What is DMARC?
Why most teams ship p=none and get stuck there, and what gets them past it. The operational guide, not the spec.
Last updated 2026-06
Email Authentication Guides
The traps the RFCs don't warn you about.
What is SPF?
The 10-lookup limit, the +all trap, and the subtle ways third-party senders break alignment. Read this before publishing.
Last updated 2026-06
What is DKIM?
Signing isn't rotation. What an actual DKIM hygiene program looks like: keys, selectors, and the failures DMARC reports surface.
Last updated 2026-06
What is BIMI?
The reward for enforcement, not a separate effort. Why BIMI requires DMARC at quarantine, and why the VMC isn't the blocker.
Last updated 2026-06
DMARC Monitoring
How DMARC aggregate and forensic reports work, and what a monitoring tool actually does for you.
SPF Flattening
When SPF flattening is the right fix for the 10-lookup limit and when it creates new problems.
Email Forwarding and DMARC
Why forwarded mail breaks SPF alignment, when DKIM survives, and why SRS and ARC are mitigations rather than magic fixes.
Last updated 2026-07
DMARC pct Rollout
A safe, staged DMARC enforcement rollout using the pct tag without nuking legitimate mail.
PCI DSS and DMARC
How PCI DSS 4.0.1 treats DMARC and what auditors actually want to see.
Microsoft 365 DMARC Setup
Custom-domain DKIM, the spf.protection.outlook.com lookup budget, and the third-party senders that break alignment under DMARC.
Last updated 2026-06
Google Workspace DMARC Setup
DKIM in the Google Admin console, the _spf.google.com lookup budget, and the SMTP relays that break alignment under Gmail's 2024 bulk-sender enforcement.
Last updated 2026-06
Microsoft Exchange (On-Premise) DMARC
On-prem Exchange signs no DKIM natively. Transport agent, smart host, or M365 hybrid routing, plus the journaling appliances that break the body hash.
Last updated 2026-06