SYSoulaymen Yaakoubiinplaindmarc.hashnode.dev·3d ago · 4 min readHow to Check SPF, DKIM and DMARC Without Leaving Your AI AssistantEmail authentication debugging is a lookup problem. Someone forwards you a bounce, and answering it means pulling a TXT record, counting SPF includes, chasing a DKIM selector through a CNAME chain, an00
JPJose Pollmaninnotspoofed.hashnode.dev·4d ago · 4 min readWhy your DMARC reports never arrive (and why Gmail can't be your rua address)There is a failure mode in DMARC that is worse than a misconfiguration, because a misconfiguration at least shows up somewhere. Your record is valid. Every checker says it's fine. And you receive noth00
JPJose Pollmaninnotspoofed.hashnode.dev·5d ago · 5 min readSPF passed. DKIM passed. DMARC failed. Nothing is broken.This header block is where most people's understanding of email authentication falls apart: Authentication-Results: mx.google.com; spf=pass smtp.mailfrom=bounce@esp-vendor.net; dkim=pass header.d=00
CPCanny Pigeonsincannypigeons.hashnode.dev·Jul 23 · 5 min readHow to set up DMARC and DKIM for MailchimpMailchimp sends your campaigns from its own servers, so by default the DKIM signature says d=mailchimp.com and the SPF check uses a Return-Path on mailchimp.com. Both checks pass — but for Mailchimp's00
CPCanny Pigeonsincannypigeons.hashnode.dev·Jul 23 · 5 min readDNS drift: why email authentication decaysEmail authentication is configured in DNS, and DNS is a shared surface: your IT team, your web agency, your marketing tools, your registrar — and, if you're unlucky, an attacker — can all change it. T00
CPCanny Pigeonsincannypigeons.hashnode.dev·Jul 23 · 6 min readSource IPs in DMARC reports, explainedEvery row of a DMARC aggregate report starts with an IP address, a message count, and one question: is this server mine? The IP itself carries more evidence than most people expect. Reverse DNS, geolo00
CPCanny Pigeonsincannypigeons.hashnode.dev·Jul 23 · 3 min readWhat is an ESP — and why does it fail DMARC?An ESP (Email Service Provider) is any platform that sends email on your behalf: Mailchimp for newsletters, SendGrid or Mailgun for transactional mail, HubSpot or Klaviyo for marketing, Zendesk for su00
CPCanny Pigeonsincannypigeons.hashnode.dev·Jul 23 · 3 min readWhat is ARC?Forwarding is authentication's blind spot: a forwarded message arrives from an IP that fails SPF, and mailing lists that tag subjects or add footers break DKIM too. ARC — Authenticated Received Chain 00
CPCanny Pigeonsincannypigeons.hashnode.dev·Jul 22 · 4 min readWhat is DMARC? Email authentication explainedDMARC lets you tell every mailbox provider on the planet what to do with email that claims to come from your domain but can't prove it — and it makes them send you reports about everyone using your na00
CPCanny Pigeonsincannypigeons.hashnode.dev·Jul 22 · 3 min readDMARC reports explained: how to read RUA aggregate reportsPublish a DMARC record with a rua address and something remarkable happens: Google, Microsoft, Yahoo and hundreds of other mail operators start emailing you daily summaries of every message that claim00
