Knowledge Base.

ARC preserves authentication results across forwarding, letting receivers trust mail whose SPF and DKIM broke in transit. How the chain works and what it fixes.

A DMARC record is a TXT record at _dmarc.yourdomain.com built from tags: v, p, sp, rua, ruf, adkim, aspf and more. What each does and which you actually need.

BIMI displays a verified brand logo next to authenticated email. The DNS record, the VMC certificate, the DMARC prerequisite, and an honest look at the ROI.

DKIM cryptographically signs email so receivers can verify the sending domain and message integrity. How signing and verification work, and where DKIM fits.

DKIM public keys live in DNS under selector names like s2026a._domainkey.example.com. How the record is structured, why selectors exist, and delegation via CNAME.

Canonicalization normalizes a message before signing so harmless transit changes do not break DKIM. How simple and relaxed differ, and what still breaks signatures.

DKIM keys need a size decision, a rotation practice, and an inventory. Why 2048-bit is the standard, the zero-downtime rotation pattern, and handling vendor keys.

Aggregate reports are DMARC's feedback loop: daily XML files showing every source sending as your domain. The format, a worked example, and what to look for.

Alignment is DMARC's core concept: the authenticated domain must match the From: domain. How relaxed and strict modes work and which mechanism carries the pass.

DMARC lets a domain declare how its mail authenticates and what receivers should do with failures. How it builds on SPF and DKIM, and how evaluation works.

The p= tag tells receivers what to do with mail that fails DMARC. What each policy does, how subdomain policy works, and why reject is the destination.

A valid DKIM signature can be abused: replayed at scale, extended with unsigned headers, or exploited via partial body coverage. The hardening measures that limit it.

DMARC deployment is a process, not a DNS change. The staged path from monitoring to full enforcement without breaking legitimate mail.

SPF is a DNS-based email authentication standard that lists which servers may send mail for a domain. How it works, what it protects, and where it falls short.

DMARC only accepts an SPF pass when the envelope domain matches the visible From domain. What alignment means, why ESPs break it, and how to fix it.

The eight SPF mechanisms decide which servers match a record. What each one tests, what it costs in DNS lookups, and when to use or avoid it.

The qualifier on the all mechanism is your SPF policy: fail, softfail, neutral, or pass. What each one tells receivers and which to publish at each stage.

An SPF record is one TXT record with a strict grammar: version tag, qualified mechanisms, optional modifiers. The rules, the common shapes, and worked examples.

How to verify DKIM works: reading verdicts in headers, checking keys in DNS, and the short list of misconfigurations behind most DKIM failures.

The seven SPF results and what each means, the tools that validate records, and the recurring misconfigurations behind most SPF failures.

The DKIM-Signature header carries the signature and everything needed to verify it: d, s, h, bh, b and more. What each tag means and which choices matter.

SPF evaluation stops after 10 DNS lookups and returns permerror. Which mechanisms count, how includes multiply the cost, and the fixes that keep records under budget.

DMARC is effective but not complete: forwarding breaks it legitimately, lookalike domains bypass it entirely, and display name spoofing sits outside its scope.

Since 2024, the major mailbox providers require authentication, easy unsubscribes, and low complaint rates from bulk senders. The unified checklist and the penalties.

Consent is the legal and practical foundation of sending. What GDPR and CAN-SPAM actually require, how double opt-in proves it, and where single opt-in is defensible.

One-click unsubscribe lets mail clients offer an unsubscribe button that works with a single POST. The two headers, the endpoint rules, and the common mistakes.

DANE pins mail server certificates in DNS, secured by DNSSEC, closing the same downgrade hole as MTA-STS with stronger guarantees and steeper prerequisites.

MTA-STS lets a domain require verified TLS for mail delivered to it, closing the STARTTLS downgrade hole. The policy file, the DNS record, and safe rollout.

Reverse DNS maps a sending IP back to a hostname, and receivers check it before anything else. Forward-confirmed rDNS, generic PTR problems, and how to fix them.

Dedicated subdomains per mail stream isolate reputation, sharpen monitoring, and contain incidents. The standard architecture and the rules for carving it up.

TLS-RPT gets large senders to mail you daily JSON reports about TLS failures on delivery to your domain. The record, the report format, and how to act on it.

An ESP is the platform that sends email at scale on your behalf: infrastructure, list management, and compliance machinery. What they do and what stays your job.

The envelope sender is the address the SMTP transaction names for bounces, distinct from the From header users see. Why the two differ and why it matters.

The MTA is the software that moves email between servers: queueing, retrying, and speaking SMTP. What it does, common implementations, and where it sits in the stack.

MX records are the DNS entries that tell sending servers where to deliver a domain's mail, with priorities for failover. Syntax, behaviour, and the usual mistakes.

The organizational domain is the registered root that owns all its subdomains for authentication purposes. How it is determined and why DMARC alignment depends on it.

SMTP is the protocol that moves email between servers: a text conversation of commands and reply codes. The transaction, the ports, and the extensions that matter.

A bounce is a delivery failure with a reason attached. Hard versus soft, the SMTP codes underneath, and the handling rules that protect your reputation.

List hygiene is the discipline of removing addresses that bounce, complain, or stop responding. The sunset policy, the suppression rules, and why smaller wins.

New IPs and domains start unknown, and unknown at volume looks like spam. How warming builds history gradually, the schedule shape, and the signals to watch.

Sender reputation is the score mailbox providers keep on your domain and IPs, built from complaints, engagement, and hygiene. What feeds it and how to see it.

Every report-spam click feeds your complaint rate and, via feedback loops, can come back to you as data. The thresholds, the FBL registrations, and the pipeline.

Spam traps are addresses that only receive unwanted mail, run by blocklists and providers as sensors. The three types, how lists acquire them, and the defense.