Guides
Plain-English explainers for the DNS records behind email security — what each one does, how it's structured, and how to set it up. Each guide pairs with a free checker.
DMARC is the record that actually stops people spoofing your domain. Here's how it works and how to roll it out safely.
SPF lists the servers allowed to send email as your domain. Get it right and your mail stays out of spam; get it wrong and it can make things worse.
MTA-STS forces other servers to deliver mail to you over an encrypted connection — closing the door on downgrade attacks.
BIMI puts your brand logo next to authenticated email in the inbox — a trust signal you only earn once your authentication is solid.
DNSSEC signs your DNS so answers can't be forged in transit — protecting your mail and website from redirection.
DKIM cryptographically signs your outgoing mail so receivers can prove it's genuinely from you and wasn't tampered with.