Email Security Insights
Expert guides on DMARC, DKIM, SPF, and email authentication best practices to protect your domain from spoofing.
RFC 9989: What Changed From RFC 7489 for DMARC
RFC 9989 (May 2026) replaces RFC 7489. pct is gone, a DNS tree walk replaces the Public Suffix List, np, psd and t are new, and reporting moved to RFC 9990 and 9991.
DMARC Adoption in the Top 1,000 Domains (October 2026)
We read DMARC, SPF and BIMI for the Tranco top 1,000 on 19 October 2026. 73.8% of the 688 domains with MX records enforce DMARC; 11.5% publish none.
Email Sender Requirements: Gmail, Yahoo and Outlook
Gmail, Yahoo and Outlook.com require SPF, DKIM, DMARC at p=none or stricter, alignment and one-click unsubscribe from bulk senders. Every rule, cited.
DMARC Record Syntax: Every Tag, Default and Example
A DMARC record is one TXT record at _dmarc.yourdomain that starts v=DMARC1. Every tag with its RFC 7489 default, plus valid and broken examples.
Email Spoofing Attacks: Types, Losses and How to Stop Them
DMARC at p=reject stops exact-domain spoofing. Lookalike domains and display-name tricks need other controls. What each attack looks like and a checklist.
How to Implement DMARC in 5 Steps: A Rollout Plan
List every sender, align SPF and DKIM for each, publish p=none with rua, read the reports, then ramp to quarantine and reject. Records for each step.