Guides
How email authentication and delivery work, with DNS examples you can adapt and links to the specifications.
Email authentication
- DMARC RFC 9989: what changed and what to doWhat RFC 9989 changed in DMARC compared with RFC 7489: the DNS tree walk, new np, psd and t tags, removed pct, rf and ri, and what your record needs now.8 min read
- How DKIM works and how to find your selectorHow DKIM signs a message, what d= and s= mean, where the public key lives in DNS, which key types and sizes to use, and how to find the selector you need.6 min read
- How to configure DMARC correctlyA step-by-step DMARC rollout from p=none to p=reject, updated for RFC 9989: reports, alignment, subdomain policies and the mistakes to avoid.6 min read
- How to protect domains that never send emailLock down parked and web-only domains: SPF -all, DMARC p=reject, null MX, an optional DKIM revocation wildcard, and subdomains covered by sp and np.6 min read
- How to read DMARC aggregate reportsWhat a DMARC aggregate (rua) report contains, how to read its XML record by record, and how to turn the data into fixes for your senders and policy.7 min read
- What is SPF and how does it work?How the Sender Policy Framework decides which servers may send mail for your domain, how receivers evaluate it, and the mistakes that break it.6 min read
- DMARC alignment explained with real headersWhy SPF and DKIM can pass while DMARC fails: From vs Return-Path vs DKIM d=, relaxed and strict alignment, organizational domains and how to fix it.5 min read
- How to rotate DKIM keys without breaking mailA safe DKIM key rotation: why and how often, 2048-bit RSA keys, two selectors with an overlap period, revoking with an empty p= and provider-hosted keys.6 min read
- SPF permerror: too many DNS lookups — how to fix itWhy SPF fails with permerror when a record needs more than 10 DNS lookups, how to count them, and which fixes to apply first without breaking legitimate mail.6 min read
- SPF vs DKIM vs DMARC: what each one doesSPF, DKIM and DMARC solve different parts of email authentication. What each checks, why you need all three, and how alignment ties them together.4 min read
Deliverability
- Email bounce codes explained: SMTP and enhanced codesHow to read a bounce: SMTP reply codes and enhanced status codes, 4xx versus 5xx, what 550 5.1.1, 5.7.26 or 421 4.7.0 mean, and what to do next.7 min read
- Email list hygiene without SMTP mailbox probingWhy checking mailboxes with RCPT TO is unreliable and risky, and what keeps a list clean instead: syntax and domain checks, double opt-in, bounces, sunsetting.6 min read
- Gmail, Yahoo and Outlook.com sender requirements checklistWhat Gmail, Yahoo and Outlook.com require from senders: SPF and DKIM, aligned DMARC, one-click unsubscribe, spam rate limits, reverse DNS and TLS.7 min read
- How to warm up a new sending domain or IP addressWhy mailbox providers distrust new senders, what to set up before the first send, how to raise volume gradually and which signals to watch while you do it.8 min read
- One-click unsubscribe (RFC 8058) for developersHow to implement List-Unsubscribe and List-Unsubscribe-Post per RFC 8058: the HTTPS POST endpoint, DKIM coverage, the mailto fallback and testing.6 min read
- Why emails go to spam, and how to find out which reason appliesThe usual causes of spam-folder placement — authentication, reputation, complaints, list quality, content, infrastructure — and how to diagnose them.4 min read
Mail infrastructure
- DNS propagation: what actually happens after a changeDNS changes are not pushed anywhere: resolvers cache answers for the TTL. Why updates appear unevenly, why new records look missing and how to plan changes.7 min read
- How to set up BIMI: logo, DMARC and certificatesWhat BIMI needs before your logo appears: DMARC at enforcement, an SVG Tiny PS logo, a VMC or CMC and the default._bimi record — and what it won’t do.6 min read
- How to troubleshoot MX recordsHow MX records route incoming mail, how to look them up, and how to fix the common problems: missing records, CNAME or IP targets, dead hosts and migrations.4 min read
- Migrating email to Google Workspace or Microsoft 365How to move your domain’s email to Google Workspace or Microsoft 365 without losing messages: planning, MX, SPF, DKIM, DMARC and the coexistence period.7 min read
- MTA-STS and TLS-RPT: enforce TLS for inbound mailSet up MTA-STS and TLS-RPT step by step: the _mta-sts and _smtp._tls records, the policy file, testing vs enforce mode, and reading TLS reports.7 min read
- Null MX: declaring that a domain accepts no emailWhat a null MX record (RFC 7505) is, why it beats having no MX at all, how mail servers react to it, and how to pair it with SPF and DMARC.6 min read
- Reverse DNS (PTR) for mail serversHow reverse DNS and forward-confirmed reverse DNS work for mail servers, who sets the PTR record, what Gmail requires, and how to fix HELO and IPv6 problems.7 min read
- SMTP and STARTTLS: how mail between servers is encryptedHow mail servers encrypt delivery with STARTTLS, why opportunistic TLS can be stripped, how MTA-STS and DANE fix it, and what to check on your own MX servers.7 min read
For developers
- How to read email headers, from Received to ARCRead full email headers step by step: Received lines bottom-up, Return-Path, Authentication-Results, DKIM-Signature, ARC, spam verdicts and safe sharing.7 min read
- How to validate email addresses (and why regex isn’t enough)What the standards allow in an email address, the 64/254 length limits, quoted and internationalized addresses, and a practical strategy for web forms.6 min read
- Sending transactional email from your applicationSet up app email that reaches the inbox: a sending subdomain, aligned SPF, DKIM and DMARC, bounce and complaint handling, safe retries and testing.7 min read