Resources · 17 articles
Make sense of
email security
Set up authentication, find out why messages go missing, and protect your domain.
Start with the question that brought you here.
Email authentication
New to email authentication? Start here.How email authentication works: SPF, DKIM, and DMARC explained
Understand SPF, DKIM, and DMARC with diagrams and four email examples. Learn how alignment, policies, and aggregate reports help protect your domain.
What is DMARC? How it helps protect your domain from spoofing
See why SPF and DKIM can pass while DMARC fails. Compare real-world email scenarios, understand alignment and policies, and learn what DMARC cannot prevent.
Why your company can still be spoofed when you use Gmail or Outlook
Using Google Workspace or Microsoft 365 does not settle domain spoofing. Compare mail routes and headers to separate spoofing, setup errors, and account compromise.
Setup and troubleshooting
How to set up SPF: DNS records, includes, and the difference between ~all and -all
Set up SPF for Google Workspace, Microsoft 365, and other senders. Learn to merge records, count DNS lookups, read headers, and diagnose SPF failures.
How to set up DKIM for Google Workspace and Microsoft 365
Configure DKIM with Google TXT records or Microsoft 365 CNAMEs. Understand selectors and 2,048-bit keys, verify real mail, and plan key rotation.
How to set up DMARC: publish your DNS record and verify real email
Create a DMARC TXT record, choose initial settings, enable RUA reports, and fix alignment failures. Includes worked headers and policy guidance for your domain.
SPF and DKIM Pass but DMARC Fails? How to Fix Domain Alignment
Diagnose DMARC alignment failures with real-format headers. Compare relaxed and strict modes, configure custom DKIM, and check forwarding, SRS, and ARC.
SPF, DKIM, and DMARC pass. Why is your email still in spam?
Email passes SPF, DKIM, and DMARC but lands in spam? Follow a newsletter investigation through headers, reputation, list changes, and real delivery checks.
Gmail and Outlook email bounces: read the error, find the cause
Read Gmail 550 5.7.26 and Outlook 5.7.515 errors, separate authentication failures from IP blocks, and follow a CRM example from diagnosis to a fresh test.
WordPress contact form emails not arriving? Check From before changing SMTP
Trace missing WordPress and Contact Form 7 emails through storage, From and Reply-To, SMTP, and domain authentication, then test both notification emails.
Reports and operations
DMARC Policies Explained: When to Use None, Quarantine, or Reject
Learn when to change DMARC policy, why a 99% pass rate can hide failed invoices, and how to review senders, forwarding, policy scope, and rollback plans.
How to Read DMARC RUA Reports: XML, Alignment, and Sending Sources
Read a sample DMARC XML report, diagnose 150 failed newsletters, investigate unknown senders, and troubleshoot missing RUA reports with worked examples.
DMARC Rollout Checklist: Find and Verify Every Sending Service
Use a downloadable sender inventory and eight-point checklist to verify newsletters, CRM, invoices, and automated mail before changing your DMARC policy.
DIY or managed DMARC? Compare the work behind the price
Compare DIY DMARC, reporting tools, and managed services by responsibility, internal time, pricing factors, DNS approval, data retention, and exit plans.
Email fraud cases
Supplier Impersonation in Korea: The Fraud Behind a Bank-Account Change
Explore KOTRA's reported supplier impersonation cases and a practical workflow for independently verifying bank-account changes before approving payment.
A US$42.3 Million Email Scam in Singapore: One Changed Character
Examine Singapore's 2024 supplier email scam: the i-to-l address change, frozen versus returned funds, DMARC's limits, and what to do after a transfer.
How supplier impersonation led two US companies to transfer over $120 million
Examine a $120 million supplier impersonation case, then follow a payment example to check the legal entity, bank account, and limits of email authentication.