Guides

Which DKIM RSA key size to publish, why 512 and 768-bit keys fail, why a 2048-bit key is split into several TXT strings, how to rotate to 2048, and where Ed25519 fits.

SPF pass and DKIM pass do not satisfy DMARC unless one of them uses your From domain. How identifier alignment works and how to fix it in Google Workspace, Microsoft 365, Mailchimp, SendGrid and Amazon SES.

Two TXT records at _dmarc make receivers discard both, so your domain has no DMARC policy. How to find the duplicates, merge them into one record and check the result.

How to move a DMARC policy from none to quarantine to reject without losing legitimate mail: read reports first, use sp and np, and replace pct ramp-up with t=y under RFC 9989.

How to read DMARC aggregate (rua) XML reports, what ruf failure reports contain and why few receivers send them, and how _report._dmarc authorizes third-party addresses.

What the DMARC checker's errors mean: v=DMARC1 not first, missing p, wrong separators, invalid rua or ruf URIs, multiple records, and common typos, with corrected examples.

DNS changes do not spread; resolvers keep old answers until the TTL runs out. Learn why checks disagree, how negative caching delays new records, why '48 hours' is a myth, and how to check.

What each common DNS record type does, with an example for A, AAAA, CNAME, MX, NS, TXT, SOA, CAA, SRV, PTR, DS and DNSKEY, plus the CNAME-at-apex restriction and how to look each one up.

Get the full headers in Gmail, Outlook, Apple Mail, Yahoo or Thunderbird, then read them bottom-up: delays, SPF/DKIM/DMARC results, ARC, and which header lines you can trust.

An MX record must point to a hostname with A or AAAA records, not to a CNAME alias. See the symptoms, why RFC 2181 and RFC 5321 forbid it, and how to replace the alias.

Your MX record points to a name with no A or AAAA record. Learn the usual causes (typo, missing trailing dot, deleted host), how mail fails under RFC 5321, and how to repair it.

A null MX record, 'MX 0 .', tells senders a domain accepts no email so they fail at once. When to use it, the 556 5.1.10 and 5.7.27 bounces, and pairing with SPF -all and DMARC reject.

Mail servers need a PTR record whose hostname resolves back to the same IP (FCrDNS). Who can set it, what Google and Microsoft say, and how to fix 550 5.7.25 and 451 4.7.23 errors.

Publish a DKIM public key at selector._domainkey, choose TXT or CNAME, size the key, split long values, rotate and revoke keys, and find your selector in message headers.

Publish a DMARC TXT record at _dmarc, understand p, sp, rua, ruf, pct, adkim, aspf and fo, roll out none, quarantine, reject safely, and authorize external report addresses.

Create MX records that deliver mail: hostname targets, priorities, why a CNAME or IP breaks them, apex versus subdomain, null MX for domains that receive no mail, and migrating with TTL.

Exact DNS records for Google Workspace email: MX smtp.google.com, SPF include:_spf.google.com, a DKIM key generated in the Admin console, and a DMARC rollout from p=none to p=reject.

DNS records for Microsoft 365 email: tenant MX from the admin center, SPF include:spf.protection.outlook.com, two DKIM CNAMEs (selector1, selector2) and a staged DMARC rollout. GCC High and 21Vianet variants included.

DNS records for Zoho Mail: MX from your Admin Console, SPF include:zohomail.com, a DKIM TXT with a selector you choose, and a DMARC rollout from p=none to p=reject.

Publish one SPF TXT record per domain: syntax, qualifiers, combining several senders, ~all versus -all, and the 10-lookup and void-lookup limits from RFC 7208.

More than one v=spf1 TXT record makes SPF return permerror. How to find the extra record, merge the includes of every provider into one, and stay under 10 lookups.

What ~all, -all, ?all and +all tell receivers, what they actually do with each result, and which to publish given DMARC. RFC 7208 results explained.

Fix SPF permerror caused by typos: unknown mechanisms, include without a domain, bad ip4 values, +all, terms after all, and includes that point at a domain with no SPF.

RFC 7208 allows 10 DNS-querying terms. Here is how the count works, which terms cost a lookup, and four ways to get back under the limit.

Cut the TTL ahead of a DNS change, wait at least the old TTL, switch, then raise it again. Includes timing, the NS and DS exceptions set at the parent zone, and a checklist.