Learn email authentication
SPF, DKIM and DMARC decide whether mail from your domain reaches the inbox and whether anyone else can send as you. Start with the basics, then follow the guides to enforcement.
The basics
SPF vs DKIM vs DMARC
What each of the three checks, and why you need all of them.
What is DMARC?
How DMARC decides, what each policy does, and why reports matter.
What is SPF?
How SPF authorizes senders, the 10-lookup limit and which ending to use.
What is DKIM?
How DKIM signs mail, what selectors are and why key length matters.
DMARC alignment explained
Which domains must match for DMARC to pass, and how strict that match is.
What is BIMI?
How your logo reaches the inbox, and what it requires first.
Guides
Gmail, Yahoo and Outlook sender requirements
What Gmail, Yahoo and Outlook.com require from senders, side by side.
How to read DMARC aggregate reports
The fields of a rua report, an annotated example and common misreadings.
Moving from p=none to p=reject
The staged path from monitoring to full protection, with a checklist.
MTA-STS and TLS-RPT
Make other servers use TLS when they deliver to you, and get reports when they can't.
RFC 9989: what changed in DMARC
What the new standard removed and added, and what you actually have to change.
DMARC record tags reference
Every tag with its values and default, and which ones are obsolete.
Troubleshooting
DMARC fails even though SPF passes
Why SPF can pass while DMARC fails, and how to fix alignment.
How to find your DKIM selector
Find the selector in headers, provider settings or reports.
Multiple SPF records: why they break SPF and how to merge them
Why two SPF records fail, and how to merge them into one.
SPF ~all vs -all: which ending to use
What each SPF ending means and which one to choose.
SPF "too many DNS lookups": why it happens and how to fix it
How lookups are counted, and safe ways to get under 10.
Gmail 550 5.7.26: what it means and how to fix it
Which of the three 5.7.26 messages you got, and how to fix each one.