July 25, 2026
Setting up DMARC, SPF and DKIM in Cloudflare DNS
Cloudflare hosts the DNS zone, whatever mailbox sits behind it. Placing the _dmarc and SPF TXT records, DKIM selector CNAMEs, proxy status and flattening.
Read →Blog — page 8
July 25, 2026
Not receiving DMARC reports: the causes and the fix
A DMARC record is published, but no reports arrive. Here are the possible causes, in the order to check them, from the most common to the most subtle.
Read →July 24, 2026
Configuring the DMARC rua address (without getting tripped up)
The DMARC rua tag receives the aggregate reports. The syntax is simple, but an external destination hides an authorization trap found far too late.
Read →July 24, 2026
Configuring SPF and DKIM at Gandi
GandiMail, LiveDNS, the _mailcust.gandi.net include, the gm1 to gm3 DKIM selectors: the complete path to authenticating email for a domain hosted at Gandi.
Read →July 23, 2026
DMARC record examples to copy (and understand)
Ready-to-paste DMARC record templates — monitoring, quarantine, reject, parked domain — with per-provider settings and the publishing pitfalls to avoid.
Read →July 23, 2026
Setting up SPF and DKIM on OVHcloud
OVHcloud MX Plan, Email Pro and Exchange each need their own SPF and DKIM records. The DNS zone, the default SPF trap, CNAME selectors, checks.
Read →July 22, 2026
The DMARC subdomain policy: sp and np
Hardening the root domain isn't enough if the subdomains stay open. How the sp and np tags close that side door — including non-existent subdomains.
Read →July 21, 2026
Rolling out DMARC gradually, after the end of pct
The pct tag hardened DMARC in percentage steps. DMARCbis removed it. Here's how to run a safe, gradual rollout without it.
Read →July 20, 2026
p=quarantine or p=reject: which one to choose?
The two enforcing DMARC policies don't share the same risk profile. What each actually does to failing mail, and how to decide for a given domain.
Read →July 19, 2026
Readiness checklist: when is a domain ready for p=reject?
The conditions to meet before hardening a DMARC policy from p=none to p=reject: a pre-flight checklist for enforcement with no legitimate mail lost.
Read →