September 04, 2026
Amazon SES: aligning SPF and DKIM for DMARC
Amazon SES needs Easy DKIM and a custom MAIL FROM domain to pass DMARC: the three CNAMEs, the BYODKIM option, and the mistakes that break alignment.
Read →Blog — page 2
September 03, 2026
DMARC adoption: what 2026 shows
Mailbox-provider mandates, NIS2 and DORA, the publication of DMARCbis: what 2026 reveals about DMARC adoption, from published records to enforced policies.
Read →September 03, 2026
French healthcare and email impersonation: where things stand
Why hospital email in France is so exposed — ransomware, patient data, continuity of care — and what the DMARC Observatory measures every month.
Read →September 02, 2026
French municipalities and DMARC: the state of play
Spoofed town halls, fake payment notices, small municipalities without a security team: what the Observatory measures across French local government.
Read →September 01, 2026
Cyber insurance: what insurers look at on the email side
Wire-transfer fraud dominates cyber claims; underwriting questionnaires now probe SPF, DKIM and DMARC. What p=reject changes for the premium and the claim.
Read →August 31, 2026
Buying a pre-owned domain: the email legacy that comes with it
A bought domain never arrives clean: inherited sender reputation, blocklist entries, forgotten SPF records. The pre-purchase audit and the reset.
Read →August 31, 2026
DMARC in vendor security questionnaires
DMARC is now a standard line in vendor security questionnaires, driven by NIS2, DORA and ISO 27001. Typical wordings, DNS checks, honest answers.
Read →August 30, 2026
Mergers and acquisitions: consolidating email domains without an authentication gap
An acquisition brings an unknown fleet of email domains: DNS due diligence, transition risks, phased consolidation, p=reject on abandoned domains.
Read →August 30, 2026
Multi-brand, multi-domain: DMARC governance at scale
Thirty brands, two hundred domains: DMARC becomes governance. Fleet typology, central registry, industrialized DNS and a p=reject rollout in waves.
Read →August 26, 2026
Detecting spoofing in DMARC reports: the method
What a RUA report shows when a domain is spoofed: unknown IPs failing both SPF and DKIM, short bursts, odd geographies — and the weekly triage method.
Read →