Blog · Email security
Email security, from the records up
Email is where most small businesses are impersonated first, because forging a sender is cheap and the invoice that follows looks exactly like a real one. These guides are the fixes, in the order that does not break your mail.
There are three separate mechanisms in play, and they are routinely confused with each other. SPF describes which servers may send mail for your domain. DKIM signs the message so a receiver can tell whether it was altered in transit. DMARC is the policy that decides what to do when either check fails — and, critically, whether the domain the receiver checks is the domain your customer actually sees in their inbox.
It is common to find SPF published, less common to find a working DKIM signature on every sender, and rarer still to find a DMARC policy that enforces anything — because enforcement is the step that makes missing mail somebody's problem. The guides here take that sequence seriously: inventory first, reporting second, enforcement last.
Every post in this cluster ends with the same question: what would you do on Monday? Where a check can be run by hand, the command is in the post. Where it cannot, the post says so rather than implying a tool will handle it.
Reference article
For the specification-level detail behind these guides — mechanisms, edge cases and what the standard does not cover:
SPF, DKIM and DMARC: how email authentication actually worksGuides
3 posts in this cluster.
Newest first.
SPF, DKIM and DMARC, explained without the acronym soup
What the three email records actually do, how they work together, and a ten-minute check you can run on your own domain without changing anything.
How to roll out DMARC without breaking your email
A staged rollout that starts in monitoring mode, uses aggregate reports to find every sender you forgot about, and only then moves to enforcement.
Why your business email keeps landing in spam
Authentication failures, mismatched sending domains, new-domain reputation and list breakage all look the same from the inbox. Here is how to tell them apart.
What the tool checks
The controls this cluster maps to.
Pulled from the published 22-control catalog, with the weights that drive the posture score.
| Control | What is evaluated |
|---|---|
| SPF policy strength | Whether the record ends in a hard fail (-all), a soft fail, or nothing at all. |
| SPF record validity | Whether the record stays inside the RFC 7208 ten-lookup limit, and whether more than one SPF record exists. |
| DMARC enforcement | Whether _dmarc exists and which policy is published: none, quarantine or reject. |
| DKIM presence | Whether discoverable selectors publish a usable key, and at what length. |
| MX and null-MX posture | Whether mail routing is coherent, including deliberate null MX for domains that never send. |
Other clusters
Keep going elsewhere
Check this area on your own domain.
The assessment covers all five clusters, with the observation quoted behind every conclusive finding.