SPF, DKIM, DMARC
The three DNS records that protect your domain from forgery.
- BIMI: Getting Your Logo in the Inbox with a VMC or CMC
BIMI shows your logo next to messages in Gmail, Apple Mail and Yahoo. You need DMARC at quarantine or reject, an SVG Tiny PS logo and, for Gmail, a VMC or CMC.
- Prevent Email Spoofing: What Actually Stops Forged Senders
Prevent email spoofing of your exact domain with SPF, DKIM and DMARC at p=reject, plus 3 DNS records for parked domains and what to do about lookalike domains.
- Read DMARC Reports: Aggregate XML Explained Field by Field
How to read DMARC reports: what each XML field means, how to tell your own senders from forgeries, and 4 patterns found in most aggregate reports.
- DKIM Setup: Selectors, 2048-bit Keys and DNS Records
DKIM setup step by step: pick a selector, generate a 2048-bit key, publish it at selector._domainkey, then confirm dkim=pass with header.d set to your domain.
- DMARC Setup: From p=none to p=reject Without Losing Mail
DMARC setup in stages: publish a _dmarc record with p=none and rua reports, fix alignment, then move to quarantine and reject over 4 to 8 weeks.
- SPF Record Setup: Syntax, Examples and the 10-Lookup Limit
SPF record setup done right: one TXT record, the mechanisms that count toward the 10 DNS lookup limit, ~all versus -all, and how to verify it with dig.