Guides
Practical, no-nonsense guides on email authentication — written for people who have to make it actually work.
Start here
What DMARC, SPF, DKIM, BIMI and MTA-STS actually are, in plain terms.
DMARC Explained: A Simple Guide for Non-Technical Teams
What DMARC is and why it protects your company from email spoofing and CEO fraud, explained without DNS records or technical jargon — a plain-language guide for non-technical teams.
What Is DMARC? Plain-English Guide for MSPs
DMARC stops forged emails sent from your domain. See how it works, the three policy levels, and a realistic rollout timeline — explained without jargon.
What is SPF? A Complete Guide to SPF Email Authentication
Learn what SPF is, how it works, and how IT teams and MSPs can use it to protect domains from email spoofing.
What is DKIM? A Complete Guide to Email Signing for IT Teams and MSPs
Learn what DKIM is, how it cryptographically signs email, how to read a DKIM record and signature header, and how to configure, rotate and troubleshoot it correctly.
What is BIMI? A Complete Guide to Displaying Your Verified Logo in Inboxes
Learn what BIMI is, why it only works once DMARC is enforced, how to prepare a compliant SVG logo, what a VMC certificate does, and how to publish a BIMI record correctly.
What is MTA-STS? A Complete Guide to Email Transport Security and TLS Reporting
Learn what MTA-STS is, how it stops SMTP downgrade attacks, how TLS-RPT reports transport failures, and how to move from testing to enforce without breaking legitimate mail.
DMARC 101 reference
Tag-by-tag and mechanism-by-mechanism deep dives for when you need the exact details.
Every DMARC Tag Explained: p, sp, rua, ruf, adkim, aspf and More
A complete, tag-by-tag reference for DMARC DNS records: syntax, valid values, real examples, and which tags are deprecated under the current specification.
Every SPF Mechanism Explained: include, a, mx, ip4, all and More
A complete reference for SPF record mechanisms and qualifiers: syntax, DNS lookup cost for each, and how they combine into a working record.
Every DKIM Attribute Explained: Signature Header and DNS Key Tags
A complete reference for DKIM's two tag sets: the DKIM-Signature email header (v, a, d, s, h, bh, b) and the DNS public key record (v, k, p, t, h).
Alignment vs Authentication: Why SPF and DKIM Passing Isn't Enough
Why a message can pass SPF and DKIM and still fail DMARC: the difference between authentication and alignment, relaxed vs strict mode, and the organizational domain.
How to Read a DMARC Aggregate Report
A field-by-field walkthrough of a real DMARC aggregate report — what source_ip, count, and policy_evaluated mean, and how to spot a spoofing attempt.
RUA Tag: The Complete Technical Guide
Full rua= syntax, multiple addresses, third-party reporting authorization, and why DMARC enforcement without it is a mistake — the complete technical reference.
SPF PermError: Understanding the 10 DNS Lookup Limit
Why SPF fails with PermError above 10 DNS lookups, how to count them accurately, the mistakes that push you over, and how flattening fixes it.
Setup guides by provider
Configure SPF and DKIM correctly for the platform you actually send from.
SPF and DKIM for Google Workspace: Complete DNS Setup Guide
Configure SPF with include:_spf.google.com and 2048-bit DKIM in the Admin console for Google Workspace, with exact DNS record syntax and verification steps.
SPF and DKIM for Microsoft 365: Complete DNS Setup Guide
Configure SPF with include:spf.protection.outlook.com and DKIM CNAME records for Microsoft 365, with exact syntax and Defender admin center steps.
SPF and DKIM for SendGrid: Domain Authentication Setup Guide
Set up SendGrid Domain Authentication correctly: the three CNAME records it requires, what each one does, and how to verify SPF and DKIM pass.
SPF and DKIM for Amazon SES: Custom MAIL FROM and Easy DKIM Setup
Configure Amazon SES authentication: custom MAIL FROM domain with MX and SPF records, plus Easy DKIM's three CNAME records, explained step by step.
SPF and DKIM for Mailchimp: Domain Authentication Setup Guide
Set up Mailchimp domain authentication correctly: the two DKIM CNAME records and DMARC TXT record it requires, plus SPF considerations.
SPF and DKIM for Salesforce: Authenticating Your Sender Domain
Configure DKIM keys and authenticated domains in Salesforce, including the CNAME records Salesforce generates and how SPF fits alongside them.