Practical notes from the people who built DMARC Guardian. Real failure modes from real reports — written for the operator on call at 22:47, not the analyst writing a whitepaper. No fluff, no RFCs cited unless they actually help.
You added SendGrid or Amazon SES, SPF is passing, but DMARC reports still show failures. This is the alignment problem — and it's not a bug in your SPF record. Here's what's actually happening and how to fix it.
You added SendGrid or Amazon SES, SPF is passing, but DMARC reports still show failures. This is the alignment problem — and it's not a bug in your SPF record. Here's what's actually happening and how to fix it.
You locked down your root domain with DMARC p=reject. But mail.yourdomain.com, helpdesk.yourdomain.com, and every other subdomain might still be wide open. Here is the sp= tag you've never heard of, and why skipping it is the most common DMARC blind spot in 2026.
How aggregate (RUA) reports differ from forensic (RUF) data and what operators should focus on first.
You configured DKIM once and it's been "working" ever since. But DKIM private keys age out, leak, and get compromised — and most teams have no rotation process in place. Here's what the risk looks like and how to fix it before it matters.
Your SPF record hit the 10-lookup limit and now DMARC reports show permerror for a growing chunk of your mail. Here is exactly what happened and how to fix it without breaking the senders you already have.
A step-by-step guide for DevOps engineers and solo admins who set up DMARC monitoring months ago and still haven't enforced it — and why that matters.
Notes on email authentication, deliverability, and how we ship DMARC Guardian.
A plain-English walkthrough for non-technical founders whose customer emails disappear into spam folders. No acronyms until explained.
A practical checklist for DevOps engineers and solo admins who need email authentication done right without drowning in RFC specs.
If your onboarding emails, password resets, or invoices keep hitting spam folders, SPF, DKIM, and DMARC misconfiguration is the likely cause. Here's how to diagnose and fix it without reading an RFC.
Type your domain. We will tell you — in plain English — whether anyone can forge a fake invoice from it today. 15 seconds. No signup, no card.