Explainer
DMARC is the standard that tells the world's mail servers what to do with email pretending to be from your domain - and reports back on what they saw. Here is how it works, in plain English, with no diagrams to decode.
Explainer
Thousands of UK domains have a DMARC record set to p=none - and their owners believe they are protected. They are not. Here is what p=none really does, why it exists, and how to progress safely to a policy that blocks spoofed email.
Explainer
SPF is a public guest list of the servers allowed to send email for your domain. It is simple in concept and surprisingly easy to break in practice. Here is how it works, the 10-lookup limit that catches everyone out, and why SPF alone will not protect you.
Explainer
DKIM puts a tamper-proof seal on every email your domain sends - a cryptographic signature any receiver can verify. Here is how it works in plain English, why keys need rotating, and what it means when DKIM fails.
Explainer
Add a reporting address to your DMARC record and the world's mail providers start sending you XML files daily. Here is what every field in those files actually means, why the raw format is unreadable at any scale, and what a useful translation looks like.
Explainer
Business email compromise needs no malware and no hacking - only an email convincing enough to move money. Here is how BEC actually works, the three distinct techniques behind it, and an honest account of which one DMARC stops.
Explainer
Most email travels encrypted - but only politely, and a criminal in the middle can ask both servers to drop the encryption. MTA-STS removes that option. Here is how it works, why the NCSC recommends it, and why starting in testing mode matters.
Explainer
Your mail servers support encryption - but do the servers sending to you actually achieve it? TLS-RPT is the standard that tells you, in a daily report. Here is what those reports contain, and what an anomaly looks like.
Explainer
BIMI displays your verified logo next to your emails in Gmail, Apple Mail and Yahoo. It is real, it works - and for most small UK businesses the costs outweigh the benefit. Here is the complete, honest picture, including what the certificates cost.
Explainer
“Check your junk folder” is not a business strategy. When legitimate email lands in spam, there is always a reason - and most of them are diagnosable from your domain’s public records. Here are the six causes, in order of likelihood.
Explainer
p=reject is where DMARC actually protects you - and the journey there is where most organisations stall, sometimes for years. Here is the staged route, what your aggregate reports should show before each move, and the blockers to expect.
Explainer
Receiving a scam email “from your own address” feels like a breach. Usually nothing was hacked - email’s 1980s design simply lets anyone write any sender address. Here is how spoofing works, what each side sees, and the one control that ends it.
We use privacy-friendly, self-hosted analytics and a sampled, masked session-replay tool to find usability problems. Nothing is shared with third parties, and these load only if you accept. See our Privacy Policy.