Guides
Email authentication guides
Updated
Practical guides to DMARC, SPF, DKIM, and MTA-STS for the people who run an organisation's domains. Each one explains what the setting does, how to roll it out safely, and what to watch afterwards.
What is DMARC?
DMARC lets a domain owner tell receiving mail servers how to handle messages that claim to come from the domain but fail authentication. It also gives the owner reports on who is sending mail in the domain's name.
How to move from p=none to p=reject safely
A DMARC record at p=none reports on spoofing but does not stop it. This guide shows how to find every legitimate sender, fix alignment, and step up to p=reject without losing real mail.
SPF's 10 DNS lookup limit and how to stay under it
An SPF record may trigger at most 10 DNS lookups when it is evaluated. Go over the limit and SPF returns a permanent error instead of a pass. This guide explains what counts, what happens when you exceed it, and how to bring the count down safely.
DKIM signatures explained: what makes a signature trustworthy
A DKIM signature proves that a message was approved by the signing domain and not changed on the way. A signature that verifies is not automatically a strong one. This guide explains the signature header, the published key, alignment with the From domain, and the settings that decide whether a signature really protects your domain.
How to protect domains that do not send email
Parked, defensive and send-only domains are easy to forget and easy to spoof. This guide shows which SPF, DMARC and MX records lock them down, how to handle subdomains, and how to see whether anyone tries to use them.
MTA-STS and TLS-RPT: enforcing TLS for incoming email
MTA-STS lets you tell other mail servers to deliver email to your domain only over verified TLS. TLS-RPT sends you daily reports on how those connections went. This guide explains both and how to roll them out without losing mail.
DNSSEC for email: why your DNS records need protecting
SPF, DKIM, DMARC and MTA-STS are all published in DNS, and ordinary DNS answers can be forged. DNSSEC signs your records so that receivers can tell when an answer has been tampered with. This guide explains what DNSSEC protects, how to switch it on, and how to avoid locking yourself out.
How to read your Email Security Check report
The Email Security Check analyses one email you send to a private test address, together with your domain's public DNS. This guide walks through the report section by section: what each part asks, what a typical problem means, and what to do about it.