8 min read
SPF record syntax explained
Every SPF mechanism and qualifier, with examples, and how to stay under the 10-lookup limit.
Guides
Background reading for the checks. Every guide links to the tool that tests what it explains.
9 min read
How to set up DMARC, step by step
A staged setup plan from monitoring to full enforcement, with report review checkpoints at each stage.
5 min read
DKIM key rotation
How to rotate DKIM keys safely, without breaking mail already in flight, using selector overlap.
5 min read
How MTA-STS and TLS-RPT work together
How MTA-STS enforces encrypted mail delivery and TLS-RPT gives you visibility into failures, and why they pair together.
5 min read
How to read a DNS lookup result
A plain-language walkthrough of record types, TTLs and authoritative versus resolver answers.
5 min read
BIMI requirements explained
Every BIMI requirement explained: DMARC enforcement, the SVG logo format, and when a Verified Mark Certificate matters.
5 min read
Why MX records matter
What an MX record actually does, how priority and fallback work, and what happens when a domain has none.
5 min read
Email authentication checklist
A practical, ordered checklist covering SPF, DKIM, DMARC, BIMI, MTA-STS and TLS-RPT.
11 min read
DNS record types explained
What every DNS record type actually does, read from real lookups, and the mistakes each one invites.
8 min read
What DNS propagation is, and why it takes as long as it does
Why a DNS change is not visible everywhere at once, what actually sets the wait, and how to plan a cutover around it.
10 min read
Fix SPF PermError: too many DNS lookups
Why SPF stops working past ten DNS lookups, how to count yours, and the four fixes in order of least regret.
10 min read
DMARC record examples and tag reference
Every tag RFC 9989 defines, with defaults and worked examples, and the tags the 2026 revision removed.
8 min read
How to find your DKIM selector
Selectors are not discoverable from DNS. Three reliable ways to find yours, and what each major platform uses.
10 min read
How to read email headers
Read headers the way a mail server does: the Received chain bottom-up, the authentication verdict, and what a forgery looks like.
10 min read
Gmail and Yahoo sender requirements: a checklist
What Google, Yahoo and Microsoft each require from senders, where they differ, and the order to fix things in.
9 min read
How to set up MX records for Google Workspace and Microsoft 365
The current MX records for both platforms, where your own values come from, and how to cut over without losing mail.
14 min read
PTR records and reverse DNS
Why the PTR record for your server is not in your own DNS, who can publish it, and what mail receivers actually check.
12 min read
Common DMARC failures explained
Why SPF and DKIM can pass while DMARC fails, what alignment actually requires, and how to identify and fix each class of failure from an aggregate report.
16 min read
SSL certificate expired: how to check and renew
What expiry actually does to visitors and API clients, how to check the whole chain, and how to renew, automate and monitor it.
19 min read
HTTP security headers explained
What each security header actually does, which ones are obsolete, and how to deploy CSP and HSTS without breaking the site.
16 min read
Fixing redirect chains
What a chain and a loop are, what each 3xx status really means, and how to collapse the usual four hops into one.
15 min read
CAA records explained
What CAA actually prevents, the exact record values for the common authorities, and how to publish one without blocking your own renewal.
17 min read
DNSSEC explained, and how to enable it safely
What signing a zone actually proves, how the chain of trust is built, and how to turn DNSSEC on and off without an outage.
15 min read
Core Web Vitals explained
What LCP, INP and CLS measure, the current thresholds, why field and lab data disagree, and the fixes for each.
19 min read
How to remove your IP from an email blacklist
What a blocklist listing actually means, how to read the return code, how to fix the cause, and how delisting works at each major operator.
18 min read
Email deliverability checklist
Everything that decides inbox placement once SPF, DKIM and DMARC are already correct: reputation, reverse DNS, warm-up, list hygiene, complaints, unsubscribe, TLS and the monitoring loop.
17 min read
WHOIS vs RDAP: how to find out who owns a domain
How RDAP replaced WHOIS, what an RDAP response contains, which EPP status codes matter, and how to find who really runs a domain.
16 min read
ASNs and IP ownership: who runs the network behind an address
What an autonomous system is, how to look up the network behind an IP address, and how far the public data can honestly take you.
17 min read
How to test whether a port is open
What open, closed and filtered actually mean, how to test from the outside, and which ports are worth worrying about.