Email Security

A mail server with no PTR record, or one that does not match forward, gets rejected before it says a word. Here is how forward-confirmed reverse DNS works.

Google and Yahoo started enforcing their bulk sender rules in 2024. The requirements are simple to list and easy to fail. Here is what still trips senders up.

One include too many and your SPF record returns permerror, which receivers treat as an SPF failure. Here is how to count your lookups and get back under ten.

Rotating a DKIM key is a publish-first, sign-later dance across two selectors. Get the order wrong and every message in flight fails authentication.

Microsoft moved SNDS to a new URL, expired automated access links after 30 days, added a REST API, and tightened JMRP. Here's what to fix in monitoring.

STARTTLS is opportunistic, so a downgrade attack can strip encryption silently. MTA-STS lets you publish a policy requiring TLS for delivery to your domain.

The DMARCbis spec is finalized as three separate RFCs. Here's what changed, what got removed, and what it means for your email authentication setup.

SPF, DKIM, and DMARC are table stakes. Inbox placement is driven by IP and domain reputation, engagement, list hygiene, and sending patterns. What matters most.

Most people set up DMARC and never look at the RUA reports. The XML is dense. Here's how to read it and use the data to tighten your policy.

TLS-RPT tells you when TLS negotiation fails between mail servers on your domain. Most organizations have never enabled it. Here's what you're missing.

SPF, DKIM, and DMARC are the three core email authentication standards. Understanding how they work together is essential for business email.

DMARC is the DNS policy layer that ties SPF and DKIM together. A short introduction to the record format, policy modes, and what publishing one actually does.