Skip to content

sign in start free

$ authentication

Authentication

SPF, DKIM, DMARC and the alignment check that decides whether the first two counted for anything.

Three gates in a row; the first two stand open, the third is closed and lit amber.

Publishing a BIMI record, and the certificate most senders do not need yet

A BIMI record is three lines of DNS and one very expensive prerequisite. What the record contains, why the SVG you already have will not work, the difference between a VMC and a CMC, and the reason most transactional senders should publish nothing at all for now.

Three gates in a row; the first two stand open, the third is closed and lit amber.

How to set up SPF, DKIM and DMARC for a sending domain, step by step

Four DNS records, published in a specific order, turn a domain from "anyone can send as this" into one that receivers can verify. Here is what each record contains, where it goes, and how to confirm it worked before you send anything real.

Three signal beams converging; two meet the target, the third misses below it.

Reading DMARC aggregate reports, and getting from p=none to p=reject

A DMARC policy at p=none protects nothing, but it is the only way to get the reports that tell you what is being sent as your domain. What is inside an aggregate report, how to read it, and the sequence that gets a domain to enforcement without losing legitimate mail.

Three signal beams converging; two meet the target, the third misses below it.

The SPF 10-lookup limit, and why your record silently fails when you cross it

SPF allows ten DNS lookups per evaluation. Every include, a, mx and redirect spends one, nested includes spend their own, and going over produces a permanent error that receivers count as a failure. How to count, what to cut, and why flattening is a maintenance debt rather than a fix.