Email authentication, explained properly
In-depth guides to DMARC, SPF and DKIM, and the fraud they exist to stop. Written for the people who have to make it work, not for search engines.
All articles
DMARC in South Africa: The Complete 2026 Guide for Businesses
A practical 2026 guide to DMARC for South African businesses: what it does, why local companies are targeted, how POPIA fits, and how to reach enforcement safely.
How Much Does DMARC Cost in South Africa?
The DNS record is free; the work is not. A frank breakdown of what DIY, self-service software and managed DMARC really cost a South African business.
How to Set Up DMARC for Microsoft 365 Without Breaking Your Email
A step-by-step Microsoft 365 DMARC setup: SPF, custom DKIM in the Defender portal, the onmicrosoft.com default domain and a rollout that does not block your own mail.
How to Set Up DMARC for Google Workspace
Configure SPF, DKIM and DMARC for Google Workspace correctly, including the Start authentication step most admins miss and the routing setups that quietly break alignment.
Banking Details Change Fraud: A Prevention Checklist for South African Finance Teams
Banking details change fraud succeeds through process gaps, not clever technology. This checklist covers verification, master-file controls, where DMARC helps and what to do in the first hour.
DMARC Checker Results Explained: What Each Status Means and What to Fix First
A DMARC checker gives you a wall of statuses. This guide translates each one into plain language and gives you a priority order for fixing them.
Managed DMARC vs DMARC Software: Which Does Your Business Need?
DMARC software and managed DMARC both process your reports. The difference is who does the work afterwards. A frank comparison and a framework for choosing.
How to Read a DMARC Report (and What to Do With It)
DMARC aggregate reports look like noise until you know the structure. Here is how to read the XML, sort sending sources and decide what to fix first.
SPF "Too Many DNS Lookups": How to Fix the 10-Lookup Limit
An SPF record that needs more than 10 DNS lookups returns a permanent error, and DMARC treats that as an SPF fail. Here is how to audit, prune and restructure it without breaking mail.
DMARC Alignment Explained: Why SPF and DKIM Pass but DMARC Fails
SPF and DKIM can both pass while DMARC still fails, because DMARC asks a different question: do the authenticated domains match the From address your recipient sees?
POPIA and Email Security: Where DMARC Fits (and Where It Does Not)
POPIA requires reasonable technical and organisational safeguards. DMARC is a credible one for email impersonation, but it is one control, not a compliance certificate.
Xero, Sage, Mailchimp and the Other Services That Send as You
Your invoices, newsletters and booking confirmations probably leave from platforms you do not run. Here is how to find every one and make it pass DMARC before you enforce.
Parked Domains: How to Lock Down Domains That Never Send Email
Domains that never send email are often the least protected ones you own. Three DNS records lock them down, and a portfolio approach keeps them that way.
Lookalike Domains: What DMARC Cannot Stop, and What You Can Do Instead
DMARC stops criminals from sending as your exact domain. It does nothing about yourcornpany.co.za or a hacked mailbox. Here is what fills the gap.
Subdomains and DMARC: The sp= Tag and the Forgotten Subdomain Problem
Your main domain may be at p=reject while every subdomain is wide open. How DMARC inheritance works, what sp= controls and how to design policy that covers both.
What Is DMARC, and Why It Is No Longer Optional
DMARC is the record that decides whether criminals can send email as your business. Here is how it works, what the three policies really do, and why monitoring alone protects nothing.
Why Monitoring-Only DMARC Is a False Sense of Security
A DMARC record at p=none ticks the box on a checklist and blocks nothing. If your domain has been at monitoring for more than a few months, it is not protected.
SPF Explained: Why a Pass Does Not Always Mean Safe
SPF is the oldest email authentication standard and the most misunderstood. It checks a different address to the one your recipient sees, and it breaks in ways nobody notices until mail stops arriving.
How Email Spoofing Leads to Invoice Fraud and CEO Impersonation
Most business email fraud is not technically sophisticated. It relies on one thing: a message that appears to come from someone you trust. Here is how the main variants work and which defences stop each one.
DKIM Explained: The Signature Behind Trusted Email
DKIM is the part of email authentication that survives forwarding and does most of the work for DMARC. It is also the part most often left signing with someone else's domain.
Google, Yahoo and Microsoft Sender Requirements: What They Mean for Your Business
The three largest mailbox providers now require SPF, DKIM and DMARC from bulk senders. Here is exactly what they ask for, who it applies to, and why businesses below the threshold should act anyway.
DMARC for Agencies, MSPs and IT Teams: What Changes at Scale
One domain is a project. Forty client domains, each with its own senders, DNS host and approver, is an operation. Here is what breaks at scale and how to run DMARC for clients without carrying the risk alone.
Rolling Out DMARC Safely: From p=none to p=reject
Enforcement is where DMARC protects you and where it can hurt you. This is the sequence that gets a domain to p=reject without blocking the invoices, statements and bookings your business depends on.
Find out where your domain stands
Send us your domain. We will review your DMARC, SPF and DKIM set-up, map the services sending as you, and tell you plainly what it would take to reach enforcement. No charge and no obligation.