Guides

How SPF, DMARC, DKIM and MX work, written from the RFCs, with links to the checks and the findings they relate to.

• BIMI explained: the record, the logo and DMARC
  How BIMI publishes a brand logo for email: the TXT record at selector._bimi, the l= and a= tags, the DMARC requirements and what mail clients check.
• CAA records explained: which CAs may issue
  How CAA records (RFC 8659) limit which certificate authorities may issue certificates for a domain: issue, issuewild, iodef, the critical flag and inheritance.
• DKIM explained: selectors, keys and rotation
  How DKIM signing and key records work under RFC 6376: selectors, the v, k, p and t tags, key sizes after RFC 8301, Ed25519, rotation and revocation.
• DMARC explained: policy, alignment and reports
  How DMARC works under RFC 9989: SPF and DKIM alignment, the p, sp, np and t tags, the DNS tree walk, reports, and a safe path from none to reject.
• DNSSEC explained: DS, DNSKEY and validation
  How DNSSEC signs DNS data under RFC 4033-4035: DS and DNSKEY records, the chain of trust, the four validation states and algorithm choice.
• Domain expiry and EPP status codes explained Draft
  What happens when a domain expires, how RDAP shows registration dates (RFC 9083), and what EPP statuses like client hold or redemption period mean.
• MTA-STS and TLS-RPT explained: policy, mode and MX
  How MTA-STS (RFC 8461) makes senders require TLS for your mail and how TLS-RPT (RFC 8460) reports failures: the record, the policy file and its modes.
• MX records explained: priority and null MX
  How MX records route email under RFC 5321: preference values, fallback to the address record, null MX from RFC 7505, valid targets and common mistakes.
• HTTP security headers explained: HSTS, CSP and more Draft
  What HSTS (RFC 6797) and preloading, Content Security Policy, frame protection and Referrer-Policy do, and how to roll them out without breaking a site.
• SPF explained: lookups, includes and all
  How an SPF record works under RFC 7208: mechanisms, qualifiers, the ten-lookup and two-void-lookup limits, include versus redirect, and common mistakes.
• TLS certificates explained: expiry, chain and names Draft
  How a TLS certificate is checked (RFC 5280, RFC 9525): validity dates, the chain to a trusted root, the names it covers, key strength and what breaks.

Atom feed of published guides