Your CRM, newsletter, helpdesk and accounting software all send as your domain, and all of them spend the same reputation. Why one badly-behaved or badly-configured tool can hurt everyone's mail, why subdomains limit the damage, and what a subdomain will not do.

SPF, DKIM and DMARC explained without the wall of acronyms. Why a published SPF record does not stop anyone from sending email in your name, what p=none really tells the world, and what to check on Monday. Written to be forwarded.

One phishing operator, ninety days: 342 registered domains wearing 18,749 different faces, and 90% of it passed SPF, DKIM and DMARC. Authentication stopped being proof of good intent — here is what that looks like in real mail flow.

Everyone agrees a domain with no DMARC record is dangerous. We think the more dangerous domain is the one at p=none: it passes the paperwork, and it still lets every forgery through — including into its own inboxes. Here is why, in plain language, and how long you should stay there.

You published DMARC. Nobody can forge your domain — including to attack your own people internally. But almost none of that protects the mail that arrives in someone else's name: your suppliers, your accountant, your bank. Here is the blind spot in every email-security budget, and the three things that close it.

Your authentication tests clean, then a customer auto-forwards a message and it fails. That is not a bug, and it is not random. One half of your authentication cannot survive a new hop, and the other half survives only under a condition nobody tells you about.

Most small businesses cannot answer that question — and it is the one that decides whether their invoices arrive. Here is a way to find out, tool by tool, without hiring anyone.

DMARC was rewritten in May 2026, and you have probably received a few worried emails about it. Here is the honest list — one thing worth checking today, one worth adding, and five you can ignore.

We checked the public DNS records of 296 Quebec organizations across 9 sectors. Only 28% actually block someone from sending email in their name — and the reason why is not what we expected.

We published a live map of where forged email originates, updated hourly. The results are not what most people expect — and one of the two views should worry you.

DMARCbis was published in May 2026 as RFC 9989. Here's what changed — the new np tag, the DNS Tree Walk, the removal of pct — and whether you need to do anything.

Google tightens Gmail filters this month! November 2025

Introducing “Insights”: A New Way to Understand Your Delivery Performance

Risks Associated with Microsoft Direct Send

Your Digital Footprint: A Hidden Gateway to Hacking and Spam

Monitoring your email flow using DMARC Reporting is essential for maintaining domain security, protecting your reputation, and improving email deliverability.

To this day, most internet domain can be spoofed and we'll explain why

DMARCGUY has rigorously evaluated numerous DMARC monitoring tools and selected URIports, widely regarded as one of the top solutions on the market.

It has now become essential to properly configure your email system.

Contact an email security expert to lock down your DMARC and stop spoofing for good.

What led to the creation of DMARC GUY

NSA warns of North Korean hackers exploiting weak DMARC email policies

US Says North Korean Hackers Exploiting Weak DMARC Settings