Technical Writing
DMARC & Email Authentication Blog
DMARC, deliverability, and email authentication. Written for builders.
Start here
How to Set Up Email for a New SaaS (The Right Way)
Domain strategy, MX records, authentication, IP warmup, and bounce handling for indie SaaS : the full email configuration before your first paying customer signs up.
15 min read
Sep 28, 2026
DMARC np= Explained: Policy for Subdomains That Don't Exist
DMARC np= sets the policy for subdomains that return NXDOMAIN. How np, sp, and p take precedence, and why np=reject is safe to add even while p is still none.
5 min read
Sep 28, 2026
DMARC t=y: The DMARCbis Testing Flag That Replaced pct
DMARC t=y applies your policy one level softer: reject acts as quarantine, quarantine as none. How it differs from pct, and why to publish t=y; pct=0 for now.
7 min readEmail Auth
Sep 28, 2026
DMARC Tree Walk vs the Public Suffix List (and psd=)
RFC 9989 replaces the Public Suffix List with a DNS tree walk capped at 8 queries. How the walk finds your organizational domain, and who should set psd=.
6 min read
Sep 28, 2026
What's New in DMARCbis Aggregate Reports (RFC 9990)
RFC 9990 changes the DMARC aggregate report XML: new np, testing, and discovery_method fields, a pass disposition, a required DKIM selector, and no pct.
7 min readMonitoring
Sep 28, 2026
DMARCbis and Mailing Lists: Is p=reject Still Right?
RFC 9989 says domains whose users post to mailing lists SHOULD NOT publish p=reject. Here's what that means for sending subdomains and your org domain.
7 min readDeliverability
Sep 28, 2026
DMARCbis Readiness: How Many Domains Still Publish pct, rf, and ri?
We checked 1,786 DMARC records for the tags RFC 9989 removed. 46.4% still carry pct, rf, or ri. Almost all of it is harmless. Only 7 domains have the one setup that changes behavior.
9 min readResearch
Sep 23, 2026
DMARC Adoption, September 2026: The Library of Congress Locks Down 18 Domains
Our September scan of 2,240 domains: 83.3% publish DMARC and 68.5% enforce p=reject. Most of the real movement came from one agency locking down domains that never send mail.
6 min readResearch
Aug 19, 2026
What DMARC Monitoring Actually Costs
DMARC monitoring prices from eight vendors, verified on a single day, and why domain caps rather than email volume decide what a multi-domain developer pays.
6 min readMonitoringDeliverability
Aug 8, 2026
DMARC for SaaS founders: why your sending sources multiply without you noticing
Your SaaS product sends email from multiple sources simultaneously, and each one needs DKIM alignment with your domain. Here's why that visibility gap matters.
5 min readDeliverabilityMonitoringEmail Auth
Jul 25, 2026
DMARC Monitoring for Small Business: What It Catches and What to Do About It
If your domain has a weak DMARC setup, someone can send email that looks like it came from you right now. Here is what monitoring catches and what to do.
14 min readMonitoringDeliverability
Jul 11, 2026
Why Is My DMARC Failing? Five Common Causes and How to Fix Them
DMARC failures come from five causes in roughly this order of frequency. Here's what each looks like in an aggregate report and how to fix it.
7 min readSPFDKIMEmail AuthDeliverability
Jun 19, 2026
Your Parked Domain Is Sending Email (And You Didn't Know)
You registered the lookalike domains to protect your brand, parked them, and forgot them. Attackers didn't. A domain with no website and no MX is still spoofable, and nobody watches the ones with no inbox. Here's why parked domains are a spoofing target and exactly how to lock them down and monitor them.
5 min readMonitoring
Jun 14, 2026
What Is DMARC Monitoring? The Visibility Layer Explained
DMARC monitoring is the ongoing practice of reading the aggregate reports your domain receives so you can see who's sending as you, whether they're aligning, and whether anyone is spoofing you. Here's what it watches and why raw reports are useless without it.
9 min readEmail AuthMonitoring
Jun 13, 2026
EasyDMARC Alternative: What Developers Pay For vs What They Actually Need
DMARCdrift monitors up to 15 domains for $9/mo with 180-day retention, versus EasyDMARC's 2-domain Plus tier at $35.99/mo and 3-month retention. Here is who should switch and who should stay.
5 min readMonitoring
Jun 12, 2026
The DMARC Enforcement Roadmap: From p=none to p=reject
DMARC enforcement is a journey, not a switch. Here's the full roadmap from no record to p=reject, what each stage protects you from, and how long it actually takes.
9 min readGetting Started
May 29, 2026
Why Are My Emails Going to Spam? (And How to Fix It)
Most deliverability problems are infrastructure, not content. Work through authentication, reputation, content, list hygiene, and the Gmail/Yahoo bulk-sender rules in order, then diagnose your own case with the checklist at the end.
14 min readSPFDKIMDeliverabilityMonitoring
May 28, 2026
Is Your Domain Being Spoofed? Here's How to Find Out
If your domain has p=none or no DMARC record, you won't know if someone is sending email as your domain. Here's how to check, how to tell real spoofing from your own misconfigured senders, and exactly what to do to shut it down.
14 min readMonitoringEmail Auth
May 24, 2026
pct= is Deprecated in RFC 9989: Migrate Your DMARC Record
RFC 9989 removes pct= from the DMARC policy model. If you still have pct=50 or pct=25 in your record, that sampling guarantee is gone. Here's what to do instead.
8 min read
May 24, 2026
RFC 9989 DMARCbis: What Actually Changed for Your Domain
The first DMARC revision since 2015 dropped on May 19, 2026. Your existing record still works. Here's what changed and what you should actually do about it.
8 min readEmail Auth
May 21, 2026
DMARC Adoption Statistics 2026: Scanning 2,259 Domains
73.8% of tracked domains have DMARC. Only 60.4% enforce it. We scanned 2,259 domains across 9 industries and found patterns that don't follow who you'd expect to lead.
4 min readResearch
May 21, 2026
Gmail and Yahoo sender requirements: what you actually need to do
Google's bulk sender requirements are technically complete but written for enterprise IT. Here's what an indie developer or small SaaS team actually needs: the three pillars, the often-missed details, a verification checklist, and what enforcement really does.
14 min readGetting Started
May 20, 2026
The Email Deliverability Checklist for Indie SaaS (2026)
13 infrastructure checks that determine whether your email lands in the inbox. SPF, DKIM, DMARC, blocklists, and sending behavior: cover these before diagnosing content.
10 min readSPFDKIMDeliverabilityMonitoring
May 14, 2026
How to Set Up BIMI: From p=reject to Your Logo in Gmail
A practical step-by-step guide for developers ready to add BIMI. Covers prerequisites, SVG format requirements, DNS records, the VMC decision, and how to verify it's working.
5 min readEmail Auth
May 13, 2026
Microsoft 365 DMARC Setup: Email Authentication in 4 Steps
Configure DKIM, SPF, and DMARC for Microsoft 365 so your domain stops failing authentication and you can monitor email delivery.
4 min readDKIMSPFEmail AuthSetup GuidesDeliverability
May 12, 2026
38% of Cybersecurity Companies Don't Enforce DMARC on Their Own Domain
We checked 40 cybersecurity companies for DMARC enforcement. 15 of them (companies that sell email security and anti-phishing products to enterprise customers) are still spoofable.
4 min readResearch
May 9, 2026
DMARCdrift vs EasyDMARC: DMARC Monitoring Tool Comparison
An honest comparison of the main DMARC monitoring options for developers managing one or a few domains. What each tool actually does, where it falls short, and who it's built for.
5 min read
May 8, 2026
B2B SaaS DMARC Enforcement in 2026: 63% Protecting, 13% Wide Open
87% of top SaaS companies publish a DMARC record. Only 63% enforce it. A spoofed invoice email from a recognized SaaS brand is a multi-billion dollar fraud category, and a quarter of major SaaS companies aren't blocking it.
4 min readResearch
May 6, 2026
Set Up DMARC, SPF, and DKIM for Mailchimp
Domain authentication is now required in Mailchimp. Here's exactly what to add to your DNS and how to verify it's working.
5 min readSetup GuidesSPFDKIMEmail Auth
May 5, 2026
Half of Major News Organizations Are Still Spoofable by Email
14 of the 30 major news outlets we checked either have no DMARC, sit at p=none, or haven't moved past p=quarantine. A spoofed email from the New York Times or CNN will still be delivered.
4 min readResearch
May 2, 2026
SPF Flattening: How to Fix Too Many DNS Lookups
SPF has a 10 DNS lookup limit. Add a few ESPs and you'll blow past it, causing PermError, silent DMARC alignment failures, and deliverability problems that are hard to trace. Here's how to fix it.
5 min readSPFEmail Auth
May 1, 2026
Healthcare DMARC: High Coverage, Mid-Pack Enforcement, and a HIPAA Angle
Hospital systems have the highest DMARC deployment rate of any category we track (92%). But only 68% enforce it. The coverage-to-enforcement gap matters more in healthcare than almost anywhere else.
4 min readResearch
Apr 29, 2026
DMARC Failure Reports vs Aggregate Reports: RUF vs RUA Explained
RUF and RUA are two different DMARC reports. RUA gives you volume; RUF gives you forensics. Here's why most operators only care about one.
4 min readMonitoringEmail Auth
Apr 28, 2026
86% of Top Universities Have DMARC. Only 28% Actually Enforce It.
Universities have a 58-point gap between deployment and enforcement, the widest of any category we track. A spoofed email from Harvard or Stanford will still be delivered.
4 min readResearch
Apr 28, 2026
BIMI Explained: Show Your Logo in Email Inboxes
BIMI puts your logo next to emails you send. In Gmail, that requires a $1,500/yr certificate. In Yahoo Mail, it's free. Here's what BIMI is, how it works, and who should actually pursue it.
7 min readEmail Auth
Apr 24, 2026
State Governments Are 44 Points Behind Federal on DMARC Enforcement
Federal agencies are at 70% DMARC enforcement. State governments are at 26%. California is at p=none, New York has no record, Florida has no record. The difference is a binding directive.
4 min readResearch
Apr 22, 2026
DMARC p=none: What It Means and What to Do Next
You set up p=none because someone told you to. Here's what it actually means, what risk it leaves open, and exactly when you're ready to move past it.
5 min read
Apr 22, 2026
Google Workspace DMARC and DKIM Setup Guide
Step-by-step guide to enable DKIM in Google Workspace Admin Console, configure SPF and DMARC records, and verify alignment so your emails deliver and you can monitor them.
7 min readDKIMSPFEmail AuthSetup Guides
Apr 21, 2026
Banks Lead DMARC Enforcement at 76%: Why Financial Services Got Ahead
76% of the top 25 US banks enforce DMARC at p=reject, the highest rate of any sector we track. Here's what the financial sector figured out that universities, governments, and media companies haven't.
4 min readResearch
Apr 17, 2026
Fortune 100 DMARC in 2026: 67% at p=reject, 13% Exposed
87% of Fortune 100 companies have DMARC. Only 67% enforce it. Disney is at p=none, Northrop Grumman has no record, and Apple is still at p=quarantine. Here's the current state.
4 min readResearch
Apr 15, 2026
How to Set Up DKIM and DMARC for SendGrid
Configure domain authentication, SPF, DKIM, and DMARC for SendGrid so your emails pass alignment and you can monitor delivery.
5 min readDKIMSPFEmail AuthSetup GuidesDeliverability
Apr 14, 2026
Having a DMARC Record Isn't the Same as Being Protected
73.8% of well-known domains have a DMARC record. Only 60.4% are actually protected from spoofing. The gap lives at p=none, and most organizations don't realize they're in it.
4 min read
Apr 14, 2026
What Happens When You Have No DMARC Record
Without a DMARC record, receiving servers have no policy to enforce. You lose visibility into who's sending from your domain and gain no protection against spoofing.
5 min readDeliverabilityGetting Started
Apr 10, 2026
What to Do With Your DMARC Reports (A Checklist for Indie Developers)
Most developers get DMARC reports, don't know what to do with them, and ignore them. Here's a four-part checklist for turning those XML files into actual action items.
6 min read
Apr 8, 2026
Cloudflare Email Routing and DMARC: Why Forwarded Mail Fails
Cloudflare Email Routing forwards inbound mail, but forwarding breaks SPF. Here's how DMARC, DKIM, and ARC work together to keep your forwarded mail in the inbox.
6 min readSPFDKIMEmail AuthSetup Guides
Apr 1, 2026
Email Forwarding and DMARC: Why Forwarded Mail Fails Authentication
Understand why email forwarding breaks SPF, how DKIM survives the hop, and when DMARC still passes; plus how ARC sealing fixes the problem.
5 min readSPFDKIMEmail AuthDeliverability
Mar 28, 2026
Email Deliverability Guide for Indie SaaS Founders
The complete reference for indie developers setting up email authentication from scratch or fixing a broken setup. SPF, DKIM, and DMARC explained in terms you'll actually use.
8 min readSPFDKIM
Mar 26, 2026
AWS SES DMARC Setup: Email Authentication in 5 Steps
Add DKIM, SPF, and DMARC to AWS SES so your emails pass authentication checks and you can monitor them with aggregate reports.
5 min readSPFDKIMSetup GuidesEmail Auth
Mar 19, 2026
Set Up DKIM and DMARC for Postmark
Configure sender signatures, DNS records, and DMARC for Postmark so your transactional emails pass authentication and you can monitor delivery.
5 min readDKIMSPFEmail AuthSetup GuidesDeliverability
Mar 17, 2026
SPF vs DKIM vs DMARC: How Email Authentication Really Works
SPF, DKIM, and DMARC aren't alternatives; they're layers. Here's what each one does and why you need all three.
6 min readSPFDKIMEmail Auth
Mar 15, 2026
What's actually in a DMARC aggregate report
DMARC aggregate reports are your earliest signal that email alignment is drifting. Here's what every field means and how to read them for inbox placement.
4 min read
Mar 12, 2026
How to Set Up DKIM and DMARC for Resend
Configure SPF, DKIM, and DMARC for Resend so your transactional emails pass authentication and you can monitor delivery.
6 min readDKIMSPFEmail AuthSetup GuidesDeliverability
Mar 5, 2026
DKIM vs DMARC: They're Not Alternatives
DKIM and DMARC are often confused because they're both email authentication tools. But they solve different problems. DKIM authenticates messages; DMARC enforces policy. You need both.
5 min readDKIMEmail Auth
Feb 28, 2026
DMARC for indie developers: what to monitor and when to act
DMARC monitoring for indie developers: how alignment works, which policy level makes sense, and how to know when you're ready to enforce.
4 min readGetting Started
Feb 19, 2026
What Is Email Authentication
Email authentication is the set of DNS-based protocols that verify an email comes from the domain it claims to. Learn how SPF, DKIM, and DMARC work together to prevent spoofing.
4 min readEmail AuthSPFDKIMGetting Started
Feb 12, 2026
What Is SPF (Sender Policy Framework)?
SPF publishes a DNS record listing servers authorized to send email for your domain. It protects the envelope sender, not the visible From header.
4 min readSPFEmail AuthDeliverability
Feb 10, 2026
Why I stopped trying to read my DMARC reports manually
I have 900+ unread DMARC reports. Here's what happened when I stopped ignoring them, and what I learned about monitoring alignment before it breaks deliverability.
5 min read
Feb 5, 2026
What is DKIM? How Domain Key Authentication Works
DKIM adds a cryptographic signature to your emails so receiving servers can verify you sent them and they weren't modified in transit.
4 min readDKIMEmail AuthDeliverability
Jan 22, 2026
p=none to p=reject: A DMARC Deliverability Decision
DMARC policy enforcement isn't just about stopping attackers: it's about protecting your own email deliverability. Here's how to know when you're ready to tighten.
5 min read
Jun 6, 2025
Microsoft Outlook.com DMARC enforcement: what changed in May 2025
Microsoft began enforcing DMARC for bulk senders to Outlook.com on May 5, 2025. Here's who's affected, what enforcement means, and how to check your domain now.
5 min readDeliverability