Blog (page 5)
Insights on email authentication, deliverability and security.
239 articles, page 5 of 5
1024-bit vs 2048-bit DKIM keys
2048-bit DKIM is now the baseline every major mailbox provider expects, but a 2048-bit public key will not fit in a single DNS TXT string. This guide covers the real security trade-offs, the 255-byte per-string DNS limit and how chunking works, the exact way each major DNS provider wants the value entered, and how to verify the published key actually parses before you rely on it.
Read more
How to rotate DKIM keys safely
DKIM signing keys decay in security the longer they live. This guide shows how to rotate them using selectors, with full overlap and verification, so legitimate mail never drops a signature or fails DMARC during the change.
Read more
DKIM selectors explained
A DKIM selector is the label that points a receiver at the right public key. Here is what selectors are, how to read them out of a message and DNS, and how multiple selectors let you rotate keys without an outage and let many senders sign one domain.
Read more
DMARC alignment explained, with examples
A message can pass SPF and verify DKIM yet still fail DMARC. The reason is alignment. This guide explains SPF and DKIM alignment, relaxed versus strict mode, and the exact DMARC pass rule, with five worked examples of messages that pass and fail.
Read more
Ten common DMARC mistakes and how to avoid them
The configuration and rollout mistakes that most often break mail or leave domains exposed, from jumping straight to p=reject to ignoring report drift, and exactly how to avoid each one.
Read more
Protecting parked and no-mail domains
Domains that never send mail are the easiest to secure and the most commonly left wide open. Here is how to lock down parked, legacy and campaign domains with SPF -all, DMARC p=reject and a null MX so they cannot be spoofed, with zero deliverability risk.
Read more
DMARC for Google Workspace
A new Google Workspace domain ships with no DKIM signing, an SPF record you must add yourself, and no DMARC policy at all. This guide walks the exact order to fix that: get SPF right under the 10-lookup limit, switch on DKIM in the Admin console, then ratchet DMARC from monitoring to full reject without breaking a single legitimate message.
Read more
DMARC for Microsoft 365
A practical, ordered guide to email authentication on Microsoft 365: build a complete SPF record for Exchange Online, enable DKIM signing with Microsoft's two selector CNAMEs, and walk DMARC safely from p=none through quarantine to p=reject without breaking your mail.
Read more
The DMARC pct tag and sampling, explained
The pct tag was DMARC's sampling dial until RFC 9989 removed it. How legacy receivers still apply it, why pct=0 was a downgrade trap, and how to migrate off it safely.
Read more
The DMARC record explained, tag by tag
A plain-English reference to every tag in a DMARC record: v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf and ri. What each one does, the exact syntax it expects and the sensible default to reach for.
Read more
What DMARC reports do and do not tell you
Passing DMARC is permission to be judged on your merits, not a guaranteed seat in the inbox. Here is how to read aggregate reports for exactly what they measure, identity and authentication, without mistaking a perfect pass rate for good deliverability or panicking at failures that do not matter.
Read more
DMARC aggregate vs forensic reports
DMARC sends two kinds of feedback: aggregate (rua) reports and forensic (ruf) reports. They answer different questions and carry very different privacy risks. This guide explains exactly what each contains, why forensic reports have all but vanished, the data-protection considerations on both sides, and how to turn the aggregate data into a safe path from p=none to p=reject.
Read more
Subdomain policy: the DMARC sp tag
An enforced root domain at p=reject protects exactly one address and can leave every subdomain spoofable. Here is what the DMARC sp tag does, the inheritance trap that catches teams mid-migration, and how to close the gap safely without bouncing legitimate subdomain mail.
Read more
How email spoofing actually works
Email spoofing takes no password and no exploit: SMTP simply trusts whatever the sender types into the From field. This guide traces the mechanism from the raw SMTP conversation, through the crucial split between the envelope-from used for delivery and the header-from a human reads, to the three layered controls (SPF, DKIM and DMARC alignment) that finally make forging your domain fail.
Read more
Email transport security: STARTTLS, MTA-STS, DANE
DMARC proves who sent a message, but it does nothing to protect that message while it crosses the internet. Here is how opportunistic STARTTLS, MTA-STS, DANE and TLS-RPT work together to keep inbound mail encrypted in transit, why STARTTLS alone is trivially downgraded, and the safe order to deploy enforcement without bouncing legitimate mail.
Read more
How to enable DKIM in Google Workspace
A step-by-step guide to enabling DKIM for a Google Workspace domain: generating a 2048-bit key in the Admin console, publishing the public key as a DNS TXT record (including the 255-byte chunking that trips people up), verifying it is live, and turning on signing safely in the right order.
Read more
How to enable DKIM in Microsoft 365
Microsoft 365 signs your mail with a shared Microsoft domain by default, which does nothing for DMARC alignment. This guide walks through enabling DKIM signing for your own custom domain end to end: finding the exact CNAME values, publishing the two selector records, switching signing on, and verifying the result really passes.
Read more
How to fix SPF PermError
SPF PermError means a receiver tried to evaluate your SPF record and gave up, so SPF stops counting towards DMARC. This guide diagnoses PermError, TempError and the ten-lookup limit, then walks through a step by step repair process.
Read more
Why forwarding breaks email authentication
Forwarding almost always breaks SPF and sometimes breaks DKIM too. Here is what survives a forwarding hop, why DKIM is the mechanism that carries your authentication through, how DMARC's one-aligned-pass rule copes, and where ARC rescues mailing-list mail.
Read more
Lookalike and cousin domains
Attackers register confusable domains that authenticate perfectly and slip past your defences, because your DMARC policy protects only the exact name it is published under. Here is how homoglyph and cousin domains work, the precise reason a p=reject policy cannot touch them, and the layered plan that actually defends your brand.
Read more
One-click unsubscribe: the List-Unsubscribe requirement
Google, Yahoo and Microsoft now require working one-click unsubscribe on bulk mail. Here is what the List-Unsubscribe and List-Unsubscribe-Post headers are, how RFC 8058 one-click actually works on the wire, how to implement it correctly, and why it sits alongside SPF, DKIM and DMARC on the same deliverability checklist.
Read more
PCI DSS 4.0, cyber-insurance and email authentication
PCI DSS 4.0 Requirement 5.4.1 and cyber-insurance questionnaires now treat anti-phishing as a measurable control. Here is exactly how that intersects with DMARC, SPF and DKIM, what counts as evidence, and how to reach enforcement without breaking your own mail.
Read more
Phishing and business email compromise
Business email compromise rarely uses malware: it borrows trust by impersonating people you already deal with. Here is how phishing and BEC work, where the money goes, and the layered defences, with DMARC at enforcement as the load-bearing wall.
Read more
Publishing DMARC, SPF and DKIM on common DNS hosts
Exact steps to publish SPF, DMARC and DKIM on Cloudflare, GoDaddy, Namecheap and AWS Route 53, plus the two gotchas that break most setups: TXT chunking on long DKIM keys and CNAME coexistence at the apex.
Read more
How sender reputation works
Mailbox providers decide where your mail lands based on sender reputation, a private estimate built from how recipients react to your messages and how cleanly you send. This guide explains domain and IP reputation, the signals that raise and lower them, how to warm up a new sender, and why aligned SPF, DKIM and DMARC are what keep the reputation you build genuinely yours.
Read more
The 2024 and 2025 bulk-sender requirements in full
Google, Yahoo and Microsoft turned email authentication into a hard delivery gate. Here are the exact requirements, the numeric thresholds, who counts as a bulk sender, and a line-by-line compliance checklist.
Read more
Keeping your spam complaint rate under 0.3%
The spam complaint rate is the small, unforgiving number mailbox providers trust most. Learn how it is measured per provider, what pushes it past the 0.3% danger line, and the concrete steps that bring it back down.
Read more
The SPF 10-lookup limit, explained
SPF caps how much DNS work a receiver may do when evaluating your record. Go over the 10-lookup limit, or the separate void-lookup limit, and SPF returns a permerror that quietly stops helping your DMARC result. Here is how includes consume the budget, why exceeding it breaks SPF, and how to get safely back under the line.
Read more
SPF ~all vs -all vs ?all
Soft fail, hard fail, neutral and pass-all: what each SPF qualifier on the all mechanism actually instructs receivers to do, how DMARC changes the picture, and which one to publish at each stage of your rollout.
Read more
SPF flattening: what it is and when you need it
SPF flattening replaces lookup-based mechanisms with raw IP ranges to dodge the ten-lookup limit. It works, but a hand-flattened record silently goes stale. Here is what flattening really does, the trade-offs, why doing it by hand is risky, and how hosted flattening stays current automatically.
Read more
SPF records for common email providers
The correct, current SPF includes for Google Workspace, Microsoft 365, Mailchimp, SendGrid, Amazon SES and more, plus how to combine several providers in one record without breaking the 10-lookup limit.
Read more
What is BIMI and is it worth it?
BIMI puts your brand logo beside authenticated mail, but only after DMARC enforcement and, for the big providers, a paid certificate. Here is what it shows, what it costs, and an honest view of who actually benefits.
Read more
DANE and TLSA records explained
DANE pins your mail server's certificate in DNSSEC-signed TLSA records so senders refuse to deliver over a downgraded or substituted TLS connection. Here is how TLSA records work, how DNSSEC anchors the trust, how DANE compares with MTA-STS, and which one fits your domain.
Read more
What is DKIM and how does it work?
DKIM attaches a cryptographic signature to every message you send, letting receivers verify with a public key in DNS that the mail really came from your domain and was not altered. Learn how signing and verification work step by step, how to read the headers and DNS record, and why a DKIM signature survives forwarding that breaks SPF outright.
Read more
What is DMARC and how does it work?
DMARC is the control that stops exact-domain spoofing. Here is what it is, how it builds on SPF and DKIM through alignment, what each policy value instructs receivers to do, and how to reach p=reject safely.
Read more
What is MTA-STS and how does it work?
MTA-STS forces encrypted, authenticated delivery of your inbound mail. Learn how the _mta-sts DNS record and the HTTPS-hosted policy file work together, the difference between testing and enforce mode, and exactly how it stops TLS downgrade and interception attacks.
Read more
What is SPF and how does it work?
SPF lets you publish, in DNS, the list of servers allowed to send mail for your domain. Here is how the syntax works, what the all qualifier and each mechanism mean, what SPF actually authorises, the ten-lookup limit that catches everyone, and the spoofing gap that DMARC alignment closes.
Read more
What is TLS-RPT?
TLS-RPT (SMTP TLS Reporting) is a single safe-to-publish DNS record that gives you a daily, machine-readable summary of how other mail servers negotiated encryption with your inbound MX hosts. Learn what the record and its JSON reports contain, how to decode each failure type, and the exact publish-then-enforce workflow that pairs it with MTA-STS without risking an email outage.
Read more
Why legitimate email lands in spam
Real, useful email ends up in the junk folder when its signals look untrustworthy to mailbox providers. This guide breaks misfiled mail into its four root causes (authentication, reputation, content and complaints) and shows how to diagnose and fix each with concrete tools and steps, starting with the highest-leverage fix: authentication.
Read more
The Google and Yahoo sender rules, one year on
A year after Google and Yahoo made authentication mandatory for bulk senders, here is what changed, how mail failed, and where enforcement is heading.
Read more
Why p=none gives a false sense of security
A DMARC record at p=none watches your domain but blocks nothing. Here is how to tell whether you are actually protected, and the safe path to enforcement.
Read more
SPF PermError: when your SPF silently stops working
SPF breaks quietly. Cross the 10 DNS-lookup limit and your record returns PermError, fails open, and stops protecting your domain. Here is how to count, fix and flatten it safely.
Read more
Reading your first DMARC aggregate report
A field-by-field walkthrough of a DMARC aggregate (RUA) XML report: metadata, source IPs, disposition, SPF and DKIM results, alignment, and spotting spoofers.
Read more
Do you actually need BIMI?
An honest decision guide to BIMI: what it really requires, what a VMC costs, the CMC alternative, the SVG Tiny PS rules, and who should skip it.
Read more
How invoice fraud begins with a spoofed domain
Invoice fraud usually starts with a forged sender address. Here is how exact-domain spoofing works, what DMARC at p=reject stops, and what it does not.
Read more
How to reach DMARC p=reject without breaking email
The staged playbook to DMARC enforcement with no email outage: inventory senders, fix SPF and DKIM, ramp p=none to p=reject, and lock down subdomains.
Read more
Why Gmail, Yahoo and Microsoft now require DMARC
Gmail, Yahoo and Microsoft now require SPF, DKIM and DMARC from bulk senders. Here is what each demands, what "require" really means, and how to comply.
Read more