Guides
Email authentication and DNS security
What each mechanism does, how to read its record, and the failure that catches people out.
What is SPF?
SPF is a DNS record that lists which servers are allowed to send mail using your domain. Receivers check the sending server against that list and use the answer to decide whether the mail is genuine.
What is DKIM?
DKIM adds a cryptographic signature to outgoing mail. The receiver fetches your public key from DNS and verifies the signature, which proves the message really came from your domain and was not altered on the way.
What is DMARC?
DMARC ties SPF and DKIM to the From address your recipients actually see, tells receivers what to do when a message fails, and sends you daily reports about everyone sending as your domain.
What is DNSSEC?
DNSSEC signs DNS answers cryptographically, so a resolver can prove the record it received is the one the domain actually published and was not tampered with in transit.
What is MTA-STS?
MTA-STS lets a domain declare that mail sent to it must use TLS, closing the downgrade attack that ordinary opportunistic encryption leaves open.