Guides
Email security guides
How to stop your domain being spoofed, and make sure mail to it arrives securely.
- SPF, DKIM and DMARC explained How the three email authentication standards fit together, what each one proves, and which you need to stop people sending email as your domain.
- How to create an SPF record Build a correct SPF record step by step: find every service that sends as you, add the right includes, pick between -all and ~all, and avoid the common mistakes.
- Fixing "SPF PermError: too many DNS lookups" Why SPF stops at 10 DNS lookups, how the count is worked out across nested includes, and four ways to bring a record back under the limit.
- Moving DMARC from p=none to p=reject A safe rollout plan for DMARC: start monitoring, read the aggregate reports, fix legitimate senders, and step up to quarantine and reject without losing mail.
- What DKIM is and how to set it up How DKIM signatures work, where the public key lives in DNS, what a selector is, and how to turn DKIM on for the services that send your mail.
- How to secure a domain that sends no email Parked and website-only domains are easy targets for spoofing. Three DNS records — null MX, a deny-all SPF record and DMARC reject — lock them down.
- DMARCbis: what changed in DMARC in 2026 (RFC 9989) DMARC was revised in May 2026 as RFC 9989, 9990 and 9991. What is new, what was removed — pct, rf and ri — and what to change in your record.
- DKIM2: the next version of DKIM, explained DKIM2 is an IETF draft that chains signatures across every hop, records how intermediaries change a message, and stops DKIM replay. What it does and where it stands.
- How to set up MTA-STS and TLS-RPT Stop attackers stripping TLS from email sent to your domain. Publish an MTA-STS policy in testing mode, collect TLS-RPT reports, then enforce.