Email guides
Plain-English email guides, with links to the checks that go with them.
-
Email
Moving DMARC from p=none to reject, safely
How to read DMARC reports, fix every real sender and move from monitoring to quarantine and reject in stages, without blocking your own email.
-
Email
How to write an SPF record, with examples for common providers
What each part of an SPF record means, the includes for Google Workspace, Microsoft 365 and other providers, where to publish it and how to stay within 10 lookups.
-
Email
Email health checklist: what to check before you send
The DNS records and other checks that decide whether your email is trusted, from MX, SPF, DKIM and DMARC to reverse DNS, BIMI, MTA-STS and DNSSEC.
-
Email
MX records explained, and what to check when email isn't arriving
How MX priority and fallback work, what Google Workspace and Microsoft 365 records look like, and a step-by-step checklist for missing email, from stale records to null MX.
-
Email
DKIM explained: selectors, keys and why signatures fail
What DKIM signs, how to find your selector, how Google Workspace and Microsoft 365 set it up, 1024 versus 2048-bit keys, safe key rotation and the usual reasons signatures fail.
-
Email
SPF 10-lookup limit: how to fix "too many DNS lookups"
Why SPF stops at 10 DNS lookups, how includes add up behind the scenes, and safe ways to get your record back under the limit.
-
Email
MTA-STS rollout checklist
A step-by-step checklist for MTA-STS and TLS reporting: the policy file, the DNS records, testing mode and switching to enforce.
-
Email
What BIMI needs before Gmail shows your logo
The four things Gmail needs before it shows your brand logo: DMARC at enforcement, an SVG Tiny PS logo, a VMC or CMC, and a BIMI record.
-
Email
Reverse DNS (PTR) records and why your mail server needs one
What reverse DNS is, why receiving mail servers check it, and how to get a correct PTR record from whoever owns your IP address.
-
Email
How to set up DMARC for Microsoft 365, step by step
Set up SPF, DKIM and DMARC for a Microsoft 365 domain in the right order, then move safely from monitoring to quarantine and reject.