Email Authentication
SPF, DKIM, DMARC, BIMI, MTA-STS — the protocols that prove your emails are legitimate.
2026-05-16
Office 365 DKIM Setup: The Complete Guide
Set up DKIM in Office 365 (Microsoft 365 / M365 / Exchange Online) the right way. Generate keys, publish DNS records, enable signing — with screenshots and verification steps.
2026-03-31
ARC: Solving the DMARC Problem with Email Forwarding
What ARC (Authenticated Received Chain) is, why it matters for forwarded email, and how it preserves authentication through mailing lists and forwarding services.
2026-04-01
ARC Sealing Explained: How Intermediaries Preserve Authentication
Understand ARC sealing — how mailing lists, forwarding services, and gateways preserve email authentication through the forwarding chain.
2026-04-01
BIMI on Apple Mail: How It Differs from Gmail
Apple Mail supports BIMI without requiring a VMC certificate. Learn how Apple's implementation differs from Gmail and what you need to set up.
2026-04-01
BIMI on Gmail: Requirements and Timeline
Gmail has the strictest BIMI requirements — including a VMC and registered trademark. Learn exactly what you need and the implementation timeline.
2026-04-01
What is BIMI? Complete Guide to Brand Indicators for Message Identification
BIMI displays your brand logo next to emails in supported inboxes. Learn how BIMI works, the requirements, and whether it's worth the investment.
2026-03-30
BIMI Setup Guide: Display Your Brand Logo in Email Inboxes
How to set up BIMI (Brand Indicators for Message Identification) to show your brand logo next to emails in Gmail and Apple Mail. Requirements, VMC certification, SVG format, and step-by-step implementation.
2026-04-01
BIMI SVG Tiny PS: Format Requirements and Common Rejections
Your BIMI logo must be in SVG Tiny PS format. Learn the exact requirements, common rejection reasons, and how to convert your logo correctly.
2026-04-01
BIMI Troubleshooting: Logo Not Showing
Fix common BIMI problems. Your logo isn't displaying? Diagnose DNS issues, SVG format errors, VMC validation failures, and caching delays.
2026-04-01
BIMI VMC: DigiCert vs Entrust — Which to Choose
Compare DigiCert and Entrust for BIMI Verified Mark Certificates. Pricing, validation process, and which is right for your organization.
2026-04-01
BIMI VMC: DigiCert vs Entrust — Which Certificate Authority to Choose
Compare DigiCert and Entrust for BIMI Verified Mark Certificates. Pricing, process, timeline, and which is right for your organization.
2026-04-01
BIMI Without a VMC: Which Providers Support It
You don't need a VMC for BIMI on every provider. Learn which email clients display BIMI logos without a Verified Mark Certificate and how to set up.
2026-04-01
How to Check If Your Email Authentication Is Working
Verify your SPF, DKIM, DMARC, and MTA-STS are working correctly. Free tools, manual header checks, and ongoing monitoring methods.
2026-03-31
Common SPF Mistakes That Destroy Deliverability
Avoid these SPF configuration mistakes. Learn the errors that cause permerror, authentication failures, and deliverability problems—with fixes for each.
2026-03-31
Debugging SPF Failures with dig, nslookup, and Online Tools
Diagnose SPF failures step-by-step using command-line tools and online validators. Identify permerror, softfail, and fail causes quickly.
2026-04-01
DKIM for ActiveCampaign: Setup Guide
Set up DKIM signing in ActiveCampaign with a custom sending domain. Add the CNAME record, verify authentication, and ensure DMARC alignment.
2026-03-31
DKIM Alignment in DMARC: Relaxed vs Strict Explained
Understand DKIM alignment in DMARC. Learn the difference between relaxed and strict alignment, when each matters, and how to troubleshoot alignment failures.
2026-05-16
DKIM Alignment Explained: How DMARC Uses It
DKIM alignment is the rule that DKIM's signing domain must match the From: header for DMARC to pass. Here's how relaxed vs strict alignment actually works.
2026-04-01
DKIM Body Hash Mismatch: Causes and Fixes
Diagnose and fix DKIM body hash mismatch errors. Learn what causes bh= verification failures and how to prevent them in your email pipeline.
2026-05-16
DKIM CNAME vs TXT Records: Which Should You Use?
DKIM CNAME vs TXT records compared: when each is used, ESP behavior, key rotation implications, and how to debug DKIM lookups when records don't resolve.
2026-03-31
DKIM CNAME vs TXT Record: Which to Use and Why
Choose between CNAME and TXT records for DKIM. Understand when to use each, the tradeoffs, and how to configure both correctly.
2026-04-01
Common DKIM Failures and How to Fix Them
Diagnose and fix the most common DKIM failures. From missing DNS records to key mismatches and body hash errors — every scenario with solutions.
2026-05-16
DKIM Generator: How to Create a DKIM Key (and Verify It)
A DKIM generator creates the public/private key pair needed for DKIM signing. Here's how to generate, publish, and verify DKIM records — for any ESP or self-hosted setup.
2026-04-01
DKIM for Google Workspace: Complete Setup Guide
Set up DKIM signing in Google Workspace step by step. Generate your key, add the DNS record, and verify DKIM is working for your domain.
2026-04-01
DKIM for HubSpot: Setup Guide
Set up DKIM signing in HubSpot for your email sending domain. Add the required CNAME records and verify authentication in HubSpot's settings.
2026-04-01
DKIM Key Length and DNS TXT Record Limits
Understand DKIM key length constraints and DNS TXT record size limits. Learn why 2048-bit keys sometimes fail and how to work around DNS limitations.
2026-03-31
DKIM 1024-bit vs 2048-bit: Which Key Length to Use
Choose the right DKIM key length. Understand why 2048-bit is now standard, when 1024-bit is acceptable, and how to upgrade your DKIM keys.
2026-03-31
DKIM Key Rotation: Why, When, and How
How to rotate DKIM keys safely. Why rotation matters, the recommended schedule, step-by-step process, and how to avoid breaking authentication during rotation.
2026-04-01
DKIM for Klaviyo: Setup Guide
Set up DKIM signing in Klaviyo for your custom sending domain. Add the required DNS records and verify authentication in minutes.
2026-04-01
DKIM for Mailchimp: Setup Guide
Set up DKIM authentication in Mailchimp with a custom sending domain. Add the required CNAME record and verify your domain is authenticated.
2026-04-01
DKIM for Mailgun: Setup Guide
Set up DKIM signing in Mailgun for your custom domain. Add the required TXT record, verify authentication, and confirm DKIM-signed email delivery.
2026-04-01
DKIM for Microsoft 365: Complete Setup Guide
Set up DKIM signing in Microsoft 365 (Exchange Online). Create your CNAME records, enable signing in Defender, and verify it works.
2026-04-01
DKIM for Postmark: Setup Guide
Set up DKIM signing in Postmark for your sending domain. Add the required CNAME record, verify authentication, and confirm proper DKIM signing.
2026-05-16
DKIM Selector Examples: Naming, Rotation, and Multi-Selector Setup
DKIM selector examples from real ESP configurations — naming conventions, rotation patterns, and how to run multiple selectors safely for the same domain.
2026-03-31
DKIM Selector: What It Is and How to Manage Multiple Selectors
Understand DKIM selectors and how to manage them. Learn naming conventions, key rotation, and handling multiple selectors across ESPs.
2026-04-01
DKIM for SendGrid: Setup Guide
Set up DKIM authentication in SendGrid with automated security. Add CNAME records for domain authentication and verify DKIM signing works.
2026-03-31
How to Set Up DKIM for Any ESP: Complete Guide
Set up DKIM signing for any email service provider. Step-by-step instructions for generating keys, adding DNS records, and verifying DKIM works.
2026-03-31
DKIM Signature Verification: How to Read DKIM Headers
Learn to read and verify DKIM signatures in email headers. Understand the DKIM-Signature format, authentication results, and how to diagnose failures.
2026-05-16
DMARC at 100% Reject: The Final Step
DMARC at p=reject pct=100: how to safely reach full enforcement, the validation checks you need first, and what to monitor after.
2026-05-16
Reading DMARC Aggregate Reports Like a Pro
DMARC aggregate report reading: how to parse the XML, interpret DMARC tags (adkim, aspf, p, sp, fo), and use reports to move from p=none to p=reject safely.
2026-04-01
DMARC Alignment: SPF Alignment vs DKIM Alignment
Understand DMARC alignment — how SPF and DKIM results must align with the From domain. Learn relaxed vs strict alignment and how to fix alignment failures.
2026-03-31
DMARC and Third-Party Senders: How to Authorize Safely
How to authorize third-party services (CRMs, helpdesks, billing tools) to send email as your domain without breaking DMARC. The process for discovering, authorizing, and monitoring third-party senders.
2026-04-01
The DMARC Authentication Matrix: All SPF/DKIM/DMARC Result Combinations
Every possible combination of SPF, DKIM, and DMARC results explained. Understand what each combination means and what action to take.
2026-04-01
DMARC and Email Forwarding: Why Forwarded Mail Fails
Understand why email forwarding breaks DMARC authentication. Learn how SPF fails, when DKIM survives, and how ARC solves the forwarding problem.
2026-04-01
DMARC Failures: Every Scenario and How to Fix Each One
Diagnose every type of DMARC failure. SPF alignment failures, DKIM alignment failures, forwarding issues, and policy misconfigurations — with specific fixes.
2026-03-31
DMARC for Subdomains: sp= Tag and Policy Inheritance
How DMARC applies to subdomains, the sp= tag for subdomain policy, when to use separate subdomain DMARC records, and common inheritance issues.
2026-04-01
DMARC Forensic Reports (RUF): What They Contain and Why They're Mostly Useless
Understand DMARC forensic reports (ruf=). Learn what they contain, which providers send them, and why aggregate reports are far more useful.
2026-04-01
DMARC for Google Workspace: Complete Configuration
Set up DMARC for Google Workspace domains. Configure the DNS record, align SPF and DKIM, and advance your policy safely with Workspace-specific guidance.
2026-04-01
DMARC and Mailing Lists: The Alignment Problem
Understand why mailing lists break DMARC authentication and how to handle the alignment problem with ARC, From rewriting, and policy adjustments.
2026-04-01
DMARC for Microsoft 365: Complete Configuration
Set up DMARC for Microsoft 365 domains. Configure SPF, DKIM, and DMARC together for Exchange Online with M365-specific guidance.
2026-03-31
DMARC Monitoring: Free and Paid Tools Compared
Every DMARC monitoring tool compared — dmarcian, Postmark DMARC, EasyDMARC, DMARC Analyzer, URIports. What each does, pricing, and which to choose for your situation.
2026-04-01
Why You Need DMARC Even If You Don't Send Email
Domains that don't send email still need DMARC protection. Learn why parked and non-sending domains are spoofing targets and how to lock them down.
2026-05-16
DMARC for Parked Domains (You Still Need It)
Do you need DMARC on parked or no-mail domains? Yes. Here's how to publish a defensive DMARC record on domains that never send mail to block spoofing.
2026-04-01
Why You Need DMARC Even If You Don't Send Email
Non-sending domains are prime spoofing targets. Learn why every domain needs DMARC at p=reject, even if it never sends a single email.
2026-04-01
Advancing from p=none to p=reject: The Safe Timeline
Move your DMARC policy from p=none to p=reject safely. A week-by-week timeline with checkpoints, pct ramp, and rollback plan to prevent breaking legitimate email.
2026-04-01
Advancing from p=none to p=reject: The Safe Timeline
Move your DMARC policy from p=none to p=reject safely. A week-by-week timeline with checkpoints to prevent breaking legitimate email.
2026-05-16
DMARC Setup for Office 365: Step-by-Step
Configure DMARC for Office 365 / Microsoft 365 (M365) the right way. Add the TXT record, advance from p=none to p=reject, and monitor reports. Full walkthrough.
2026-04-01
DMARC Organizational vs Relaxed Alignment
Understand DMARC organizational domain alignment. Learn how relaxed and strict alignment modes work and when to change the defaults.
2026-04-01
DMARC Organizational vs Relaxed Alignment Explained
Understand DMARC alignment modes. Learn the difference between strict and relaxed alignment for SPF and DKIM, when each matters, and how to configure them.
2026-04-01
DMARC pct Tag: Gradual Rollout Strategy
Use the DMARC pct= tag for safe, gradual policy rollout. Learn how percentage-based enforcement works and the right timeline for advancing to p=reject.
2026-03-31
DMARC Policy Levels: none vs quarantine vs reject
What each DMARC policy level does, when to use each, and the safe path from monitoring to full enforcement.
2026-03-30
How to Read DMARC Reports (And Actually Use Them)
DMARC aggregate reports are XML files that tell you everything about who's sending email as your domain. Here's how to parse them, identify unauthorized senders, and use the data to safely advance your DMARC policy.
2026-05-16
DMARC Report Parsers Compared: Free and Paid
DMARC report parser comparison: dmarcian, Postmark DMARC, EasyDMARC, Valimail, and open-source options. Pick the right parser for your scale and budget.
2026-04-01
DMARC Report Parsing Tools Compared
Compare the best DMARC report parsing and monitoring tools. Free and paid options for analyzing aggregate reports and managing your DMARC policy.
2026-03-30
How to Set Up DMARC: Step-by-Step Guide from None to Reject
Set up DMARC correctly with this step-by-step guide. Start at p=none, monitor aggregate reports, authorize all senders, and safely advance to p=reject without breaking legitimate email.
2026-05-16
Every DMARC Tag Explained: A Complete Reference
A complete reference for every DMARC tag — v, p, sp, rua, ruf, pct, adkim, aspf, fo, rf, ri — with sender-side defaults and recommendations.
2026-05-16
DNS Records for Email: The Complete Guide
Every DNS record needed for sending and receiving email — MX, SPF, DKIM, DMARC, BIMI, MTA-STS, TLS-RPT — with examples and ordering.
2026-05-16
Do I Need DMARC? (Yes, and Here's Why)
Yes, you need DMARC — the Gmail/Yahoo bulk sender rules made it mandatory at 5,000+ sends/day, and every domain benefits regardless of volume.
2026-04-01
Email Authentication Audit Checklist: Verify Everything Is Correct
A complete checklist for auditing your domain's email authentication. SPF, DKIM, DMARC, MTA-STS, BIMI — verify every record, every setting, every alignment.
2026-04-01
Email Authentication and Deliverability: The Direct Connection
Email authentication directly impacts deliverability. Understand how SPF, DKIM, and DMARC affect inbox placement, sender reputation, and provider trust.
2026-03-30
SPF, DKIM, DMARC: The Complete Email Authentication Guide
Set up SPF, DKIM, and DMARC correctly the first time. This guide covers every protocol, every configuration option, and every mistake that breaks authentication.
2026-05-16
Exchange Server DKIM Setup: On-Premises Configuration
Exchange Server doesn't sign DKIM natively. Here's how to add DKIM signing to on-prem Exchange 2016, 2019, and Subscription Edition without breaking mail flow.
2026-04-01
Email Authentication for Fastmail: Complete Setup
Configure SPF, DKIM, and DMARC for Fastmail with custom domains. DNS records, Fastmail settings, and verification steps.
2026-04-01
Email Authentication for Google Workspace: Complete Guide
Set up SPF, DKIM, DMARC, BIMI, and MTA-STS for Google Workspace. Every DNS record, every setting, one complete guide.
2026-04-01
Email Authentication for Microsoft 365: Complete Guide
Set up SPF, DKIM, DMARC, and MTA-STS for Microsoft 365. Every DNS record, Defender portal setting, and verification step in one guide.
2026-04-01
MTA-STS Hosting: Where to Host the Policy File
MTA-STS requires hosting a policy file over HTTPS. Learn your hosting options: subdomain on your server, static hosting, GitHub Pages, Cloudflare Workers, or managed services.
2026-03-31
MTA-STS Setup: Enforce TLS Encryption for Your Email
How to set up MTA-STS (Mail Transfer Agent Strict Transport Security) to enforce encrypted email delivery to your domain. DNS record, policy file, hosting, and TLS-RPT reporting.
2026-04-01
MTA-STS Testing Mode vs Enforce: When to Switch
Understand the difference between MTA-STS testing and enforce modes. Learn when it's safe to switch and what to monitor before enforcing.
2026-04-01
Email Authentication for ProtonMail Business: Complete Setup
Configure SPF, DKIM, and DMARC for Proton Mail Business with custom domains. DNS records, admin settings, and what Proton handles automatically.
2026-03-31
SPF 10 DNS Lookup Limit: What It Is and How to Fix It
Your SPF record exceeds 10 DNS lookups and is silently failing. Here's how the limit works, how to count your lookups, and three solutions: pruning, subdomain delegation, and flattening.
2026-03-31
SPF Alignment in DMARC: Relaxed vs Strict Explained
Understand SPF alignment in DMARC. Learn the difference between relaxed and strict alignment, when each matters, and how to fix alignment failures.
2026-05-16
SPF, DKIM, DMARC Explained: The Three-Letter Email Authentication Stack
SPF, DKIM, and DMARC together prove your email is legitimate. SPF lists authorized servers, DKIM signs messages cryptographically, DMARC ties them to your visible From: domain.
2026-03-30
SPF, DKIM, DMARC for Multiple Sending Services: The Architecture Guide
How to configure SPF, DKIM, and DMARC when your business uses 3-7 email sending services simultaneously. Solving the SPF 10-lookup limit, managing DKIM across ESPs, and keeping DMARC aligned.
2026-03-31
SPF and Email Forwarding: Why It Breaks and How to Fix It
Email forwarding breaks SPF authentication. Learn why forwarded mail fails SPF, how DKIM and ARC solve the problem, and how to configure for reliability.
2026-03-31
SPF Flattening: What It Is, When to Use It, and Tools
SPF flattening replaces include: mechanisms with resolved IP addresses to solve the 10-lookup limit. How it works, tools that automate it, and why subdomain delegation is usually better.
2026-03-31
SPF for Google Workspace: Complete Setup Guide
Set up SPF for Google Workspace correctly. Copy the exact DNS record, combine with other senders, and verify authentication works.
2026-05-16
SPF include vs redirect: Which to Use
SPF include vs redirect mechanisms explained: when to use each, how they differ in lookup behavior and modifier semantics, and which fits your setup.
2026-03-31
SPF Macros Explained: %{s}, %{l}, %{d}, and More
Understand SPF macros for advanced record configuration. Learn what %{s}, %{l}, %{d}, %{i}, and %{o} mean and when to use dynamic SPF records.
2026-03-31
SPF Include vs Redirect vs A vs MX: When to Use Each Mechanism
Learn when to use SPF include, redirect, a, mx, ip4, and other mechanisms. Understand the differences and build efficient SPF records.
2026-03-31
SPF for Microsoft 365: Complete Setup Guide
Set up SPF for Microsoft 365 (Office 365) correctly. Copy the exact DNS record, combine with other senders, and verify authentication.
2026-05-16
SPF With Multiple Email Providers: Combining Records Safely
How to combine SPF records when using multiple email providers (Google Workspace, SendGrid, Mailchimp) without exceeding the 10-lookup limit or breaking authentication.
2026-05-16
SPF mx Mechanism: When and Why to Use It
The SPF mx mechanism authorizes your MX hosts to send mail. When to use it, when to avoid it, and how it interacts with the 10-DNS-lookup limit.
2026-03-31
SPF Permerror: Causes and How to Fix It
Fix SPF permerror by identifying the cause—too many DNS lookups, syntax errors, or multiple records. Step-by-step diagnosis and solutions.
2026-03-31
SPF Record Examples for Every Major ESP
Copy-paste SPF records for Google Workspace, Microsoft 365, SendGrid, Mailgun, Postmark, and 20+ other email services. Ready-to-use examples.
2026-03-31
SPF Record Generator: How to Build One Manually
Build your own SPF record step-by-step. Understand the syntax, combine multiple senders, stay under the lookup limit, and avoid common mistakes.
2026-03-31
SPF Record Syntax Explained: Mechanisms, Qualifiers, and Modifiers
Every SPF record component explained. include, ip4, ip6, a, mx, exists, redirect, exp — what each means, when to use it, and how they interact.
2026-03-31
SPF Record Too Long: How to Fix It
Fix SPF records that exceed DNS limits. Reduce lookup count, flatten includes, use subdomains, or optimize mechanisms to get under the 10 lookup limit.
2026-03-31
How to Set Up SPF Records: Step-by-Step Guide
Set up SPF records correctly with this step-by-step guide. Learn the DNS syntax, authorize your email senders, and verify your SPF record works.
2026-03-31
SPF Softfail vs Hardfail vs Neutral: What Each Qualifier Means
Understand SPF qualifiers: ~all (softfail), -all (hardfail), ?all (neutral), +all (pass). Learn when to use each and how receivers handle them.
2026-03-31
SPF Void Lookups: The Hidden Limit You Don't Know About
SPF has a 2 void lookup limit in addition to the 10 DNS lookup limit. Learn what void lookups are, what causes them, and how to fix them.
2026-04-01
TLS-RPT Setup: How to Enable TLS Reporting for Your Domain
Set up TLS-RPT to receive reports about email TLS connection failures. One DNS record gives you visibility into encryption issues affecting your inbound email.
2026-04-01
What Is ARC? When and Why It Matters
ARC (Authenticated Received Chain) preserves email authentication results through forwarding. Learn what ARC does, how it works, and when it matters.
2026-04-01
What Is BIMI? Complete Guide to Brand Indicators for Message Identification
BIMI displays your brand logo next to emails in recipients' inboxes. Learn how it works, what it requires, and which providers support it.
2026-03-31
What Is DKIM? Complete Guide to DomainKeys Identified Mail
DKIM adds a cryptographic signature to your email proving it wasn't altered in transit. How it works, why it matters for DMARC, setup process, and common failures.
2026-03-31
What Is DMARC? Complete Guide for 2026
DMARC ties SPF and DKIM together and tells receiving servers what to do when authentication fails. How it works, why it's mandatory, policy levels, and reporting.
2026-04-01
What Is MTA-STS? Why Your Domain Needs It
MTA-STS forces encrypted TLS connections for inbound email, preventing downgrade attacks. Learn what it is, how it works, and why it matters.
2026-03-31
What Is SPF? Complete Guide to Sender Policy Framework
SPF (Sender Policy Framework) tells receiving servers which IPs can send email for your domain. How it works, why it matters, record syntax, common mistakes, and how to set it up.
2026-04-01
Email Authentication for Zoho Mail: Complete Setup
Configure SPF, DKIM, and DMARC for Zoho Mail. Step-by-step DNS records and Zoho Admin Console settings for full email authentication.