DMARC, SPF, DKIM and email security guides
Step-by-step walkthroughs, explainers and troubleshooting for email authentication, DNS and domain security. Written for busy IT teams and UK MSPs.
Showing 21 of 21 resources
Dynamic SPF flattening: how it works and what you hand over
How hosted SPF flattening works: one include, an hourly refresh, 72 hours' grace for dropped ranges, what setup shows before you switch, and how to leave.
NCSC and Cyber Essentials Email Security Requirements for UK Public Sector Suppliers
Cyber Essentials does not require DMARC, SPF or DKIM. What the certificate actually covers, which NCSC guidance the email questions really come from, and what changed when Mail Check retired.
What is SPF? Sender Policy Framework Explained
What SPF means, how it works, which address it checks, ~all vs -all, the 10-lookup limit, and why SPF needs DKIM and DMARC.
Why is My DMARC Failing? Causes and Fixes
The real reasons DMARC fails: alignment, broken DKIM, forwarding, unauthorised senders and strict alignment, each with a symptom, diagnosis and fix.
Bulk Sender Requirements 2026: Google, Yahoo and Microsoft
What Google, Yahoo and Microsoft require from bulk senders in 2026: SPF, DKIM, DMARC alignment, one-click unsubscribe and spam-rate limits, mapped to the DNS controls that satisfy them.
DMARC for MSPs: how to run it across your client domains
How a UK MSP runs DMARC across client domains: inventory, per-client reporting, report-driven enforcement, DNS change control and pricing the service.
DMARC p=none to p=reject: a stage-by-stage rollout runbook
What to check at p=none, quarantine and reject, how long to stay at each stage, when to move on and how to roll back.
Free DMARC Tools Compared: Checkers, Generators and Report Viewers
An honest map of the free DMARC tool landscape in 2026, what each one really gives you, the limits of free tiers, and when a multi-domain team should move to a paid platform.
DMARC for Parked and Non-Sending Domains
How to set up DMARC for a parked domain that never sends email. NULL MX, SPF -all, p=reject and DKIM revocation, with RFC, NCSC and M3AAWG sources.
Best DMARC Monitoring Tools UK 2026
UK-focused 2026 comparison of ShieldMarc, dmarcian, EasyDMARC, PowerDMARC, Valimail, Red Sift and Sendmarc. Pricing, features, data residency and best fit for UK MSPs, multi-domain IT teams, NHS trusts and enterprise.
What is BIMI? Brand Indicators for Message Identification Explained
How BIMI displays your verified logo in Gmail, Apple Mail, and Yahoo, and what a VMC actually costs.
DMARC for the NHS and UK Public Sector: A Post Mail Check Guide
How NHS trusts, councils, and gov.uk bodies can replace NCSC Mail Check with a UK owned, EU hosted platform.
How to set up SPF, DKIM and DMARC for Google Workspace
Set up SPF, DKIM and DMARC for Google Workspace: the Admin console DKIM steps, a 2048-bit key, the _dmarc record and the daily reports Google sends.
How to Set Up DMARC for Office 365 and Microsoft 365
Set up SPF, DKIM and DMARC for Office 365 and Microsoft 365: current Defender portal steps, the onmicrosoft.com record, and how to check it worked.
CAA Records Explained: Control Who Issues Your SSL Certificates
Use CAA records to restrict which certificate authorities can issue certs for your domain.
DNS Record Types Explained: A, AAAA, MX, TXT, CNAME and More
A guide to every common DNS record type and what it does.
Lookalike domains: what to do when one turns up
The response playbook for a lookalike of your domain: record it, check it for mail, ask for a takedown by the right route once spoofed mail is seen, and catch the next one sooner.
SPF hard fail vs soft fail: choosing -all or ~all with DMARC
How receivers treat -all and ~all, how DMARC and forwarding change the answer, and which to use on each kind of domain.
DMARC reports: RUA and RUF, set-up and triage
The two kinds of DMARC report, how to start receiving them, and how to triage the senders they show.
What is DMARC? A Complete Guide to Email Authentication
DMARC explained for IT teams. What it does, how it works, and why you need it.
SSL Certificate Monitoring: What to Check and When
Avoid certificate expiry incidents with proactive SSL monitoring.
How these guides are written
Every guide is written in plain English. Examples follow the record syntax the standards define, and facts are checked against live DNS, the relevant RFC or the provider’s own documentation, because email authentication is unforgiving about syntax and a subtly wrong example costs a reader an afternoon. Each guide shows the month it was last updated.
Mailbox providers handle alignment, forwarding and subdomain policy in ways the specifications do not fully determine, and the differences matter when you are deciding whether it is safe to enforce.
Guides are revised when the underlying standard, a provider’s behaviour or a regulatory position changes, and substantive revisions are dated. Nothing here is gated behind a sign-up form, and no guide ends by asserting that the only sensible answer is to buy something.