DMARC, SPF, DKIM and email security guides
Step-by-step walkthroughs, explainers and troubleshooting for email authentication, DNS and domain security. Written for busy IT teams and UK MSPs.
Showing 20 of 55 resources
NCSC and Cyber Essentials Email Security Requirements for UK Public Sector Suppliers
Cyber Essentials does not require DMARC, SPF or DKIM. What the certificate actually covers, which NCSC guidance the email questions really come from, and what changed when Mail Check retired.
What is SPF? Sender Policy Framework Explained
What SPF means, how it works, which address it checks, ~all vs -all, the 10-lookup limit, and why SPF needs DKIM and DMARC.
Why is My DMARC Failing? Causes and Fixes
The real reasons DMARC fails: alignment, broken DKIM, forwarding, unauthorised senders and strict alignment, each with a symptom, diagnosis and fix.
Bulk Sender Requirements 2026: Google, Yahoo and Microsoft
What Google, Yahoo and Microsoft require from bulk senders in 2026: SPF, DKIM, DMARC alignment, one-click unsubscribe and spam-rate limits, mapped to the DNS controls that satisfy them.
DMARC for MSPs: how to run it across your client domains
How a UK MSP runs DMARC across client domains: inventory, per-client reporting, report-driven enforcement, DNS change control and pricing the service.
How to Move from DMARC p=none to p=reject (Step by Step)
A report-driven path from p=none to p=reject: read the aggregate reports, authorise every legitimate sender, then advance to quarantine and reject once the data is clean.
Free DMARC Tools Compared: Checkers, Generators and Report Viewers
An honest map of the free DMARC tool landscape in 2026, what each one really gives you, the limits of free tiers, and when a multi-domain team should move to a paid platform.
DMARC for Parked and Non-Sending Domains
How to set up DMARC for a parked domain that never sends email. NULL MX, SPF -all, p=reject and DKIM revocation, with RFC, NCSC and M3AAWG sources.
Best DMARC Monitoring Tools UK 2026
UK-focused 2026 comparison of ShieldMarc, dmarcian, EasyDMARC, PowerDMARC, Valimail, Red Sift and Sendmarc. Pricing, features, data residency and best fit for UK MSPs, multi-domain IT teams, NHS trusts and enterprise.
How to set up SPF, DKIM and DMARC for Google Workspace
Set up SPF, DKIM and DMARC for Google Workspace: the Admin console DKIM steps, a 2048-bit key, the _dmarc record and the daily reports Google sends.
How to Set Up DMARC for Office 365 and Microsoft 365
Set up SPF, DKIM and DMARC for Office 365 and Microsoft 365: current Defender portal steps, the onmicrosoft.com record, and how to check it worked.
What is BIMI? Brand Indicators for Message Identification Explained
How BIMI displays your verified logo in Gmail, Apple Mail, and Yahoo, and what a VMC actually costs.
DMARC for the NHS and UK Public Sector: A Post Mail Check Guide
How NHS trusts, councils, and gov.uk bodies can replace NCSC Mail Check with a UK owned, EU hosted platform.
What is DMARC? A Plain English Guide
DMARC explained for IT teams. What it does, how it works, and why you need it.
How to Read DMARC Reports: RUA and RUF
How to read and act on DMARC aggregate and forensic reports.
SPF Hard Fail vs Soft Fail: Why ~all Is Safer with DMARC
When to use -all vs ~all in your SPF record and how DMARC changes the equation.
SSL Certificate Monitoring: What to Check and When
Avoid certificate expiry incidents with proactive SSL monitoring.
CAA Records Explained: Control Who Issues Your SSL Certificates
Use CAA records to restrict which certificate authorities can issue certs for your domain.
DNS Record Types Explained: A, AAAA, MX, TXT, CNAME and More
A guide to every common DNS record type and what it does.
Protecting Your Brand from Lookalike Domains
Detect and defend against typosquatting and brand impersonation domains.
How these guides are written
Every guide is written in plain English and tested before publication. DNS examples are real records resolved against live nameservers rather than illustrative snippets, because email authentication is unforgiving about syntax and a subtly wrong example costs a reader an afternoon.
Where a guide makes a claim about how a mailbox provider behaves, that behaviour has been observed rather than inferred from documentation. Provider handling of alignment, forwarding and subdomain policy differs in ways the specifications do not fully determine, and the differences matter when you are deciding whether it is safe to enforce.
Guides are revised when the underlying standard, a provider’s behaviour or a regulatory position changes, and substantive revisions are dated. Nothing here is gated behind a sign-up form, and no guide ends by asserting that the only sensible answer is to buy something.