Guides
What each record does, how receivers read it, and the mistakes we see most.
7 guides
-
Email DNS records: MX, SPF, DKIM and DMARC explained
What MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI records do, how receiving servers read them, and the mistakes that break delivery.
- MX: where mail for a domain goes
- SPF: who may send as the domain
- DKIM: a signature that survives forwarding
- DMARC: what to do when checks fail
- MTA-STS: make senders insist on TLS
- TLS-RPT: hear about TLS failures
- BIMI: a logo next to authenticated mail
- Sources
-
DNS blocklists: how they work and how to get delisted
How DNS blocklists (DNSBLs) answer, what their return codes mean, why a check can come back "unavailable", and what to do when your IP is listed.
- How a lookup works
- Return codes are not all listings
- Test points and health checks
- Why some lists refuse queries
- If your address is listed
- Sources
-
How to read email headers: route, delays, SPF, DKIM
How to read a message's headers: the Received route and its delays, Authentication-Results for SPF, DKIM and DMARC, ARC, and anti-spam fields.
- Getting the full headers
- Received: the route
- Delays
- Authentication-Results: what the receiver concluded
- ARC
- Anti-spam fields
- Sources
-
Testing an SMTP server: banner, STARTTLS, certificate
What an SMTP server check looks at: the greeting, EHLO capabilities, STARTTLS, TLS version, the certificate and reverse DNS, and why each one matters.
- The conversation
- TLS and the certificate
- Reverse DNS and FCrDNS
- Where the test comes from
- Sources
-
DMARC step by step: from p=none to reject
How to publish DMARC without losing mail: reports, SPF and DKIM alignment, subdomains, pct and moving gradually from p=none to quarantine and reject.
- When a message passes DMARC
- The record
- Step 1: p=none and reports
- Step 2: quarantine, gradually
- Step 3: reject
- Forwarding and mailing lists
- Subdomains
- Reports to another domain
- Sources
-
MTA-STS and TLS-RPT: enforce TLS without losing mail
How to publish MTA-STS and TLS-RPT step by step: the policy file, the DNS records, hosting, testing mode, the TLS reports and moving to enforce.
- What MTA-STS is made of
- The modes
- The mx patterns
- Hosting the file
- max_age
- TLS-RPT: the reports
- Moving to enforce, step by step
- Dropping MTA-STS
- Sources
-
Why emails go to spam and how to fix it
The technical reasons mail lands in spam: SPF, DKIM, DMARC, reverse DNS, blacklists, TLS, the header and unsubscribing, each with its test and its fix.
- What the large providers require
- SPF, DKIM and DMARC
- Reverse DNS
- Blacklists
- TLS
- The header
- Unsubscribing
- What one message cannot show
- The steps, in short
- Sources
The tools they explain
- Email DNS check MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI of a domain, each explained.
- DNS lookup Any record of a name: A, AAAA, MX, TXT, NS, SOA, PTR, CAA, SRV, with TTL, the CNAME chain and DNSSEC validation.
- Blacklist check Is an IP or domain listed on public DNS blocklists?
- Header analyzer Paste a message's headers: route, delays and authentication results.
- SMTP server check Banner, EHLO, STARTTLS, certificate and reverse DNS of each MX.
- SMTP error codes Paste a bounce or look up a code like 550 or 5.7.26: what it means, how Gmail and Microsoft 365 use it, what to do.
- Mail delivery test Send a message to a test address and see what the receiving server sees: SPF, DKIM, DMARC, reverse DNS, blacklists, TLS.
- SPF generator Tick the services that send mail for your domain and get the SPF record, checked live.
- SPF tree An SPF record's whole include and redirect chain, with DNS lookups counted as a receiver counts them and where the limit of 10 is crossed.
- DNS propagation The domain's DNS servers asked directly: do they all give the same answer and serial, and do resolvers still hold the old answer?
- Domain monitoring Get an e-mail when your domain lands on a blacklist, when SPF, DKIM or DMARC break, or when the mail server's certificate is about to expire.
- DMARC generator Policy, reports and alignment: the DMARC record ready to publish, with its report destinations checked.
- DMARC report analyzer Upload the aggregate reports you receive (XML, .gz, .zip): who sends in your domain's name, what passes and what fails.
- DKIM generator A DKIM key made in your browser, with the TXT record to publish and a check of it in DNS. The private key never reaches the server.
- MTA-STS generator The policy file, the _mta-sts record and TLS-RPT, checked against the domain's MX hosts.
- TLS report analyzer Upload the TLS-RPT reports you receive (JSON, .gz, .zip): which TLS deliveries to the domain failed, on which MX and why.