Guides
Email security guides: SPF, DKIM, DMARC, phishing and spam
Email security, explained properly. 215 step-by-step guides and plain-English explainers, each with primary sources, written for the people who actually run business email.
Filter guides
Nothing matches that search.
Try fewer or different words, or browse instead:
- Email security basics
- Phishing & threats
- SPF, DKIM & DMARC
- Setup guides
- Running email day to day
- Switching & migration
- Choosing a filter
- SMTP error codes
- Glossary
Other pages
New and featured guides
SPF, DKIM & DMARC
What is DMARC, and how does it work?
What DMARC is, how it uses SPF and DKIM alignment, what p=none, quarantine and reject do, what the reports show, and how to set it up in five safe steps.
9 min read Running email day to dayWhy is spam getting through the Microsoft 365 spam filter, and how do you fix it?
Why spam reaches Microsoft 365 inboxes: allow lists, SCL -1 rules, weak policies, Direct Send. How to find the cause in headers and fix it step by step.
9 min read Running email day to dayEmail deliverability checklist: how to reach the inbox in 2026
A sender checklist for reaching the inbox in 2026: aligned SPF, DKIM and DMARC, reverse DNS, TLS, one-click unsubscribe, spam rates, warming and monitoring.
9 min read SPF, DKIM & DMARCHow to stop others sending email as your domain
Stop criminals sending email as your domain: the DMARC path to p=reject, SPF and DKIM, subdomains and parked domains, monitoring, and what DMARC can't stop.
9 min read SPF, DKIM & DMARCWhy does DMARC fail? Causes and fixes for dmarc=fail
Troubleshoot dmarc=fail: alignment vs pass, third-party senders, forwarding, subdomains, DKIM d= and SPF MAIL FROM mismatches, with a causes-to-fixes table.
9 min read Phishing & threatsAI phishing emails: what has changed and what still stops them
How generative AI changes phishing, from flawless grammar to cloned voices, according to the FBI and NCSC, and which defenses still stop AI-written attacks.
9 min readEmail security basics
How business email, MX records, spam filters and quarantines actually work, in plain English.
- What is DNSSEC, and what does it do for your email? 9 min
- Email encryption types for business: which do you need? 10 min
- Is it safe to click unsubscribe in spam emails? 7 min
- SMTP ports 25, 587, 465 and 2525: which one should you use? 9 min
- What is a mail transfer agent (MTA)? 9 min
- What is a smart host, and when do you need an SMTP relay? 9 min
- What is a spam score? 8 min
- What is DANE for SMTP, and do you need it? 9 min
- What is Exchange Online Protection (EOP), and what does it include? 8 min
- What is greylisting in email? 9 min
- What is sender reputation, and how do you improve it? 9 min
- What is SMTP and how does it deliver email? 9 min
- Where do spammers get my email address? 9 min
- Why do I get so much spam, and what actually reduces it? 8 min
- How do spam filters work? 9 min
- Is my email encrypted in transit? STARTTLS, MTA-STS and DANE explained 9 min
- What is an MX record? 8 min
- What is an email quarantine, and how should you use it? 8 min
Phishing & threats
Phishing, spoofing, business email compromise and malicious attachments: how they work and how to stop them.
- AI phishing emails: what has changed and what still stops them 9 min
- Signs your business email account has been compromised, and what to do 10 min
- Email bombing and subscription bombing: what it is and how to respond 9 min
- Microsoft 365 user restricted from sending (550 5.1.8): how do you investigate and unblock it? 9 min
- How does adversary-in-the-middle phishing bypass MFA, and what stops it? 10 min
- AI voice cloning and deepfake BEC: how the attack works and how to verify requests 10 min
- Calendar invite phishing: how fake meeting invites work and how to stop them 8 min
- Callback phishing: why fake invoice emails ask you to call 9 min
- Charity and disaster relief scam emails: how to give safely 9 min
- ClickFix and fake CAPTCHA emails: how the paste-a-command trick works 9 min
- Crypto investment scam emails: pig butchering, fake platforms and recovery scams 10 min
- What to do when scammers impersonate your company to your customers 9 min
- What is display name spoofing, and how do you stop it? 9 min
- Domain renewal scam emails: how to spot fake expiry notices 9 min
- What is email thread hijacking, and how do you spot it? 9 min
- Fake Amazon order confirmation emails: how to spot them and check safely 8 min
- Fake bank alert emails: how to spot them and what to do 9 min
- Fake court notice and jury duty scam emails: how to tell and what to do 9 min
- Fake delivery notification emails: how to spot and report parcel scams 9 min
- Fake DocuSign emails: how to spot e-signature phishing 9 min
- Fake job offer emails: how recruitment scams work and how to stop them 9 min
- Fake Microsoft login pages: how to spot them and what to do 10 min
- File-sharing notification phishing: how to check a shared file safely 9 min
- How to check if a link is safe before you click it 9 min
- HTML attachment phishing and HTML smuggling: how they work and how to stop them 9 min
- IRS Publication 4557 and the WISP: the email controls tax professionals need 9 min
- Mailbox full and account suspended phishing: how to spot and stop it 8 min
- Microsoft 365 Direct Send spoofing: how it works and how to block it 9 min
- Microsoft Teams phishing: how fake help desk chats work and how to stop them 9 min
- What is OAuth consent phishing, and how do you stop it in Microsoft 365? 9 min
- Why does Office block macros in files from the internet? 9 min
- Password-protected ZIP attachments: why they're risky and how to handle them 9 min
- Payroll diversion scam emails: how to stop direct deposit fraud 9 min
- PDF phishing attachments: how they work and how to stop them 9 min
- How does ransomware get in through email, and how do you stop it? 10 min
- Real estate wire fraud: how fake closing instructions work and how to stop them 9 min
- Social Security impersonation emails: how to spot and report them 8 min
- Spear phishing vs phishing vs whaling: what's the difference? 8 min
- Voicemail phishing emails: how to spot fake missed call alerts 8 min
- W-2 phishing scams: how to protect payroll data in tax season 9 min
- Why am I getting bounce messages for emails I didn't send? 8 min
- How to prevent business email compromise (BEC) 9 min
- Which email attachment types are dangerous, and what should you block? 9 min
- Email security awareness training for small businesses: what works 9 min
- Email security for nonprofits: the risks and a practical setup 9 min
- Fake invoice and payment emails: how to spot them 9 min
- Gift card scam emails from your "boss" 8 min
- How to spot a phishing email 9 min
- What is lookalike domain phishing, and how do you stop it? 8 min
- Phishing statistics for 2026, with sources 8 min
- What is QR code phishing (quishing), and how do you stop it? 8 min
- How to report a phishing email 9 min
- Sextortion scam emails: "I hacked your camera" 8 min
- Someone is sending email from my address: spoofed or hacked? 9 min
- How to stop phishing emails in Microsoft 365 9 min
- How to stop vendor invoice fraud and payment redirection 9 min
- What is email spoofing? 9 min
- What to do after clicking a phishing link 9 min
SPF, DKIM & DMARC
Set up and troubleshoot email authentication so receivers trust your mail and impostors are rejected.
- What is DMARC, and how does it work? 9 min
- How to stop others sending email as your domain 9 min
- Why does DMARC fail? Causes and fixes for dmarc=fail 9 min
- "DMARC policy not enabled": what it means and how to fix it safely 8 min
- How to find a domain's DKIM selector, and check its key 8 min
- DKIM "body hash did not verify" and other DKIM failures: causes and fixes 9 min
- What is ARC (Authenticated Received Chain), and how does it work? 9 min
- How do you check if an email passed SPF, DKIM and DMARC? 9 min
- DKIM 2048-bit key too long for a TXT record: how to split it correctly 8 min
- What does each tag in a DKIM-Signature header mean? 9 min
- DMARC alignment: relaxed vs strict, and what adkim and aspf do 9 min
- Why do mailing lists break DMARC, and how do you fix it? 9 min
- How do you set up DMARC for your onmicrosoft.com domain? 8 min
- DMARC p=quarantine vs p=reject: which should you use? 9 min
- DMARC rua and ruf: how to set up DMARC reporting addresses 9 min
- How do you set up DMARC for Google Workspace? 9 min
- DMARCbis and RFC 9989: what changed in DMARC, and what should you do? 9 min
- Multiple SPF records found: why it causes PermError and how to merge them 8 min
- How does subdomain takeover through dangling DNS put your email at risk? 9 min
- BIMI explained: how to show your brand logo in the inbox 8 min
- How to rotate DKIM keys without breaking email 9 min
- How to set up DKIM in Microsoft 365 and Google Workspace 9 min
- Moving DMARC from p=none to p=reject: a staged rollout for small businesses 9 min
- DMARC record examples, explained tag by tag 9 min
- DMARC subdomain policy: how sp, np and the tree walk work 8 min
- Why email forwarding breaks SPF and DMARC, and how ARC helps 9 min
- What do Gmail's warning banners mean, and how do you stop them on your mail? 9 min
- Gmail, Yahoo and Microsoft bulk sender requirements explained 9 min
- How to read DMARC reports 9 min
- MTA-STS and TLS-RPT explained: how to set them up safely 9 min
- How to protect parked and non-sending domains from spoofing 8 min
- SPF record syntax and examples 9 min
- SPF softfail vs hardfail: should you use ~all or -all? 8 min
- How to fix SPF PermError: too many DNS lookups 8 min
- SPF vs DKIM vs DMARC: what each one proves, and what it doesn't 8 min
- What is DKIM, and how does a DKIM signature work? 10 min
- What is SPF, and how does an SPF record work? 9 min
Setup guides
Step-by-step instructions for running a spam filter in front of Microsoft 365, Google Workspace and cPanel/WHM.
- How do you configure Gmail spam and phishing settings in Google Workspace? 9 min
- How do you protect the domain your email depends on? 10 min
- How do Exchange Server's built-in anti-spam agents work, and are they enough? 10 min
- How do you enforce 2-Step Verification in Google Workspace without locking people out? 10 min
- How do you set up advanced phishing and malware protection in Google Workspace? 10 min
- How do you use Gmail content compliance rules to improve email security in Google Workspace? 10 min
- How do you set up the advanced delivery policy for phishing simulations in Microsoft 365? 9 min
- Microsoft 365 anti-phishing policy settings: what each one does 10 min
- How do you configure anti-spam policies in Microsoft 365? 10 min
- How do you set up Attack simulation training in Microsoft 365? 10 min
- Microsoft 365 connectors explained: when you need them and how they work 9 min
- What are Microsoft 365 preset security policies, and should you use them? 9 min
- How do Safe Links and Safe Attachments work in Microsoft 365, and how do you set them up? 10 min
- What does the SMTP AUTH Basic auth retirement mean for your Microsoft 365 tenant? 9 min
- How does spoof intelligence work in Microsoft 365? 9 min
- How do you add SPF, DKIM and DMARC records in Cloudflare? 8 min
- How do you add email DNS records in GoDaddy? 8 min
- How do you add email DNS records in Namecheap? 8 min
- How do you set up DMARC for Microsoft 365 domains? 9 min
- How to put an external spam filter in front of cPanel/WHM 9 min
- How to set up a Google Workspace inbound gateway for a spam filter 9 min
- How do you set up scan to email and app SMTP with Microsoft 365? 9 min
- How to use an external spam filter with Microsoft 365 and Enhanced Filtering for Connectors 10 min
- How do you set up email on a new business domain? 10 min
- How do you add an external email warning tag in Outlook and Microsoft 365? 9 min
Running email day to day
False positives, headers, allow lists, outages and the everyday questions admins get asked.
- Why is spam getting through the Microsoft 365 spam filter, and how do you fix it? 9 min
- Email deliverability checklist: how to reach the inbox in 2026 9 min
- How do you find and release quarantined email in Microsoft 365? 9 min
- Why are legitimate emails going to Junk in Microsoft 365, and how do you fix it? 9 min
- How do you test that your spam filter is actually working? 9 min
- How do you manage email security across multiple domains? 9 min
- How do you protect a shared mailbox from spam and phishing? 9 min
- Should you use a catch-all email address? 9 min
- What are email feedback loops and how do you set them up? 9 min
- How do you build an email security incident response plan for a small business? 11 min
- Which email security metrics should admins track each month? 9 min
- What are the email sending limits in Microsoft 365 and Google Workspace? 9 min
- How do you secure email when an employee leaves? 10 min
- How do you set up and manage the Gmail admin quarantine in Google Workspace? 9 min
- How do you use Email Log Search in Google Workspace? 9 min
- How do you use the Google Workspace security investigation tool to remove phishing email? 9 min
- IPv6 email deliverability: what you need before sending over IPv6 9 min
- How do you find and block malicious inbox rules and auto-forwarding? 10 min
- Which Microsoft 365 alert policies matter for email, and how do you set them up? 9 min
- How do you use the Microsoft 365 audit log to investigate an email incident? 10 min
- How does automated investigation and response (AIR) work in Microsoft 365? 9 min
- How do you run a message trace in Microsoft 365? 9 min
- How do quarantine policies and notifications work in Microsoft 365? 9 min
- How do you set up the Report button and user reported settings in Microsoft 365? 10 min
- Threat Explorer vs Real-time detections: how do you investigate email in Microsoft 365? 9 min
- What does zero-hour auto purge (ZAP) do in Microsoft 365? 9 min
- Mobile email security: how to protect work email on personal phones 9 min
- Are out-of-office auto-replies a security risk? 9 min
- How do you get email delivered to Outlook.com and Hotmail? 10 min
- How do Outlook's junk email filter settings work, and which should you use? 9 min
- Why aren't my password reset emails arriving? 9 min
- How do you protect public email addresses like info@ from spam? 9 min
- How do you restrict who can email a distribution list? 8 min
- Should you use separate subdomains for marketing and transactional email? 9 min
- What are spam traps, and how do you avoid them? 9 min
- Who are the unknown sources in my DMARC reports? 9 min
- How to stop spammers bypassing your filter by delivering straight to your mail server 9 min
- How do you block a sender or domain in Microsoft 365? 9 min
- Email security checklist for small businesses in 2026 9 min
- Email security for remote teams: what to set up first 9 min
- Email warm-up: how to warm up a new domain or IP address 9 min
- Legitimate email flagged as spam: why false positives happen and how to fix them safely 8 min
- How do you set up and read Google Postmaster Tools? 10 min
- Hard bounce vs soft bounce: what's the difference and what should you do? 9 min
- How to read email headers 10 min
- Which Microsoft 365 mail flow rules improve email security, and how do you set them up safely? 9 min
- Microsoft 365 spam headers explained: how to read SFV, CAT, BCL and compauth 9 min
- One-click unsubscribe (RFC 8058): how to set it up and test it 9 min
- How to get your domain or IP removed from an email blacklist 9 min
- Reverse DNS and PTR records for mail servers 8 min
- Shared vs dedicated IP for email: which one do you need? 9 min
- Spam complaint rate explained: what it is and how to lower it 9 min
- Why are my website form emails going to spam? 9 min
- What happens to email when your mail server is down? 8 min
- How do you safely whitelist a sender in Microsoft 365 and Google Workspace? 9 min
- Why are my emails going to spam, and how do I fix it? 10 min
- Why did this email go to spam or quarantine? 9 min
Switching & migration
Change MX records and switch spam filter providers without losing email: lower TTLs, stage the new path, cut over, verify, roll back.
- How do you decommission your old spam filter after switching? 9 min
- How does DNS TTL affect an MX record change? 9 min
- Exchange Server 2016 and 2019 end of support: what are your options? 10 min
- How to change MX records without losing email 11 min
- How to switch spam filter providers without a gap in protection 9 min
Choosing a filter
What to compare when you choose an email security service, and what the pricing models really cost.
- Email security RFP template: 25 questions to ask before you buy 10 min
- How should an MSP price managed spam filtering? 9 min
- Defender for Office 365 Plan 1 vs Plan 2: which do you need? 9 min
- How much does email security cost a small business? 11 min
- Email security for ecommerce stores: protect orders, customers and payments 10 min
- Email security for K-12 schools: the threats and a practical checklist 10 min
- Email security for local government: a practical guide for municipalities 10 min
- Free vs paid spam filter: is free good enough for a business? 9 min
- The FTC Safeguards Rule and email security: what it requires 10 min
- Google Workspace vs Microsoft 365: which has better email security? 10 min
- How to evaluate a spam filter during a trial or pilot 10 min
- Hosted vs on-premise spam filter: which should you choose? 9 min
- How to choose a spam filter for a small business 9 min
- Secure email gateway vs API-based email security: which do you need? 9 min
- How to stop spam for your whole domain, not one inbox at a time 8 min