Blog

DMARC, explained without the jargon

Practical guides to stopping email impersonation and getting your domain to full enforcement. Written for the person responsible, not for specialists.

October 3, 2026 Google Workspace

How to set up DMARC for Google Workspace

Set up SPF, DKIM and DMARC for a Google Workspace domain: the SPF record, generating a 2048-bit DKIM key in the Admin console, timing, and the DMARC record.

October 3, 2026 Microsoft 365

How to set up DMARC for Microsoft 365

Set up SPF, DKIM and DMARC for a Microsoft 365 domain: the exact records, where to turn on DKIM, the onmicrosoft.com domain, and how Microsoft treats p=reject.

October 3, 2026 Reporting

Why your DMARC reports are not arriving, and how to check

A reporting service only gets your DMARC reports if it has authorized your domain in DNS. Without it, reports vanish silently. How to check, and how to fix it.

October 3, 2026 Standards

Gmail, Yahoo and Outlook sender requirements: what you need

Gmail, Yahoo and Outlook.com now require SPF, DKIM and DMARC from bulk senders, and reject mail that falls short. The rules side by side, and what to do.

October 3, 2026 DKIM

How to find your DKIM selector

Every DKIM key lives at a selector, and DNS will not list them. How to read it from a message header, plus verified selectors for 14 common email providers.

October 3, 2026 MTA-STS

MTA-STS and TLS-RPT explained: encrypting the mail sent to you

DMARC protects who can send as you. MTA-STS protects mail on its way to you. What MTA-STS and TLS-RPT do, and how to roll them out without losing mail.

August 12, 2026 BIMI

BIMI and your logo in the inbox: what you get after p=reject

BIMI puts your verified logo next to your emails, but only once DMARC is enforced. What BIMI and a VMC are, and why they are the visible payoff for getting DMARC right.

July 29, 2026 Subdomains

DMARC for subdomains and domains that do not send email

The sp and np tags, and why a domain that sends no mail still needs DMARC. How to lock down subdomains and parked domains so nobody can spoof them.

July 15, 2026 Troubleshooting

When DMARC breaks legitimate mail: forwarding, mailing lists and third-party senders

Why forwarding, mailing lists and outside senders fail DMARC alignment, what aggregate reports reveal about each, and how to fix them without loosening your policy.

July 1, 2026 SPF

Fixing too many DNS lookups: the SPF 10-lookup limit

SPF caps you at 10 DNS lookups, 2 void lookups and 255 characters per string. Cross the line and SPF fails. How to spot it, and how to fix it without breaking mail.

June 17, 2026 Standards

The DNS Tree Walk in DMARCbis, and what it means for your subdomains

DMARCbis swaps the Public Suffix List for a DNS Tree Walk to find your policy, capped at eight queries. What that changes, and why your subdomains need their own records.

June 3, 2026 Standards

DMARCbis is here: what RFC 9989 changes and what it does not

DMARCbis published in May 2026 as RFC 9989, 9990 and 9991, replacing RFC 7489. What actually changes for your records, and why there is nothing to panic about.

May 6, 2026 Service

Doing DMARC yourself vs using a service: what you actually save

An honest look at DMARC by hand versus a monitoring service, across reading reports, spotting alignment failures, deciding when to tighten, and time cost.

April 22, 2026 Rollout

Why most DMARC projects stall at p=none, and how to get unstuck

DMARC projects rarely fail loudly. They stall quietly at p=none because nobody parses the reports or owns the next step. Here is why, and how to fix it.

April 8, 2026 Reporting

How to read a DMARC aggregate report, and why raw XML is painful

What is inside a DMARC aggregate report, how to read pass and fail by sending source, and why doing this by hand across dozens of receivers does not scale.

March 25, 2026 Rollout

From p=quarantine to p=reject without blocking real mail

How to tighten a DMARC policy in stages: move to p=quarantine, watch the reports, use t=y to test, and only reach p=reject once nothing legitimate is failing.

March 11, 2026 Alignment

Get SPF and DKIM aligned so DMARC passes

A practical guide to making your return-path and DKIM signing domain match your visible From address, with the common alignment breakers and the fix for each.

February 25, 2026 Rollout

Start with p=none: audit your email before you enforce

Before you block a single message, publish p=none and collect a few weeks of DMARC reports. Here is what p=none does, and what the first reports tell you.

February 11, 2026 Alignment

What DMARC alignment really means

Why SPF or DKIM passing is not enough on its own, how relaxed and strict alignment differ, and a worked example of mail that passes a check but still fails DMARC.

January 28, 2026 Fundamentals

SPF, DKIM and DMARC explained without the jargon

The three DNS records behind email authentication, what each one actually proves, and how they work together to stop people forging your domain.

January 14, 2026 Impersonation

How email spoofing works, and how DMARC stops it

Why plain email lets anyone forge your From address, the real damage spoofing does to a business, and how a DMARC policy shuts it down at the receiver.