ReaperCloud

Training

Email authentication explained for people who run businesses, not mail servers. Free to download, no account required.

THE GUIDE SERIES

Eight guides, in the order worth reading them

Each guide covers one standard in plain English, with diagrams, and assumes no prior knowledge. Every factual claim is checked against the relevant RFC rather than against other people's summaries — which matters more than it sounds, because a good deal of the advice in circulation is now out of date.

They are written to be read in the order below. DNS comes first because every other guide asks you to publish a DNS record, DNSSEC follows it because the DANE guide depends on it, and BIMI comes last because it requires everything before it to already be in place.

DNS — The foundation the rest of the series assumes What you are actually editing when you edit a DNS record. Where records live, who controls them, why a change you made an hour ago has not appeared — and why a record you have just created can look missing when nothing is wrong. PDF · 11 pages · 336 KB Open in new tab Download
DNSSEC — Signing your DNS so forged answers are caught How a signed domain proves its DNS answers are genuine, and why the record that switches it on lives with your registrar rather than your DNS host. The one feature in the series where getting it wrong is worse than not doing it — with the safe order for turning it on and for changing DNS host. PDF · 10 pages · 335 KB Open in new tab Download
SPF — Which computers may send as you How a receiving server decides whether the machine handing over your mail was allowed to. Includes the ten-lookup limit that quietly breaks SPF for domains that keep adding services. PDF · 11 pages · 339 KB Open in new tab Download
DKIM — Proving the message arrived as you sent it A signature attached to each message that proves it came from you and has not been altered. Covers keys, selectors, what the signature does and does not cover, and why forwarding usually leaves it intact. PDF · 11 pages · 338 KB Open in new tab Download
DMARC — Stopping other people sending mail that looks like yours The one that ties SPF and DKIM to the name your reader actually sees, and tells receivers what to do when they do not match. Updated for the 2026 revision of the standard, which retired a tag most guidance still recommends. PDF · 12 pages · 340 KB Open in new tab Download
MTA-STS — Keeping your mail encrypted in transit Not about forgery at all. How an attacker reads genuine mail in transit without changing a byte of it, and how to tell sending servers to refuse an unencrypted connection to you. PDF · 12 pages · 338 KB Open in new tab Download
DANE — The stricter alternative, if your DNS is signed Publishing a fingerprint of your mail server's certificate in your own DNS. Stronger than MTA-STS and less forgiving: it needs DNSSEC, it has no testing mode, and a certificate renewal done in the wrong order stops mail. PDF · 11 pages · 334 KB Open in new tab Download
BIMI — Your logo beside your mail The only one here that is not a security control. What it takes to get a logo displayed, what the certificate costs, which providers show it — and an honest look at whether it is worth doing. PDF · 11 pages · 336 KB Open in new tab Download

Read one, then check your own domain

The guides explain what the records mean. The free tools tell you what yours currently say.

Check your domain See our services