is how opportunistic STARTTLS, MTA-STS, DANE and TLS-RPT work together to keep inbound mail encrypted in transit, why STARTTLS alone is trivially downgraded, and the safe order to deploy enforcement without bouncing legitimate mail.
Read more
DMARC external destination verification
Sending DMARC reports to an address outside your own domain is an external destination, and RFC 7489 requires the receiving domain to authorise it first. Here is exactly which DNS record to publish, where, and why reports silently vanish without it.
Read more
How to enable DKIM in Google Workspace
A step-by-step guide to enabling DKIM for a Google Workspace domain: generating a 2048-bit key in the Admin console, publishing the public key as a DNS TXT record (including the 255-byte chunking that trips people up), verifying it is live, and turning on signing safely in the right order.
Read more
Why DMARC fails when SPF and DKIM pass
SPF passes, DKIM passes, yet DMARC still fails on legitimate mail. The cause is almost always alignment: both checks authenticated a domain other than the one in your From header. Here is how to find the misaligned identifier in a single message header and across all sources in your aggregate reports, then fix each cause.
Read more
How to enable DKIM in Microsoft 365
Microsoft 365 signs your mail with a shared Microsoft domain by default, which does nothing for DMARC alignment. This guide walks through enabling DKIM signing for your own custom domain end to end: finding the exact CNAME values, publishing the two selector records, switching signing on, and verifying the result really passes.
Read more
DMARC says quarantine but mail still reaches the inbox
A quarantine policy does not always mean the spam folder. Here is why failing mail still lands in the inbox: pct sampling, alignment, receiver discretion, DNS caching, and exactly what to check.
Read more
How to fix SPF PermError
SPF PermError means a receiver tried to evaluate your SPF record and gave up, so SPF stops counting towards DMARC. This guide diagnoses PermError, TempError and the ten-lookup limit, then walks through a step by step repair process.
Read more
DMARC reporting: mailto vs https URIs
The rua and ruf tags accept both mailto: and https: URIs, but almost every working DMARC record uses mailto: only. Here is why HTTPS delivery is dead in practice, how the size-limit suffix and external destination verification work, and how analysers ingest the gzipped XML.
Read more
Why forwarding breaks email authentication
Forwarding almost always breaks SPF and sometimes breaks DKIM too. Here is what survives a forwarding hop, why DKIM is the mechanism that carries your authentication through, how DMARC's one-aligned-pass rule copes, and where ARC rescues mailing-list mail.
Read more
DMARC reports show sources I do not recognise
Unknown sending IPs in your DMARC aggregate reports are normal, not an emergency. Here is a reliable four-question triage to tell shadow IT and forwarders from real spoofers, and exactly what to do with each.
Read more