Authentication
If you only read one
RFC 7208 reference — record syntax (mechanisms, qualifiers, modifiers, macros), the check_host() evaluation algorithm, DNS lookup limits, result codes, and common pitfalls. 6 min
- SPF (Sender Policy Framework)
RFC 7208 reference — record syntax (mechanisms, qualifiers, modifiers, macros), the check_host() evaluation algorithm, DNS lookup limits, result codes, and common pitfalls.
- DKIM (DomainKeys Identified Mail)
RFC 6376 reference plus RFC 8301 (rsa-sha256 required, 1024–4096-bit keys) and RFC 8463 (ed25519-sha256) — signature and key record syntax, tag meanings, canonicalization, signing scope, and risks.
- DKIM Key Rotation
M3AAWG DKIM Key Rotation BCP (rev. March 2019) — semiannual rotation cadence, selector naming schemes, the two-live-keys workflow, p= retirement, CNAME/subdomain delegation for third parties, and rotation auditing.
- DKIM Replay Attacks
The DKIM replay problem (draft-ietf-dkim-replay-problem) — how one legitimately signed message gets resent to millions, why l=/x= don't fix it, current mitigations and their tradeoffs, and what it means for ESP infrastructure.
- DKIM2 (in-progress IETF work)
The IETF DKIM WG redesign of DKIM — per-hop chained signatures bound to the SMTP envelope, documented modifications ("recipes"), authenticated bounces, replay resistance — with WG status as of July 2026. NOT a published standard.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance)
What DMARC does and doesn't do, how it builds on SPF and DKIM, domain alignment, the DNS record, and choosing a handling policy.
- DMARC Deployment in Depth
Operational DMARC deployment — full tag reference, subdomain policy, pct sampling, alignment strictness, report processing, forwarding/mailing-list failure modes, and the none→quarantine→reject rollout.
- DMARC Standard Reference (RFC 9989 / DMARCbis)
The standards-track DMARC spec that obsoletes RFC 7489 — full record tag registry, the DNS Tree Walk replacing the Public Suffix List, alignment rules, policy discovery, and what changed.
- DMARC Aggregate Reports (RFC 9990)
The XML aggregate feedback format — report structure, transport, filename and subject conventions, external-destination verification, and policy-override reasons.
- DMARC Failure Reports (RFC 9991)
Per-message DMARC failure ("forensic") reports — ARF format, required fields, the ruf/fo tags, privacy constraints, and why few providers send them.
- ARC (Authenticated Received Chain)
RFC 8617 reference — the three ARC header fields, instance and chain-validation tags, sealing and validation rules, and how receivers use an intact chain to override DMARC failures caused by forwarding.
- The Authentication-Results Header
RFC 8601 reference — syntax of the header receivers use to record SPF/DKIM/DMARC/iprev results, ptypes and properties, method result codes, and how to read one.
- BIMI (Brand Indicators for Message Identification)
Implementing BIMI — DMARC enforcement prerequisites, the BIMI DNS record, SVG Tiny PS logo requirements, VMC/CMC certificates, and mailbox-provider support.
- ARC (Authenticated Received Chain)
RFC 8617 reference — the three ARC header fields, instance and chain-validation tags, sealing and validation rules, and how receivers use an intact chain to override DMARC failures caused by forwarding.
- BIMI (Brand Indicators for Message Identification)
Implementing BIMI — DMARC enforcement prerequisites, the BIMI DNS record, SVG Tiny PS logo requirements, VMC/CMC certificates, and mailbox-provider support.
- DKIM (DomainKeys Identified Mail)
RFC 6376 reference plus RFC 8301 (rsa-sha256 required, 1024–4096-bit keys) and RFC 8463 (ed25519-sha256) — signature and key record syntax, tag meanings, canonicalization, signing scope, and risks.
- DKIM Key Rotation
M3AAWG DKIM Key Rotation BCP (rev. March 2019) — semiannual rotation cadence, selector naming schemes, the two-live-keys workflow, p= retirement, CNAME/subdomain delegation for third parties, and rotation auditing.
- DKIM Replay Attacks
The DKIM replay problem (draft-ietf-dkim-replay-problem) — how one legitimately signed message gets resent to millions, why l=/x= don't fix it, current mitigations and their tradeoffs, and what it means for ESP infrastructure.
- DKIM2 (in-progress IETF work)
The IETF DKIM WG redesign of DKIM — per-hop chained signatures bound to the SMTP envelope, documented modifications ("recipes"), authenticated bounces, replay resistance — with WG status as of July 2026. NOT a published standard.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance)
What DMARC does and doesn't do, how it builds on SPF and DKIM, domain alignment, the DNS record, and choosing a handling policy.
- DMARC Aggregate Reports (RFC 9990)
The XML aggregate feedback format — report structure, transport, filename and subject conventions, external-destination verification, and policy-override reasons.
- DMARC Deployment in Depth
Operational DMARC deployment — full tag reference, subdomain policy, pct sampling, alignment strictness, report processing, forwarding/mailing-list failure modes, and the none→quarantine→reject rollout.
- DMARC Failure Reports (RFC 9991)
Per-message DMARC failure ("forensic") reports — ARF format, required fields, the ruf/fo tags, privacy constraints, and why few providers send them.
- DMARC Standard Reference (RFC 9989 / DMARCbis)
The standards-track DMARC spec that obsoletes RFC 7489 — full record tag registry, the DNS Tree Walk replacing the Public Suffix List, alignment rules, policy discovery, and what changed.
- SPF (Sender Policy Framework)
RFC 7208 reference — record syntax (mechanisms, qualifiers, modifiers, macros), the check_host() evaluation algorithm, DNS lookup limits, result codes, and common pitfalls.
- The Authentication-Results Header
RFC 8601 reference — syntax of the header receivers use to record SPF/DKIM/DMARC/iprev results, ptypes and properties, method result codes, and how to read one.