Protocols and concepts
How email authentication actually works.
What is ARC (Authenticated Received Chain)?
When a mailing list or forwarder rewrites your mail, SPF and DKIM break and DMARC fails. ARC is how the next hop preserves the original verdict. What it is, when it helps, and its limits.
Envelope-from vs header-from: the two sender addresses
Email has two From addresses: the envelope-from your server uses for bounces, and the header-from your recipient sees. SPF checks one, DMARC judges the other. The difference, and why it matters.
The DMARC fo tag and failure (ruf) reports
The DMARC fo tag controls when a receiver sends a per-message failure report. What each value means, why the big providers no longer send these reports, and what to use instead.
More in the Knowledge Base
Stop guessing. Start monitoring.
Free for one domain. Set up in five minutes. We parse the reports; you read plain-English summaries.