July 31, 2026
BIMI puts your logo in the inbox — but only after you've done the hard part
The brand logo next to your email isn't a design setting. It's a reward for DMARC enforcement, and it's locked behind the exact work most domains avoid.
Notes
Notes
Field notes on email authentication — how it works, how it breaks, and how to read what receiving servers see.
July 31, 2026
Since May 2025, all three major inboxes enforce the same rule: authenticate or bounce
Google, Yahoo, and now Microsoft require SPF, DKIM, and DMARC from bulk senders. As of 2025 this is no longer a best practice — it is the entry ticket to the inbox.
July 31, 2026
Why DKIM shows "none" or fails alignment — and how to fix it
DKIM can be published, valid, and cryptographically perfect, and your mail can still fail DMARC because of it. The reason is almost never the signature. It's alignment.
July 31, 2026
The dangerous middle of a mailbox migration nobody plans for
Migrations are planned as a clean weekend cutover. Reality is a coexistence window where two mail systems run at once — and authentication has to cover both without breaking either.
July 31, 2026
The one mail record you can't fix in your own DNS: PTR
A missing or generic reverse-DNS record gets mail rejected or spam-foldered — and it's the one authentication signal that doesn't live in your domain's zone, so editing your DNS won't touch it.
July 31, 2026
Your DMARC reports are XML nobody opens. Here's what they actually say.
Once you publish a rua address, mailbox providers start sending you daily DMARC reports. They arrive as XML, so almost nobody reads them — and they're the only complete list of who sends mail as you.
July 20, 2026
How email breaks during a Google Workspace migration
A mailbox migration moves your mail. It does not move your authentication — and that gap is where deliverability quietly fails.
July 13, 2026
You have a DMARC record. That doesn't mean you're protected.
Most domains with DMARC are sitting on p=none, which blocks nothing. Having the record and being protected are two different states.
July 6, 2026
The SPF ten-lookup limit, and why your record fails silently
An SPF record can be perfectly valid and still do nothing. The reason is a limit almost no free checker counts: ten DNS lookups.