Blog
Notes on email authentication
Practical articles on DMARC, SPF, DKIM, MTA-STS and email deliverability from the DMARCHub Team.
Product updates · 18 September 2026 · 6 min read
What's new in DMARCHub v0.53: managed SPF, DNSSEC and guided MTA-STS
DMARCHub v0.53 is live. Managed SPF with flattening on selected plans, DNSSEC on the DNS Monitoring tab, up to three extra DMARC reporting addresses and a guided MTA-STS setup. Here is what each change does and what, if anything, it asks of you.
Deliverability · 18 September 2026 · 5 min read
Does DMARC improve deliverability?
DMARC is often sold as a deliverability fix. The truth is more nuanced: authentication is now a prerequisite for reaching major mailbox providers, but it will not rescue mail with poor content or a stale list. Here is what DMARC genuinely does for inbox placement, and what it cannot do.
Advanced topics · 8 September 2026 · 9 min read
What is MTA-STS? Strict transport security for email explained
STARTTLS encrypts email in transit, but an attacker on the network path can strip it without either server noticing. MTA-STS closes that gap: a DNS record plus a small HTTPS policy file that tells sending servers your domain requires encrypted, certificate-validated delivery. Here is how the mechanism works and how to deploy it safely.
Email authentication fundamentals · 25 August 2026 · 8 min read
DMARC alignment explained: SPF and DKIM alignment in practice
SPF passed, DKIM passed, and DMARC still failed. The missing piece is identifier alignment: DMARC only counts a pass when the domain that passed matches the domain in the From header. This guide explains how SPF and DKIM alignment actually work, the difference between relaxed and strict modes, and how to fix the misalignment you find in your reports.
Reports and monitoring · 17 August 2026 · 8 min read
How to read DMARC reports
DMARC aggregate reports arrive as dense XML, but the questions they answer are simple: who is sending mail as your domain, from where, and is it passing authentication? This guide walks through the structure row by row and shows you what to fix first.
Email authentication fundamentals · 11 August 2026 · 9 min read
SPF, DKIM and DMARC: how email authentication works together
SPF, DKIM and DMARC are often described as three separate checks, but they only make sense as one system. This guide walks through what each protocol verifies, what DMARC adds on top, and follows a single message through the full evaluation from connection to inbox.
Email authentication fundamentals · 11 August 2026 · 8 min read
What is DKIM? DomainKeys Identified Mail explained
DKIM lets a receiving mail server prove that a message really came from your domain and was not altered in transit. Here is how signatures, selectors and public keys in DNS fit together, why DKIM usually survives forwarding when SPF does not, and why you still need DMARC on top.
Email authentication fundamentals · 11 August 2026 · 8 min read
What is SPF? Sender Policy Framework explained
SPF lets a domain publish the mail servers allowed to send on its behalf, and lets receivers check each message against that list. Here is how the check actually works, which address it inspects, why forwarding breaks it, and why SPF on its own does not stop spoofing.
Email authentication fundamentals · 11 August 2026 · 9 min read
What is DMARC? A complete guide
DMARC lets you tell the world's mailbox providers what to do with email that pretends to come from your domain, and sends you reports showing who is really using it. This guide explains how DMARC builds on SPF and DKIM, what a policy actually does, and how to start protecting your domain.