Guides
Plain-English explainers for the DNS records behind email security — what each one does, how it's structured, and how to set it up. Each guide pairs with a free checker.
DMARC is the record that actually stops people spoofing your domain. Here's how it works and how to roll it out safely.
SPF lists the servers allowed to send email as your domain. Get it right and your mail stays out of spam; get it wrong and it can make things worse.
MTA-STS forces other servers to deliver mail to you over an encrypted connection — closing the door on downgrade attacks.
BIMI puts your brand logo next to authenticated email in the inbox — a trust signal you only earn once your authentication is solid.
DNSSEC signs your DNS so answers can't be forged in transit — protecting your mail and website from redirection.
DKIM cryptographically signs your outgoing mail so receivers can prove it's genuinely from you and wasn't tampered with.
Since 2024 the big mailbox providers enforce a baseline for senders. Here's exactly what they want and how to meet it.
Three records, three jobs. Here's what each one does, why one isn't enough, and how they work together.
The DMARC policy tag decides whether you're monitoring or actually protected. Here's how to move up safely.
The exact SPF, DKIM and DMARC steps for a Google Workspace (Gmail) domain — including the Admin console bits people miss.
The exact SPF, DKIM and DMARC steps for a Microsoft 365 domain — including the two DKIM CNAMEs Microsoft uses.
The exact SPF, DKIM and DMARC steps for a Zoho Mail domain — including the DKIM selector step in the Admin Console.
SES is a relay, so alignment is everything. Here's how to get DKIM and SPF aligned to your domain and enforce DMARC.
Mailchimp authenticates with CNAME-based DKIM aligned to your domain. Here's how to set it up so campaigns pass DMARC.
DMARC reports are how you find out who is really sending email as your domain — but providers send them as compressed XML. Here's what's inside and how to actually read it.
A single blacklisting can silently stop your email reaching inboxes. Here's how DNS blacklists work, how to check whether you're on one, and what to do if you are.