Email security guides

Fixes for the problems the checker finds most often, written from real deployments and checked against the RFCs. New to the topic? Start with SPF, DKIM and DMARC explained.

• SPF PermError: too many DNS lookups, and how to fix it

  Why SPF stops working after 10 DNS lookups, how to count them (including nested includes and void lookups), and five ways to get back under the limit.

• Moving DMARC from p=none to p=reject without blocking real email

  A staged DMARC rollout: find every sender in your aggregate reports, fix alignment, then move through quarantine to reject with a rollback plan.

• Sending DMARC reports to another domain (external report authorisation)

  Why receivers ignore an rua address on a different domain, and the _report._dmarc record that authorises it.

• How to protect domains that never send email

  Lock down parked and unused domains with SPF -all, DMARC reject, a null MX record and an empty DKIM key, so nobody can spoof them.

• DMARCbis (RFC 9989): what changed from RFC 7489

  The new DMARC standard published in May 2026: the DNS tree walk, the np, t and psd tags, pct retired, and what you actually need to change.