Email authentication
SPF, DKIM and DMARC are DNS records that let receivers verify mail claiming to come from your domain. They are easy to publish and easy to get subtly wrong. These guides explain each record, the limits that cause hard failures, and a safe path to enforcement.
- BIMI: requirements and setup for a logo in the inboxupdated 26 October 2026
What BIMI needs before an inbox shows your logo: DMARC enforcement, an SVG Tiny PS logo, a VMC or CMC certificate, and the DNS record that publishes it.
- DKIM selectors: finding, verifying and rotating keysupdated 26 October 2026
What a DKIM selector is, how to find the one your mail platform uses, how to verify the published key, and how to rotate keys without failed signatures.
- DMARC alignment, explained: why SPF passes but DMARC failsupdated 26 October 2026
Which domains DMARC compares, relaxed vs strict alignment, and how to fix the most common "SPF pass, DMARC fail" and "DKIM pass, DMARC fail" cases.
- DMARC from p=none to p=reject without breaking mailupdated 26 October 2026
How to move DMARC from monitoring to enforcement: what to publish, which reports to read, how long each stage takes, and what to do with what they find.
- Fixing "SPF too many DNS lookups" (PermError)updated 26 October 2026
Why SPF fails at 10 DNS lookups, how to count them correctly, and five safe ways to get back under the limit without breaking mail.
- SPF explained: how to read, write and audit an SPF recordupdated 26 October 2026
How SPF works, what each mechanism and qualifier means, how receivers evaluate a record, and the mistakes that make SPF fail for every message.