Authentication

RFC 8617 reference — the three ARC header fields, instance and chain-validation tags, sealing and validation rules, and how receivers use an intact chain to override DMARC failures caused by forwarding.

Implementing BIMI — DMARC enforcement prerequisites, the BIMI DNS record, SVG Tiny PS logo requirements, VMC/CMC certificates, and mailbox-provider support.

RFC 6376 reference plus RFC 8301 (rsa-sha256 required, 1024–4096-bit keys) and RFC 8463 (ed25519-sha256) — signature and key record syntax, tag meanings, canonicalization, signing scope, and risks.

M3AAWG DKIM Key Rotation BCP (rev. March 2019) — semiannual rotation cadence, selector naming schemes, the two-live-keys workflow, p= retirement, CNAME/subdomain delegation for third parties, and rotation auditing.

The DKIM replay problem (draft-ietf-dkim-replay-problem) — how one legitimately signed message gets resent to millions, why l=/x= don't fix it, current mitigations and their tradeoffs, and what it means for ESP infrastructure.

The IETF DKIM WG redesign of DKIM — per-hop chained signatures bound to the SMTP envelope, documented modifications ("recipes"), authenticated bounces, replay resistance — with WG status as of July 2026. NOT a published standard.

What DMARC does and doesn't do, how it builds on SPF and DKIM, domain alignment, the DNS record, and choosing a handling policy.

The XML aggregate feedback format — report structure, transport, filename and subject conventions, external-destination verification, and policy-override reasons.

Operational DMARC deployment — full tag reference, subdomain policy, pct sampling, alignment strictness, report processing, forwarding/mailing-list failure modes, and the none→quarantine→reject rollout.

Per-message DMARC failure ("forensic") reports — ARF format, required fields, the ruf/fo tags, privacy constraints, and why few providers send them.

The standards-track DMARC spec that obsoletes RFC 7489 — full record tag registry, the DNS Tree Walk replacing the Public Suffix List, alignment rules, policy discovery, and what changed.

RFC 7208 reference — record syntax (mechanisms, qualifiers, modifiers, macros), the check_host() evaluation algorithm, DNS lookup limits, result codes, and common pitfalls.

RFC 8601 reference — syntax of the header receivers use to record SPF/DKIM/DMARC/iprev results, ptypes and properties, method result codes, and how to read one.