Knowledge Base

Set up SPF and DKIM for the tools that send as you.

• Google Workspace SPF and DKIM setup

  Publish SPF, turn on DKIM, and avoid the two-step activation trap that quietly leaves Google Workspace mail unsigned.

• Microsoft 365 SPF and DKIM setup

  The exact SPF record, the two DKIM CNAMEs to copy out of the Defender portal, and the onmicrosoft.com alignment trap that fails your mail.

• Amazon SES SPF and DKIM setup

  Why Easy DKIM, not the SPF include everyone pastes, is what aligns SES mail, plus the custom MAIL FROM and the per-region trap.

• Twilio SendGrid SPF and DKIM setup

  Run Domain Authentication, publish the CNAMEs SendGrid generates, and dodge the DNS host trap that doubles your record names.

• Mailchimp SPF and DKIM setup

  Authenticate your domain (not just verify it) with two CNAMEs, and why Mailchimp's old SPF step is gone.

• Klaviyo SPF and DKIM setup

  Set up a branded sending domain, send from your root domain (not the subdomain), and skip the SPF record you do not need.

• HubSpot SPF and DKIM setup

  Connect your email sending domain, copy the two DKIM CNAMEs and SPF from the console, and clear the gate that blocks sending as your domain.

• Mailgun SPF and DKIM setup

  Publish SPF and DKIM on your sending subdomain, use the right DKIM selector, and avoid the from-address trap that breaks alignment.

• Postmark SPF and DKIM setup

  Publish DKIM and the Return-Path CNAME, skip SPF, and learn why an SPF-fail in your DMARC reports is expected and harmless.

• Brevo SPF and DKIM setup

  Authenticate your domain (formerly Sendinblue), publish the Brevo code and DKIM records, and keep the records you must never delete.

• Constant Contact SPF and DKIM setup

  Turn on self-authentication with two DKIM CNAMEs, skip SPF, and fix the silent from-address rewrite that means you are not done yet.

• ActiveCampaign SPF and DKIM setup

  Publish the two DKIM CNAMEs, let ActiveCampaign handle SPF, and clear the Verified-is-not-aligned trap that fails DMARC.

• Salesforce SPF and DKIM setup

  Which records you publish depends on which Salesforce you send from: Sales and Service Cloud, Account Engagement (Pardot), or Marketing Cloud.

• Zoho SPF and DKIM setup

  Zoho Mail and Zoho Campaigns have separate setups: the records for each, the region-specific Campaigns include, and why one does not cover the other.

• Zendesk SPF and DKIM setup

  Make Zendesk send support mail as your domain: the two DKIM CNAMEs, the enable-DKIM-last rule, and the DMARC step Zendesk skips.

• Shopify SPF and DKIM setup

  Authenticate your sender domain with the CNAMEs that handle DKIM and SPF, and stop the silent rewrite to shopifyemail.com.

• Intercom SPF and DKIM setup

  Publish the two CNAMEs that align both SPF and DKIM, and learn why verifying an address is not authenticating the domain.

• MailerLite SPF and DKIM setup

  Publish the litesrv DKIM CNAME plus SPF, and dodge the appended-domain trap that breaks the records.

• GetResponse SPF and DKIM setup

  Publish the DKIM TXT record, skip the optional SPF, and avoid the status that quietly sends via GetResponse.

• Campaign Monitor SPF and DKIM setup

  Publish the cm DKIM TXT plus SPF and DMARC, and know why a verified domain is not signing for the first 30 minutes.

• AWeber SPF and DKIM setup

  Publish the three DKIM CNAMEs, skip SPF, and avoid the free-address rewrite that strips your branding.

• Kit (ConvertKit) SPF and DKIM setup

  Set up a Verified Sending Domain with two CNAMEs (still ck-prefixed after the rebrand) that align both SPF and DKIM.

• Mailjet SPF and DKIM setup

  Publish the SPF include and the mailjet._domainkey DKIM record, and validate the whole domain, not just an address.

• SparkPost SPF and DKIM setup

  Publish the scph DKIM record that aligns by default, plus the optional SPF include and bounce domain for SPF alignment.

• Freshdesk SPF and DKIM setup

  Make Freshdesk send support mail as your domain: the four fwdkim CNAMEs, the forwarding, and why DKIM is now mandatory.

• Marketo SPF and DKIM setup

  Publish SPF and DKIM for Adobe Marketo Engage, and learn why DKIM (not the SPF include) is what carries DMARC.

• Front SPF and DKIM setup

  Find out which Front channel needs SPF and DKIM, copy the records from the Deliverability panel, and use relaxed alignment.

• Help Scout SPF and DKIM setup

  Publish the two fixed strong1 and strong2 DKIM CNAMEs, skip SPF, and avoid the DNS-proxy setting that breaks signing.

• SMTP2GO SPF and DKIM setup

  Verify your sender domain with three CNAMEs that handle SPF, DKIM, and tracking, with no SPF include to add.

• Pipedrive SPF and DKIM setup

  Email sync needs no DNS; Pipedrive Campaigns needs domain authentication. The records, and the verify-sender trap.

• Drip SPF and DKIM setup

  Three CNAMEs, no SPF include, and the s1/s2 selector clash that keeps Drip from verifying.

• Mandrill SPF and DKIM setup

  Mailchimp's transactional product: two mte1/mte2 DKIM CNAMEs, a required DMARC record, and no SPF include.

• MailerSend SPF and DKIM setup

  Two DKIM CNAMEs, one SPF include, and the mta return-path record that makes MailerSend SPF align.

• Resend SPF and DKIM setup

  The resend._domainkey DKIM TXT, the send-subdomain MX and SPF, and why root SPF is the wrong place.

• Customer.io SPF and DKIM setup

  Four records on a cio##### subdomain, DMARC on the root, and the strict-alignment tag that breaks it.

• SocketLabs SPF and DKIM setup

  SPF include, CNAME or TXT DKIM, and the bounce domain that stops the 'via email-od.com' label.

• Iterable SPF and DKIM setup

  Iterable's records live on Settings > DNS Setup; one sending domain by default, and the toggle resets verification.

• Pardot SPF and DKIM setup

  Verify the domain, publish the DomainKey TXT, skip the SPF include: Pardot passes DMARC on DKIM alone.

• Fastmail SPF and DKIM setup

  MX, the messagingengine SPF include, three fm._domainkey CNAMEs, and why Fastmail's SPF ends in ?all.

• Proton Mail SPF and DKIM setup

  MX, SPF, and the three rotating DKIM CNAMEs for a Proton Mail custom domain, plus the legacy TXT key trap.

• IONOS SPF and DKIM setup

  Regional SPF include, three DKIM CNAMEs for external DNS, and the name-server move that silently drops DKIM.

• Rackspace Email SPF and DKIM setup

  The emailsrvr.com SPF include, the DKIM switch in the Cloud Office Control Panel, and the DNS-host catch.

• Mimecast SPF and DKIM setup

  Regional _netblocks include, the Outbound Signing definition plus policy for DKIM, and the unsaved-key trap.

• Barracuda Email Gateway Defense SPF and DKIM setup

  The regional Barracuda SPF include, why DKIM stays on your mail platform, and the footer that breaks it.

• Loops SPF and DKIM setup

  Loops puts SPF on an envelope subdomain and requires an MX record there; here is the full set.

• Proofpoint Essentials SPF and DKIM setup

  Authorize the Proofpoint relay in SPF and turn on its console-generated DKIM key, per region.

• Gorgias SPF and DKIM setup

  Verify your domain in Gorgias: the gor and gor2 DKIM CNAMEs, the em return path, and the TXT variant.

• Bird SPF and DKIM setup

  DKIM TXT plus a send. return-path CNAME; Bird never asks for an apex SPF include.

• Squarespace SPF and DKIM setup

  One DKIM CNAME, a generated _dmarc TXT, no SPF record, and automatic when Squarespace owns the domain.

• Sender SPF and DKIM setup

  The sendersrv.com include, the sender._domainkey CNAME, and the ?all and bare p=none defaults to fix.

• BigCommerce SPF and DKIM setup

  One SPF include, no DKIM record to add, and why that makes SPF the only thing carrying your order mail.

• Mailtrap SPF and DKIM setup

  Four CNAMEs, two rwmt DKIM selectors, and no SPF include to copy: Mailtrap Email Sending verified.

• SMTP.com SPF and DKIM setup

  The _spf.smtp.com include, the smtpkey CNAME, and why support has to switch DKIM signing on.

• Emarsys SPF and DKIM setup

  Sending subdomain, key5 and key6 DKIM CNAMEs, and the bounces CNAME that makes SPF align.

• Yandex 360 SPF and DKIM setup

  MX, redirect= SPF, and the mail._domainkey DKIM key for Yandex-hosted mailboxes, with the second-sender trap.

• Kayako SPF and DKIM setup

  Three CNAMEs, one SPF include, and a DKIM checkbox you must not tick until DNS is live.

• Wix SPF and DKIM setup

  Wix authenticates by CNAME, not TXT, and its fifth record wants your _dmarc name. Here is how to keep both.

• Netcore Email API SPF and DKIM setup

  Netcore (ex-Pepipost): SPF include, DKIM record, envelope CNAME, and the approval step after DNS.

• Greenhouse SPF and DKIM setup

  Why Greenhouse puts its records on a gh-mail subdomain, the MX it needs, and when to register with a ! prefix.

• HappyFox SPF and DKIM setup

  The spf.happyfox.com include, two DKIM CNAMEs, and the fallback that rewrites unverified channels.

• DocuSign SPF and DKIM setup

  Get envelope notifications off dse@docusign.net: claim, subdomain, two DKIM CNAMEs, SPF, MX.

• Lever SPF and DKIM setup

  No Lever DNS record exists: authenticate the Google or Microsoft mailbox Lever sends through.

• Omnisend SPF and DKIM setup

  Omnisend's generated SPF, DKIM, and DMARC TXT records, and why Verified needs all three found plus a sender address on that exact domain.

• Moosend SPF and DKIM setup

  The spfa.mailendo.com SPF include and ms._domainkey DKIM TXT, plus the rule that Moosend verifies SPF, DKIM, and DMARC in one pass.

• SendPulse SPF and DKIM setup

  The mxsspf.sendpulse.com include, the sign._domainkey DKIM TXT key, and why the From domain must match the activated Sending domain.

• Benchmark Email SPF and DKIM setup

  Two account-specific CNAMEs (SPF and DKIM), the DMARC record Benchmark requires, and the clients.bmsend.com rewrite you get without them.

• Elastic Email SPF and DKIM setup

  The _spf.elasticemail.com include, the api._domainkey DKIM TXT, the optional tracking CNAME, and the custom bounce domain that makes SPF align.

• Braze SPF and DKIM setup

  Braze sends through SendGrid, SparkPost, or Amazon SES on a dedicated subdomain. Which records you are handed for each, and why your apex only gets DMARC.

• Salesforce Marketing Cloud SPF and DKIM setup

  Marketing Cloud Engagement's Sender Authentication Package or Private Domain: delegate the subdomain or publish the zone file, then fix the hidden DMARC rua.

• Atlassian SPF and DKIM setup

  Send Jira and Confluence notifications from your domain: the Atlassian email domain, _spf.atlassian.net, two DKIM CNAMEs, the bounce CNAME, and DMARC.

• Calendly SPF and DKIM setup

  Calendly has no SPF include or DKIM key. Which of its three notification paths sends as your domain, and what that means for your reports.

• Typeform SPF and DKIM setup

  Authorize an Automation email domain in Admin settings: two pdk DKIM CNAMEs, the mailgun.org SPF include, and why form notifications stay on Typeform.

• Substack SPF and DKIM setup

  Substack never sends from your domain. Why there is no SPF include or DKIM selector to publish, and what the paid custom domain actually changes.

• beehiiv SPF and DKIM setup

  Send your beehiiv newsletter from your own domain: the ownership TXT and three CNAMEs, the DMARC record beehiiv requires, and the Verified vs In use trap.

• Ghost SPF and DKIM setup

  Ghost(Pro) custom sending domain on the Publisher plan, the Mailgun records a self-hosted newsletter publishes, the required DMARC record, and the six-week warm-up.

• Mailmodo SPF and DKIM setup

  The DKIM TXT, bounce CNAME, and DMARC TXT Mailmodo generates for each sender domain, why there is no SPF include, and the hostname suffix trap behind Refresh and Verify.

• Dotdigital SPF and DKIM setup

  Dotdigital puts a custom from address on a brand-new subdomain it controls via NS delegation, and the DMARC reports for it go to Dotdigital unless you ask support to add you.

• Ortto SPF and DKIM setup

  Ortto (formerly Autopilot) authenticates a custom domain with three per-account CNAMEs, treats SPF as optional, and quietly falls back to autopilotmail.com while a domain is pending.

• SendLayer SPF and DKIM setup

  Five records on the sl subdomain, all copied from the dashboard, plus the DMARC CNAME that is not your DMARC record and the strict-alignment trap.

• Amazon WorkMail SPF and DKIM setup

  The AWS mailbox product that sends through SES: ownership TXT, MX, AutoDiscover, three DKIM CNAMEs, the MAIL FROM that aligns SPF, and the 2027 shutdown.

• iCloud Mail SPF and DKIM setup

  Custom Email Domain on iCloud+: the include:icloud.com SPF, the sig1._domainkey DKIM CNAME with your domain inside the target, and the MX cutover.

• Namecheap Private Email SPF and DKIM setup

  Private Email mailboxes: the spf.privateemail.com include, the two MX records, and the DKIM TXT whose hostname depends on when you bought the subscription.

• Keap SPF and DKIM setup

  Keap's three app-named CNAMEs, the include:infusionmail.com SPF line, the DMARC record it offers to write, and how it rewrites a Gmail From address.

• Ontraport SPF and DKIM setup

  Ontraport's Entri-driven Custom Domains flow, the single ontraport._domainkey CNAME it publishes, the paid-only and From address rules, and what still sends as ontramail.

• EmailOctopus SPF and DKIM setup

  Publish the four CNAMEs and the DMARC TXT EmailOctopus generates, understand the eom. return path, and stop it rewriting your From address to eomail1.com.

• Buttondown SPF and DKIM setup

  Delegate a sending subdomain to Buttondown with two NS records or publish its manual Postmark records, free on every plan, and check what that does to your DMARC.

• Sendy SPF and DKIM setup

  Sendy sends through Amazon SES, so the DKIM CNAMEs and custom MAIL FROM are SES records, not Sendy records. What to verify, and how the brand From email decides DMARC.

• WordPress SPF and DKIM setup

  Default wp_mail sends from your web host with no DKIM and fails DMARC. How to route it through an SMTP or API mailer, and why Force From Email alone makes it worse.

• Webflow SPF and DKIM setup

  Webflow sends form notifications from no-reply-forms@webflow.com or no-reply@webforms.io, never your domain, so there is nothing to publish and DMARC is Webflow's job.

• Hostinger Email SPF and DKIM setup

  The fixed Hostinger Email record set (mx1/mx2, one SPF include, three hostingermail DKIM CNAMEs), one-click publish on Hostinger nameservers, and the Titan Email mix-up.

• Okta SPF and DKIM setup

  Okta's custom email address is SendGrid underneath: one verification TXT, a return-path CNAME, two DKIM CNAMEs, and a documented reason to use a dedicated subdomain.

• Auth0 SPF and DKIM setup

  Auth0's built-in sender is test-only and mails from no-reply@auth0user.net. Which provider to plug in, whose SPF and DKIM records you publish, and the From-address trap.

Add the records in your DNS host, step by step.

• Adding DMARC, SPF, and DKIM records in GoDaddy

  The exact path through GoDaddy's current DNS editor, the @ apex rule, the doubled-hostname trap, and why you no longer split long DKIM keys by hand.

• Adding DMARC, SPF, and DKIM records in Namecheap

  Namecheap's Advanced DNS panel step by step, the Save all changes step people forget, and the Email Forwarding setting that injects a locked SPF record.

• Adding DMARC, SPF, and DKIM records in AWS Route 53

  The Route 53 console path, the mandatory double-quote rule, multi-string DKIM keys, the blank-apex rule, and the least-privilege IAM for a one-click connection.

• Adding DMARC, SPF, and DKIM records in Google Cloud DNS

  The Cloud DNS console path, why the apex name is blank not @, the Add item split that long DKIM keys need, and the dns.admin role (there is no dns.editor).

• Adding DMARC, SPF, and DKIM records in Azure DNS

  The Azure portal Record sets path, the @ apex rule, why Azure is the easiest provider for long DKIM keys, and the DNS Zone Contributor role you need.

• Adding DMARC, SPF, and DKIM records in Cloudflare

  The Cloudflare DNS path, why the orange-cloud proxy never touches your TXT records, the Email Routing SPF clash to merge, and how Cloudflare handles long DKIM keys for you.

• Adding DMARC, SPF, and DKIM records in Squarespace

  Where Google Domains moved: the Custom Records path, why your nameservers may still say googledomains.com, and the Text field label that trips people up.

• Adding DMARC, SPF, and DKIM records in Hostinger

  The two ways into Hostinger's hPanel DNS editor, the dns-parking.com nameserver check, the @ apex rule, and the one-email-provider trap that breaks SPF.

• Adding DMARC, SPF, and DKIM records in IONOS

  The IONOS control-panel path, the dedicated IONOS SPF entry, why DKIM is a CNAME for IONOS mail, and how it differs for a third-party sender.

• Adding DMARC, SPF, and DKIM records in Bluehost

  The current Bluehost Portal path (not cPanel), the Refers to dropdown, and the default SPF record you must delete before adding your own.

• Adding DMARC, SPF, and DKIM records in Wix

  Why a pointed domain edits DNS at the registrar (not Wix), the Manage DNS Records path, and why the apex Host Name is left blank instead of @.

• Adding DMARC, SPF, and DKIM records in OVHcloud

  The OVHcloud Add an entry wizard, why the apex sub-domain is left blank, the default 3600 TTL, and the Reset zone button to avoid.

• Adding DMARC, SPF, and DKIM records in DigitalOcean

  Infrastructure DNS with no built-in mail: the Networking path, the @ apex, splitting a long DKIM key into quoted strings, and the doctl and Terraform alternatives.

• Adding DMARC, SPF, and DKIM records in Porkbun

  The Porkbun Answer field, the blank apex, the 600-second TTL, and the default pixie.porkbun.com parking records to delete before you set up real DNS.

• Adding DMARC, SPF, and DKIM records at any provider

  The universal walkthrough: find who actually hosts your DNS, open the TXT editor in any panel, paste the right value for each record, and verify it published.

How email authentication actually works.

• What is ARC (Authenticated Received Chain)?

  When a mailing list or forwarder rewrites your mail, SPF and DKIM break and DMARC fails. ARC is how the next hop preserves the original verdict. What it is, when it helps, and its limits.

• Envelope-from vs header-from: the two sender addresses

  Email has two From addresses: the envelope-from your server uses for bounces, and the header-from your recipient sees. SPF checks one, DMARC judges the other. The difference, and why it matters.

• The DMARC fo tag and failure (ruf) reports

  The DMARC fo tag controls when a receiver sends a per-message failure report. What each value means, why the big providers no longer send these reports, and what to use instead.

Decode the bounce. Fix the failure.

• Gmail 550 5.7.26: why your mail bounced and how to fix it

  Gmail now rejects bulk mail that isn't authenticated. What the 550 5.7.26 bounce actually means, the three things that cause it, and how to confirm you've fixed it.

• 550 5.7.1: email rejected per DMARC policy, and how to fix it

  On Microsoft 365, a 550 5.7.1 rejection usually means your mail failed DMARC. Why it isn't always DMARC, the authenticated-but-unaligned trap, and the fix.

• 550 5.7.23: your mail failed SPF, and how to fix it

  Microsoft's 550 5.7.23 and Gmail's 5.7.27 mean a receiver checked SPF and the sending IP wasn't authorized. The usual causes, including the High Risk Delivery Pool, and the fix.

• SPF PermError: too many DNS lookups, and how to fix it

  SPF allows only 10 DNS lookups. Cross the limit and receivers return permerror, which counts as not passing and can take DMARC with it. What counts, and how to come back under.

• Reverse DNS and PTR records: why mail gets rejected

  Strict receivers reject mail from IPs with missing or mismatched reverse DNS (Gmail 550 5.7.25). What forward-confirmed reverse DNS is, where the PTR record lives, and how to fix it.

• Yahoo 554 5.7.9 and Gmail bulk-sender errors, decoded

  Yahoo's 554 5.7.9 and Gmail's 4.7.x and 5.7.x bulk-sender codes, decoded. Which mean fix your authentication, and which mean slow down and fix reputation.

• DKIM failed (dkim=fail): why your signature did not verify

  A dkim=fail means your DKIM signature did not verify. The handful of things that cause it (a modified body is the big one), and how to fix each.

• SMTP error codes: how to read an email bounce

  Every bounce carries an SMTP reply code and an enhanced status code. How to read them, the rule that says retry or fix, and what the common authentication codes mean.

• SPF ~all vs -all: softfail, hardfail, and which to use

  The qualifier at the end of your SPF record decides what receivers do with unlisted senders. The difference, what receivers actually do, and why DMARC changes the choice.

What each SMTP bounce code means, and whose problem it is.

• 550 5.7.515: Microsoft wants SPF, DKIM, and DMARC before it takes your mail

  Outlook and Microsoft 365 hard-reject senders that miss the 2025 bulk-sender authentication bar. What 5.7.515 means and how to pass it.

• 550 5.7.509: rejected because your DMARC policy says reject

  Microsoft honored the p=reject your domain publishes and refused a message that failed DMARC. Why your own mail can trip it, and the alignment fix.

• 550 5.7.511: your sending address or domain is on Microsoft's block list

  What the 5.7.511 access-denied bounce means, how domains end up banned at Outlook, and the delisting path through Microsoft sender support.

• 550 5.7.606: your sending IP is banned at Microsoft

  The 5.7.606 to 5.7.649 range means Outlook blocked the IP itself. How to check whether it is your IP or your provider's, and how to request delisting.

• 550 5.7.28: Gmail flagged an unusual rate of unsolicited mail

  Gmail is rejecting because the sending source looks like a spam burst. What drives 5.7.28, and how to recover the source's reputation.

• 421 4.7.0: Gmail is temporarily deferring mail from your IP

  The unsolicited-mail deferral: Gmail is throttling the IP, not bouncing you permanently. What the 4.7.0 tempfail means and how it clears.

• 421 4.7.0 [TS01, TS02, TS03]: Yahoo is deferring mail from your IP

  Yahoo's TS deferral codes mean reputation throttling. What each TS code implies, and how complaint rates and volume pacing clear it.

• 5.1.1 user unknown: the mailbox does not exist

  The classic bad-address bounce. Typos, departed employees, and stale lists, plus why repeated 5.1.1 sends damage your sending reputation.

• 5.1.2: the recipient's domain does not exist in DNS

  The receiving domain has no MX or does not resolve. How to tell a typo from a dead domain, and what to check before you retry.

• 5.2.1: the mailbox exists but is disabled

  A suspended or deactivated recipient account. What 5.2.1 tells you, how it differs from user-unknown, and when to stop sending.

• 5.2.2 mailbox full: the recipient is over quota

  Not your problem to fix, but worth handling well. What the over-quota bounce means and how senders should treat repeated 5.2.2 addresses.

• 5.2.3: your message is too large for the recipient's mailbox

  The per-recipient size rejection. How 5.2.3 differs from the system-wide 5.3.4 limit, and the practical ways around a large attachment.

• 5.3.4: your message exceeds the receiving system's size limit

  The whole receiving system, not one mailbox, refused the size. Typical limits at the big providers and how to deliver large content anyway.

• 4.4.1: connection to the recipient's mail server timed out

  Your server could not reach theirs. Why 4.4.1 is almost always a receiving-side problem, and when a stuck queue becomes your problem.

• 4.4.7: the message expired before it could be delivered

  Your server retried for days and gave up. What the retry-window bounce means, and how to read the earlier tempfail it usually hides.

• 5.4.4: no route to the recipient's domain

  DNS resolved but no usable mail route exists, usually a broken MX on the receiving side. How to verify whose DNS is wrong before you retry.

• 5.7.10: encryption required but the connection could not use TLS

  One side requires TLS and the handshake failed or was unavailable. Who enforces it, how MTA-STS changes the picture, and what to check first.

What each record does, tied to deliverability.

• What is a DNS record? DNS records explained

  Every part of how your domain works is a DNS record. The anatomy of one, the types you will actually meet (A, CNAME, MX, TXT, NS), and why a wrong one breaks mail silently.

• What is an MX record? (and why a wrong one loses mail)

  The MX record decides where your inbound email is delivered. How preference works, the null-MX and no-CNAME rules, and why a wrong MX loses mail with no warning.

• What is an A record? (A and AAAA, explained)

  An A record points a name to an IPv4 address, AAAA to IPv6. Why you cannot CNAME your apex, and how forward-and-reverse DNS decides whether Gmail trusts your mail.

• What is a CNAME record? (and why not at your apex)

  A CNAME points one name at another. Why it cannot live at your apex, why MX and NS must never point to one, and how email providers use CNAMEs to run your DKIM.

• What is a TXT record (and why SPF, DKIM, and DMARC all live in one)?

  A TXT record holds free-form text in DNS. It's also where every email-authentication record you publish actually lives. What it is, the quoting and length rules that bite, and how to verify one.

• What are NS records? (and why your DNS edit did nothing)

  NS records decide which provider answers DNS for your domain. The registrar-versus-host trap behind 'I edited my DNS and nothing changed,' and how to find your real DNS host.

• What is an SOA record? (Start of Authority, explained)

  The Start of Authority record holds your zone's serial number and timers. What each field does, and why its negative-cache minimum is the reason a new record reads as not found.

• What is a PTR record? (reverse DNS, explained)

  A PTR record is reverse DNS: it maps an IP back to a hostname. The reverse-DNS tree, why mail servers check it, and why you set it at your IP host, not your DNS panel.

• What is an SRV record? (and why email rarely needs one)

  An SRV record tells clients where to find a service. Why it does not route mail (MX does), the one place it touches email (client autoconfig), and why most domains never need one.

• What is DNSSEC? (and what it protects for email)

  DNSSEC cryptographically signs your DNS so answers cannot be forged. What it protects (including your email-auth records), why it is not required for email, and the rollover that takes a domain offline.

• DNS propagation and TTL: why your change isn't live yet

  DNS propagation is a myth: there is no push, only caching and TTL expiry. Why your DMARC or SPF change is not live everywhere yet, how to pre-lower TTL, and how to check it took.

The email-authentication vocabulary, in plain English.

• What is the Return-Path? (envelope from)

  The hidden envelope address that receives your bounces and decides SPF. What it is, who sets it, and why it rarely matches the From your reader sees.

• What is the Header From address?

  The From address people actually see, and the one DMARC exists to protect. How it differs from the envelope sender and why both alignment checks compare against it.

• What is a DKIM selector?

  The s= label that picks which signing key a receiver looks up. How a selector maps to a DNS record, why vendors each want their own, and how to see yours.

• What is DMARC alignment?

  Why an SPF or DKIM pass is not enough on its own: the domain-matching rule that decides whether a pass counts for DMARC, in relaxed and strict modes.

• What is a DMARC aggregate report? (RUA)

  The daily XML receipts mailbox providers send about mail using your domain. What they contain, what they deliberately leave out, and who sends them.

• What is a DMARC forensic report? (RUF)

  The per-message failure sample almost no provider sends anymore. What ruf= asks for, why privacy killed it, and why aggregate reports do the real work.

• What is an organizational domain?

  The registrable root that DMARC falls back to when a subdomain has no policy of its own. How the Public Suffix List decides it and why it matters for alignment.

• What is a DMARC record?

  The one-line TXT record at _dmarc that publishes your policy and reporting addresses. Its anatomy, the tags that matter, and a safe record to start with.

• What is a DMARC policy? (p=none, quarantine, reject)

  What each policy level actually tells receivers to do with failing mail, what none is for, and how domains climb to reject without losing real mail.

• What does quarantine mean in email?

  Where quarantined mail actually goes: the spam folder for most receivers, an admin hold for some. What p=quarantine asks for and how it differs from reject.

• What is email spoofing?

  How anyone can put your domain in the From line of mail you never sent. What spoofing is, how it differs from a hacked account, and what actually stops it.

• What is a Verified Mark Certificate? (VMC)

  The certificate that proves you own the logo your BIMI record publishes. Who issues VMCs, what they cost, and when you actually need one.