Guides

SPF, DKIM and DMARC: how email authentication actually worksA practical explanation of the three records, how they interact, and why a domain can pass SPF and still fail DMARC. Rolling out DMARC to p=reject without losing mailA staged plan for moving from no DMARC to full enforcement, and the specific checks to run before each step. SPF flattening: what it is, and why it is a last resortFlattening replaces include: chains with raw IP ranges to escape the ten-lookup limit. It works, and it introduces a new failure mode. DKIM selectors: how they work and why checkers cannot find yoursSelectors let one domain hold many DKIM keys. They also make DKIM impossible to audit from outside, which surprises people.