Plain-language guides to DMARC and the standards around it — written to be accurate first and short second. No jargon walls, no scare tactics.
Errors and warnings that land on you today, each with one cause people usually miss. Start here if something is failing rather than merely puzzling.
Two different failures share this code, and they have opposite fixes. Read the bounce wording, then fix the right thing.
4 minTen lookups is a hard limit, and a permerror is worse than no SPF at all. What costs a lookup, and the four fixes in order.
4 minBoth checks green and DMARC still fails. That is alignment — and there are exactly three causes worth checking.
4 minA scanner graded you red for p=none. Your record is fine — here is what the warning measures and when it is a real deadline.
Three causes share this message, and the second one hides a perfect record at a hostname nothing will ever query.
4 minBody hash, signature, neutral, temperror — five results, five unrelated fixes. Read the reason before rotating a key.
5 minFive articles, in order. About twenty minutes end to end, after which your DMARC reports will read as information rather than XML.
The control layer: policy, alignment, and the reports that name everyone sending as your domain.
5 min 2The DNS record listing your authorized servers — its syntax, the 10-lookup limit, and where it falls short.
4 min 3Signatures that survive forwarding: selectors, keys, and why DKIM is DMARC's sturdier input.
3 min 4What each policy does, what sp and np mean, and the staged playbook for enforcing without losing real mail.
4 min 5Every tag explained, three copy-paste records (none, quarantine, reject), and the exact DNS steps to publish one.
3 min 6The standard was rewritten in May 2026. The tree walk, the np, psd and t tags, why pct is gone, and whether your record needs a single edit.
6 minWhat the daily XML actually contains, and how to tell a forwarding gateway from someone spoofing you.
The XML files Google and Microsoft send you daily: what's inside, what isn't, and how to turn them into decisions.
3 minThe daily XML attachments from providers you have never dealt with: what they are, whether they are phishing, and how to make them stop.
4 minnoreply-dmarc-support@google.com with a ZIP of XML. How to confirm it is genuine, read the filename, and act on what is inside.
4 minWhy Microsoft reports on your domain even if you have never used Microsoft 365 — and what its reports are uniquely good for.
3 minOne of the two receivers behind the 2024 bulk-sender rules. What its reports tell you, and what to look for first.
3 minIt reports on mail arriving at Amazon, not on your SES sending — and the difference changes what the report is worth.
3 minA security gateway reporting on the organisations behind it. Low volume, unusually high signal.
3 minTwo red badges have three very different causes — forwarding, a vendor nobody aligned, or actual spoofing. How to tell them apart in a minute.
4 minHow to tell a spoofing VPS from a vendor nobody configured, using the evidence the IP itself carries.
6 minThreat feeds report IPs the blocklists themselves don’t list. What the annotation means, and why your own DKIM key outranks any reputation feed.
4 minThe gap between "SPF and DKIM pass" and "DMARC passes" is alignment, and it is where almost every rollout stalls. Then there's keeping it that way.
Why Mailchimp or SendGrid mail can pass SPF and DKIM yet fail DMARC — and the two settings that fix it.
3 minCampaigns pass SPF and DKIM but fail DMARC until you authenticate your domain. Setting up custom DKIM, step by step.
5 minThree records in your own DNS make mail sent through Zoho verifiably yours — exact values, step by step.
3 minWix doesn't host your email — your SPF and DKIM live with your provider. DMARC is the record you own, and here's how to publish it.
3 minWhy Email Campaigns no longer needs an SPF record — and how DKIM plus your own DMARC record is what actually protects you.
3 minHow forwarded mail and mailing lists survive strict DMARC — and why you don't need to publish anything for it.
3 minSPF edits, lost DKIM keys, softened policies — why authentication decays after rollout and how to catch it in a day.
4 minEverything above assumes the domain is yours. When it's a client's, the hard parts move: DNS access you don't own, thirty sender inventories, and a conversation about who pays for it.
What changes between one domain and thirty — DNS access, sender inventories, drift — and what's worth systematizing before domain four.
6 minThe repeatable per-client playbook: audit, publish, inventory senders, align, tighten — with exit criteria for every stage.
4 minPackaging, pricing, the ninety-second pitch that closes in one meeting, and the objections you'll actually hear.
5 minFour things worth doing rather than reading.
Paste a domain, see its published record, what each tag does, and what it leaves open. No sign-up.
Free toolA 0–100 score built from the authentication signals spam filters weigh — DMARC policy, SPF, DKIM and MX — with the gaps named. No sign-up.
Choosing a toolAn honest, current comparison with DMARCLY, EasyDMARC, dmarcian and PowerDMARC — including where they beat us.
ResearchOriginal data: we scan named lists of companies and publish who is at reject, who is monitoring only, and who has no record. Starts with the Forbes Global 2000 top 100.