Guides, tools and research
Everything you need to understand and improve your domain security posture. Free guides, 20 instant tools, and original research.
UK Public Sector DMARC Tracker
Every domain in the official .gov.uk register, re-measured hourly from public DNS against a 27 July 2026 baseline. DMARC policy, enforcement and where aggregate reports actually go.
Updated quarterly with fresh data. Downloadable tables and regional breakdowns included.
Showing 56 of 56 resources
Dynamic SPF flattening: how it works and what you hand over
How hosted SPF flattening works: one include, an hourly refresh, 72 hours' grace for dropped ranges, what setup shows before you switch, and how to leave.
UK MSP DMARC audit: Q3 2026
192 UK MSPs graded A+ to F on 16 October 2026. The average still scores a C, 4% earn an A or A+, and 3 strengthened their DMARC policy since June, with none weakening it.
NCSC and Cyber Essentials Email Security Requirements for UK Public Sector Suppliers
Cyber Essentials does not require DMARC, SPF or DKIM. What the certificate actually covers, which NCSC guidance the email questions really come from, and what changed when Mail Check retired.
What is SPF? Sender Policy Framework Explained
What SPF means, how it works, which address it checks, ~all vs -all, the 10-lookup limit, and why SPF needs DKIM and DMARC.
Why is My DMARC Failing? Causes and Fixes
The real reasons DMARC fails: alignment, broken DKIM, forwarding, unauthorised senders and strict alignment, each with a symptom, diagnosis and fix.
UK MSP DMARC Audit: Q2 2026
192 UK MSPs graded A+ to F on the Security Grade. The average UK MSP scores a C; corrected in October 2026, 4% earn an A or A+.
Bulk Sender Requirements 2026: Google, Yahoo and Microsoft
What Google, Yahoo and Microsoft require from bulk senders in 2026: SPF, DKIM, DMARC alignment, one-click unsubscribe and spam-rate limits, mapped to the DNS controls that satisfy them.
DMARC for MSPs: how to run it across your client domains
How a UK MSP runs DMARC across client domains: inventory, per-client reporting, report-driven enforcement, DNS change control and pricing the service.
DMARC p=none to p=reject: a stage-by-stage rollout runbook
What to check at p=none, quarantine and reject, how long to stay at each stage, when to move on and how to roll back.
Free DMARC Tools Compared: Checkers, Generators and Report Viewers
An honest map of the free DMARC tool landscape in 2026, what each one really gives you, the limits of free tiers, and when a multi-domain team should move to a paid platform.
DMARC for Parked and Non-Sending Domains
How to set up DMARC for a parked domain that never sends email. NULL MX, SPF -all, p=reject and DKIM revocation, with RFC, NCSC and M3AAWG sources.
Best DMARC Monitoring Tools UK 2026
UK-focused 2026 comparison of ShieldMarc, dmarcian, EasyDMARC, PowerDMARC, Valimail, Red Sift and Sendmarc. Pricing, features, data residency and best fit for UK MSPs, multi-domain IT teams, NHS trusts and enterprise.
What We're Building and When You Can Use It
A June 2026 progress update on the ShieldMarc platform: what we were working on, what was due on 1 July 2026, and how to start a free trial.
What is BIMI? Brand Indicators for Message Identification Explained
How BIMI displays your verified logo in Gmail, Apple Mail, and Yahoo, and what a VMC actually costs.
DMARC for the NHS and UK Public Sector: A Post Mail Check Guide
How NHS trusts, councils, and gov.uk bodies can replace NCSC Mail Check with a UK owned, EU hosted platform.
How to set up SPF, DKIM and DMARC for Google Workspace
Set up SPF, DKIM and DMARC for Google Workspace: the Admin console DKIM steps, a 2048-bit key, the _dmarc record and the daily reports Google sends.
How to Set Up DMARC for Office 365 and Microsoft 365
Set up SPF, DKIM and DMARC for Office 365 and Microsoft 365: current Defender portal steps, the onmicrosoft.com record, and how to check it worked.
Our Mission: AI Tools, Open to All
Why ShieldMarc gives its checking tools away free, with a plain-English explanation on request, and what we believe about access and protection.
How ShieldMarc Threat Detection Works
Every DMARC report row is evaluated by a deterministic multi-signal scoring engine to separate genuine threats from noise. AI explains a sender on request. Here is how it works.
How a modern stack shapes our DMARC pricing
We built ShieldMarc from scratch in 2026 with modern tooling. What that means for performance, and how it lets us publish flat prices.
CAA Records Explained: Control Who Issues Your SSL Certificates
Use CAA records to restrict which certificate authorities can issue certs for your domain.
DNS Record Types Explained: A, AAAA, MX, TXT, CNAME and More
A guide to every common DNS record type and what it does.
Lookalike domains: what to do when one turns up
The response playbook for a lookalike of your domain: record it, check it for mail, ask for a takedown by the right route once spoofed mail is seen, and catch the next one sooner.
SPF hard fail vs soft fail: choosing -all or ~all with DMARC
How receivers treat -all and ~all, how DMARC and forwarding change the answer, and which to use on each kind of domain.
UK MSP DMARC Audit: Q1 2026
192 UK MSPs analysed across DMARC, SPF, SSL, DNSSEC, and brand domain protection.
DMARC reports: RUA and RUF, set-up and triage
The two kinds of DMARC report, how to start receiving them, and how to triage the senders they show.
What is DMARC? A Complete Guide to Email Authentication
DMARC explained for IT teams. What it does, how it works, and why you need it.
SSL Certificate Monitoring: What to Check and When
Avoid certificate expiry incidents with proactive SSL monitoring.
ShieldMarc vs EasyDMARC
A straight comparison for UK MSPs: pricing, message volume, AI model, posture and support.
ShieldMarc vs dmarcian
A straight comparison for UK MSPs: pricing, message volume, AI model, posture and support.
ShieldMarc vs Valimail
A practical alternative to enterprise-priced DMARC. Published pricing, self-serve onboarding, 30-day trial.
ShieldMarc vs PowerDMARC
Flat pricing vs volume-tiered plans: domains per pound, in-tier price step-ups, hosting and certifications compared honestly.
ShieldMarc vs Red Sift OnDMARC
Two UK platforms compared: flat multi-domain pricing and monitoring breadth vs Red Sift's certifications and hosted record management.
ShieldMarc vs Sendmarc
Published flat pricing and self-serve onboarding vs Sendmarc's quote-based, partner-first sales model.
ShieldMarc vs DMARCLY
Mid-size economics, full-year retention and whole-domain monitoring vs DMARCLY's budget tier steps.
ShieldMarc vs Mimecast DMARC Analyzer
A standalone DMARC platform with published flat pricing against a product quoted inside an enterprise email-security portfolio.
Security Grade
Run 16 security checks and get an A+ to F grade.
SPF, DKIM & DMARC Checker
Check your DMARC policy, SPF record, and DKIM selectors in one scan.
SPF Checker
Check any domain's SPF record: mechanisms, DNS lookup count, include tree and fail policy.
DKIM Checker
Scan common DKIM selectors and verify public keys for any domain.
SSL Certificate Checker
Inspect certificates, expiry dates, and chain validity.
DNS Lookup
Look up A, AAAA, MX, TXT, NS, SOA, SRV and CNAME records for a domain or hostname.
SPF Flattener
Resolve SPF includes to a flat list of IPs.
Lookalike Domain Scanner
Detect typosquat and impersonation domains.
DNSSEC Checker
Verify DNSSEC signing on any domain.
MTA-STS Checker
Check MTA-STS policy and enforcement mode.
TLS-RPT Checker
Verify TLS-RPT reporting records.
CAA Checker
Inspect CAA records and certificate issuance restrictions.
Domain Expiry Checker
Check domain registration status and expiry dates.
WHOIS Lookup
Query domain registration and registrar data.
DMARC Record Generator
Build a valid DMARC record in seconds.
SPF Record Generator
Create an SPF record with your email providers.
DKIM Record Generator
Generate a DKIM DNS record for your domain.
CAA Record Generator
Build CAA records to restrict certificate issuance.
DMARC Report Viewer
Upload and parse DMARC aggregate XML reports.
Email Header Analyser
Paste email headers and see authentication results, routing hops, and delays.
Where to start
If DMARC is new to you, begin with the guides. They assume no prior knowledge of email authentication and build up from what SPF and DKIM actually do to why DMARC needs both, then to reading the reports that arrive once a policy is live. The most common failure is not a misconfigured record but moving to an enforcing policy before knowing every legitimate sender, so the guides spend time on discovery rather than syntax.
If you manage domains for other organisations, the research section is likely more useful. It contains original audits of how UK organisations actually configure email authentication, drawn from published DNS records, with the sample and method stated so you can reproduce or challenge the numbers.
Public sector teams working through the retirement of NCSC Mail Check will find the migration material under guides, covering what Mail Check provided, what has to be replaced, and which parts have no direct equivalent. The engineering section is a different audience again: it documents how ShieldMarc itself is built, for readers evaluating whether the detection claims hold up.