Guides
Understand email authentication, then fix it with confidence
Start with SPF, DKIM, DMARC, and MX fundamentals—or jump straight to a tested setup or troubleshooting guide.
Explore 104 focused playbooks for authentication, DNS, transport and delivery issues →
Foundations
What is DMARC? Email spoofing protection, explained
DMARC tells receiving mail servers how to handle messages that claim to be from your domain. Learn how alignment, policies, and reports stop spoofing without blocking real email.
What is SPF? The email sender list in your DNS
SPF is a DNS record listing the servers allowed to send email for a domain. Learn what SPF checks, how to read a record, its limits, and how it works with DMARC.
What is DKIM? A tamper-evident signature for email
DKIM adds a cryptographic signature to outgoing email so receivers can verify its signing domain and detect changes. Learn how keys, selectors, alignment, and verification work.
What is an MX record? How email finds your inbox
An MX record tells sending servers where a domain receives email. Learn how MX hosts, priorities, fallbacks, and DNS changes work without confusing inbound routing with authentication.
SPF vs DKIM vs DMARC: how the three fit together
SPF authorizes sending servers, DKIM signs messages, and DMARC connects those results to the visible From domain. Compare all three and see the safest setup order.
How-to guides
How to check SPF, DKIM, and DMARC for your domain
Check your domain's DNS records and a real sent message to verify SPF, DKIM, DMARC, and alignment. This step-by-step audit catches setup gaps static lookups miss.
How to create an SPF record without breaking existing senders
Build one valid SPF record from a complete sender inventory, publish it safely, stay below the 10-lookup limit, and verify the result with real email.
How to enable DKIM and verify that your email is really signed
Enable custom-domain DKIM in any email platform: create a selector and key, publish DNS, turn on signing, verify alignment, and rotate keys without downtime.
How to read an email bounce message and find the real cause
A repeatable five-step method for reading NDRs and bounce messages, separating retry behavior, standardized codes, provider detail, and the correct fix.
How to warm up an email domain (without getting throttled)
A practical domain warm-up plan: what reputation actually is, a week-by-week volume ramp, and the mistakes that get new domains throttled or spam-foldered.
Reference guides
DMARC record tags explained: p, rua, ruf, pct, adkim, aspf, and more
Understand every practical DMARC tag, which ones are required, which defaults are usually best, and how to build monitoring and enforcement records safely.
MX record priority explained: lower numbers, failover, and equal values
Learn how MX preference numbers control mail delivery order, what equal priorities mean, why backup MX servers can be risky, and how to verify a migration.
SMTP status codes explained: 2xx, 4xx, 5xx and enhanced codes
Decode SMTP reply and enhanced status codes, understand which digit controls retry behavior, and turn an email error into a useful diagnosis.
The email deliverability checklist: 24 checks before you press send
A working checklist covering authentication, DNS, list hygiene, content, and monitoring — every check that determines whether mail lands in the inbox.
DKIM selectors by provider: the reference list
Every major email provider's DKIM selector in one table — plus how to find the selector for any message from its headers.
Explainers
What is a Delivery Status Notification (DSN)?
Understand DSN bounce messages, including Final-Recipient, Action, Status, Remote-MTA, and Diagnostic-Code, without confusing them with read receipts.
SPF ~all vs -all: softfail vs hardfail, explained
The last term of your SPF record decides what happens to mail from servers you didn't authorize. Here's the real-world difference between ~all and -all in 2026, and which one to publish.
DMARC p=none vs quarantine vs reject: which policy should you use?
Your DMARC p= tag decides what happens to mail that fails authentication: nothing, spam folder, or refused. Here's what each policy actually does and when to move up.
DMARC alignment: why SPF and DKIM pass but DMARC still fails
SPF and DKIM can both pass while DMARC fails. The missing piece is alignment: the authenticated domain has to match the From address the recipient sees. Here's how it works and how to fix it.
How to read a DMARC report (with a real example)
DMARC aggregate reports arrive as gzipped XML that no human enjoys. Here's what each field means, how to spot spoofing vs misconfiguration, and how to stop reading XML entirely.
Why your emails go to spam: 8 causes, in order of likelihood
Emails landing in spam is a symptom with a short list of causes. Here are the eight that account for nearly every case, ordered by how often they're the culprit, each with its fix.
Comparisons
DSN vs MDN: delivery receipts are not read receipts
Compare Delivery Status Notifications and Message Disposition Notifications, including what each can prove and why neither guarantees human attention.
HealthCheck Email vs MXToolbox: which email-health tool fits you?
Compare HealthCheck Email and MXToolbox for domain diagnostics, DMARC monitoring, guided fixes, deliverability troubleshooting, and multi-domain management.
HealthCheck Email vs EasyDMARC: simple monitoring or a broader platform?
Compare HealthCheck Email and EasyDMARC for guided monitoring, managed authentication, SPF/DKIM tooling, reputation checks, agencies, and enterprise needs.
HealthCheck Email vs dmarcian: approachable monitoring or enterprise depth?
Compare HealthCheck Email and dmarcian for plain-English monitoring, source analysis, alerts, enterprise governance, APIs, SSO, and multi-domain deployments.
HealthCheck Email vs PowerDMARC: focused health monitoring or security suite?
Compare HealthCheck Email and PowerDMARC for DMARC monitoring, enforcement, forensic reporting, MSP/MSSP programs, usability, and domain-health workflows.
Alternatives
The best MXToolbox alternatives for email health and deliverability
Compare MXToolbox alternatives for plain-English domain health, DMARC management, enterprise governance, MSP workflows, and inbox-placement testing.
The best EasyDMARC alternatives for different email-security teams
Compare EasyDMARC alternatives for simpler domain monitoring, enterprise governance, MSP resale, transport security, and broad technical diagnostics.
The best dmarcian alternatives, from simple monitoring to MSP platforms
Compare dmarcian alternatives for simpler monitoring, managed authentication, MSP/MSSP programs, SPF and transport security, and broad diagnostics.
Fix-it guides
SPF PermError: too many DNS lookups — how to fix it
SPF has a hard limit of 10 DNS lookups. Go over it and receivers see a PermError, which DMARC treats as a fail. Here's how to count your lookups and get back under the limit.
Multiple SPF records: why it breaks everything and how to merge them
Two SPF records don't add up — they cancel out. Receivers treat multiple SPF records as a PermError, i.e. a fail. Here's how to merge them into one record correctly.
DKIM "body hash did not verify" — what it means and how to fix it
The 'body hash did not verify' DKIM failure means the message changed after it was signed. Here's what modifies email in transit and how to fix each cause.
Setup guides
How to set up DMARC, step by step (without breaking your email)
A DMARC record is one TXT record — but a safe DMARC deployment is a sequence. The full path from nothing to p=reject, with the exact records to publish at each step.
How to add an SPF record in GoDaddy (plus DKIM and DMARC)
Step-by-step: add SPF, DKIM, and DMARC records in GoDaddy's DNS manager, including the Name-field quirk that silently breaks records.
How to add SPF, DKIM and DMARC records in Cloudflare
Add SPF, DKIM, and DMARC records in Cloudflare DNS — including the proxy setting that breaks DKIM CNAMEs if you leave it orange.
How to add an SPF record in Namecheap (plus DKIM and DMARC)
Add SPF, DKIM, and DMARC records in Namecheap's Advanced DNS tab — field by field, with the host-name convention that trips people up.
Squarespace DKIM, SPF and DMARC: adding email DNS records
How to add SPF, DKIM, and DMARC records to a Squarespace-managed domain, including where Email Campaigns sender authentication fits in.
Shopify SPF and DKIM: authenticating your store's email domain
How Shopify email authentication actually works: verify your sender domain in admin, add the records Shopify generates, and set up DMARC.