Guides
Every guide, in one place
Each one starts from a problem you might be having and ends with a record you can publish. No prior knowledge of email authentication assumed.
New here? Start with Someone is sending email as my domain — it tells you which problem you actually have before you change any DNS.
-
Getting started
How to check if your domain can be spoofed
Find out if anyone can send email as your domain, free and without sending a message. How to read the SPF, DKIM and DMARC results, and what to fix.
-
SPF
SPF: too many DNS lookups
Over SPF's 10-lookup limit, receivers return permerror and ignore your record. How to count lookups, including nested includes, and 3 ways to get under.
-
Bulk senders
Google and Yahoo sender requirements: a pass/fail checklist
The 12 Gmail and Yahoo sender requirements (SPF, DKIM, DMARC, one-click unsubscribe, spam rate), each with a pass test, and which no DNS lookup can check.
-
SPF
SPF: should it end in ~all or -all?
~all vs -all matters less than you think once DMARC is in place. When to use softfail, when to move to hardfail, and the +all and missing-all mistakes.
-
Error messages
554 5.7.5 permanent error evaluating DMARC policy
Gmail bounced your mail with 554 5.7.5? It's your DMARC DNS, not the message: two records at _dmarc, a malformed record or failed alignment. The fix.
-
DMARC
What DMARC p=none actually does
v=DMARC1; p=none collects reports and blocks nothing, so forged mail is still delivered. How long to stay, and how to reach p=reject without losing mail.
-
Providers
Setting up DMARC on Google Workspace
Set up DMARC for Google Workspace: the TXT record to publish at your DNS host, why to skip pct=, why Gmail sends no ruf reports, and the 48-hour wait.
-
Providers
Setting up DMARC on Microsoft 365
Microsoft 365 DMARC failing with DKIM on? Default signing uses onmicrosoft.com, which doesn't align. Enable DKIM for your domain, then publish the record.
-
DMARC
Why DMARC fails when SPF and DKIM pass
SPF and DKIM passed for your vendor's domain, not the one in your From header. How to read alignment from your headers and fix it with DKIM signing.
-
Providers
SPF, DKIM and DMARC on Cloudflare DNS
Add SPF, DKIM and DMARC at Cloudflare DNS without breaking mail: the orange-cloud SPF trap, inbound-only Email Routing, and the doubled _dmarc name.
-
Providers
Email authentication for Shopify
Store mail sent as store+123@shopifyemail.com means your domain isn't authenticated. Publish Shopify's CNAMEs and a DMARC record, and avoid adkim=s.
-
DMARC
Your DMARC reports may be going nowhere
A valid DMARC record can still deliver zero reports: an external rua address that hasn't authorised you, or a reporting domain with no MX. Check both.
-
DMARC
SPF, DKIM and DMARC results: what every pass/fail combination means
SPF pass, DKIM fail, DMARC pass? Every result combination in an Authentication-Results header: what it means for delivery, and the one fix for each.
-
DKIM
SPF passed but DKIM failed
SPF passing says nothing about DKIM. Read the failure: body changed in transit, a missing or revoked selector, or a mailing list. Then fix the right one.
-
SPF
DKIM passed but SPF failed
SPF breaks on forwarded mail by design, and DMARC still passes on DKIM. How to tell a harmless SPF fail from a permerror that needs a DNS fix.
-
DKIM
Finding your DKIM selector
DKIM selectors can't be listed from DNS, so every checker guesses. Get yours for certain from the s= tag of a sent message, then verify the key. Free tool.
-
DKIM
DKIM selectors by provider
The DKIM selector each major provider uses (google, selector1, k1, s1), which were verified live, and which, like Amazon SES, can't be guessed.
Why a message bounced
Twenty-one more guides decode a specific SMTP rejection. These are the ones people arrive needing most:
-
Bounces
Microsoft 5.7.606 — your sending IP is blocked
-
Bounces
Mimecast rejected your message
-
Bounces
Outlook S3150 — blocked by reputation
-
Bounces
Microsoft 5.7.23 — SPF validation failed
-
Bounces
5.1.2 — the recipient domain does not resolve
-
Bounces
550 5.1.1 — no such user
Research and comparisons
What a scan of 6,157 company domains found, and the numbers behind the guides above.
-
Research
We scanned every Y Combinator company: 60.5% can be email-spoofed
The study: every YC company domain scanned for DMARC twice, three weeks apart.
-
Research
DMARC Adoption Statistics (2026)
DMARC adoption statistics from a 6,157-domain scan run twice in 2026: enforcement rates, p=none share, SPF overlap, by industry and company age. Free to cite.
-
Research
SPF vs DMARC: Why SPF Alone Doesn't Stop Email Spoofing
SPF checks the envelope sender, not the From address recipients see. In our 6,157-domain scan, 73.1% of spoofable domains had SPF. How to close the gap.
-
Research
Dataset: DMARC Posture of 6,157 Y Combinator Companies
Free CSV: DMARC policy, SPF and MX status for 6,157 Y Combinator company domains, scanned in August and September 2026. CC BY 4.0, cite with attribution.
- Bounce guides — Twenty-one guides, one per SMTP error worth its own page: what it means, whose problem it is, and the fix. Paste a bounce and it finds the right one.
- TLS-RPT result guides — Every failure type RFC 8460 defines, explained one page at a time — and whether it means inbound mail was refused or merely sent unencrypted.
- Deliverability tool guides — One-click unsubscribe, MTA-STS, TLS-RPT setup, Postmaster Tools and the Gmail and Yahoo requirements, each alongside the tool that checks it.