Koltrix
Deliverability
SPF, DKIM and DMARC in plain English
Three DNS records decide whether your email arrives. What each one actually does, what to publish, and the four mistakes that cause most of the support tickets.
4 min read
Email APISending email on behalf of your customers' domains
SaaS platforms that send as their customers need domain verification, per-tenant DKIM and isolated reputation. The architecture and the onboarding flow.
5 min read
DeliverabilityAligning DKIM when a vendor sends on your behalf
CRM, billing and support tools often sign with their own domain. How to get vendor mail DKIM-aligned with your From domain before enforcing DMARC.
4 min read
DeliverabilityRotating DKIM keys without dropping a single message
A selector-based DKIM rotation plan: publish the new key, switch signing, keep the old key long enough, then revoke it with an empty p= tag.
4 min read
GuidesTwo email providers on one domain without breaking auth
Running a workspace mailbox provider and a transactional sender on the same domain? Combine SPF, give each its own DKIM selector, and align DMARC.
5 min read
DeliverabilityDKIM body hash did not verify: the usual suspects
When DKIM fails with a body hash mismatch, something changed the message after signing. Find the culprit: footers, rewriters, line endings, encoding.
4 min read
GuidesEvery DNS record a sending domain needs, in one table
A reference table of the DNS records a domain that sends email should have: MX, SPF, DKIM, DMARC, MTA-STS, TLS-RPT and BIMI, with syntax for each.
4 min read
GuidesPublishing a 2048-bit DKIM key when DNS splits strings
A 2048-bit DKIM public key exceeds the 255-character TXT string limit. How string splitting works, provider quirks, and how to verify the result.
4 min read
DeliverabilityEd25519 DKIM: should you dual-sign yet?
RFC 8463 added Ed25519 to DKIM, but receiver support is uneven. Learn how dual signing with RSA works and whether it is worth the operational cost.
4 min read
DeliverabilityDKIM header oversigning and why the l= tag is a trap
Which headers to sign, why signing From twice blocks header injection, and how the l= body length tag lets attackers append content to signed mail.
5 min read
- Guides
A 30-minute email authentication audit for your domain
A timed checklist to audit SPF, DKIM, DMARC and transport security on any domain, with the commands to run and what a passing answer looks like.
4 min read
DeliverabilityDKIM replay attacks: how signed mail gets abused
A single legitimately signed message can be resent to millions. How DKIM replay works, why it hurts your domain, and the mitigations available today.
4 min read