Practical guides
DMARC record syntax explained: every tag, what it does, and what to set it to
A field-by-field reference for the DMARC record itself: what each tag means, what to set it to, and the mistakes that quietly break enforcement.
Explainer
What does a DMARC report actually show?
Add a reporting address to your DMARC record and the world's mail providers start sending you XML files daily. Here is what every field in those files actually means, why the raw format is unreadable at any scale, and what a useful translation looks like.
Explainer
Why DMARC p=none is not protecting you
Thousands of UK domains have a DMARC record set to p=none - and their owners believe they are protected. They are not. Here is what p=none really does, why it exists, and how to progress safely to a policy that blocks spoofed email.
Explainer
What is DMARC? A plain-English guide
DMARC is the standard that tells the world's mail servers what to do with email pretending to be from your domain - and reports back on what they saw. Here is how it works, in plain English, with no diagrams to decode.
Explainer
Parked domains and DMARC: your unused domain is a security risk
The .com you bought defensively, the old trading name, the hyphenated variant - every domain you own but never send from can be spoofed as freely as your main one. Securing each takes three DNS records and five minutes. Most businesses haven’t done it.
Explainer
Getting to DMARC p=reject: the safe route to enforcement
p=reject is where DMARC actually protects you - and the journey there is where most organisations stall, sometimes for years. Here is the staged route, what your aggregate reports should show before each move, and the blockers to expect.
