Email authentication guides
Plain-language guides to SPF, DKIM, DMARC and the rest of the stack — what the records mean, how to check yours, and how to actually stop someone sending email as your domain.
Can someone send email as your domain? How to check.
A 5-minute check of whether you can be spoofed — reading SPF, DKIM and DMARC, and what the results mean.
Read guide →DMARC p=none vs p=reject: which policy actually protects you?
What each DMARC policy does, why "monitor only" blocks nothing, and how to reach enforcement safely.
Read guide →How to move DMARC to reject without breaking email
The staged playbook for reaching full enforcement — reporting, sender inventory, and a safe quarantine-to-reject ramp.
Read guide →How to read a DMARC aggregate (RUA) report
What the XML reports contain, how to make sense of the data, and what to look for before you enforce.
Read guide →SPF "too many DNS lookups": what it means and how to fix it
What counts toward SPF's 10-lookup limit, how to check your count, and how to fix a PermError for good.
Read guide →SPF ~all vs -all: softfail vs hardfail explained
What the qualifier at the end of your SPF record does, and whether you should use ~all or -all.
Read guide →What is MTA-STS (and TLS-RPT)?
How MTA-STS forces encryption in transit, stops downgrade attacks, and how TLS-RPT reports problems.
Read guide →What is DKIM and how does it work?
How DKIM signs your mail, where the key lives, and why it's essential for DMARC and forwarded mail.
Read guide →BIMI: your verified logo in the inbox
How BIMI puts your logo beside your emails, what it requires (DMARC + a VMC), and whether it's worth it.
Read guide →Why your emails go to spam (and how authentication fixes it)
The real reasons mail lands in junk — and why SPF, DKIM and DMARC are the foundation of reaching the inbox.
Read guide →Google & Microsoft bulk sender requirements explained
Who counts as a bulk sender, what Gmail/Yahoo/Microsoft now require, and how to comply.
Read guide →Email impersonation & BEC: how attackers send mail as you
How business email compromise works, exact-domain spoofing vs lookalikes, and what authentication does (and doesn't) stop.
Read guide →Or just have us check it for you
The free exposure scan reads your live records and shows exactly where your email authentication stands — what passes, what silently fails, and whether anyone can still send as your domain.
See if your domain can be spoofed