Koltrix
Deliverability
Locking down domains that never send email
Unused domains are easy spoofing targets. Publish a null MX, a deny-all SPF record and a reject DMARC policy so nobody can send mail as them.
4 min read
DeliverabilitySPF, DKIM and DMARC in plain English
Three DNS records decide whether your email arrives. What each one actually does, what to publish, and the four mistakes that cause most of the support tickets.
4 min read
DeliverabilityBIMI readiness checklist: DMARC, SVG and certificates
Everything you need before a BIMI logo shows up: DMARC at enforcement, an SVG Tiny PS logo, an optional VMC or CMC, and a correctly formed DNS record.
5 min read
DeliverabilityAligning DKIM when a vendor sends on your behalf
CRM, billing and support tools often sign with their own domain. How to get vendor mail DKIM-aligned with your From domain before enforcing DMARC.
4 min read
- Guides
Sending DMARC reports to another domain: the auth record
If your rua address lives on a different domain, receivers check an authorization record first. How the _report._dmarc record works and how to test it.
4 min read
DeliverabilitySeparate subdomains for transactional and marketing mail
Splitting streams across subdomains contains reputation damage. How to structure them, align SPF and DKIM per subdomain, and what it cannot protect.
4 min read
DeliverabilityHow to read a DMARC aggregate report, line by line
DMARC aggregate reports are compressed XML that few people read. Walk through each element, what the counts mean, and how to spot spoofing quickly.
5 min read
DeliverabilitySPF ~all vs -all: what each qualifier does in practice
Softfail or hard fail? How receivers treat ~all and -all today, why DMARC changed the calculus, and which ending to pick for each kind of domain.
4 min read
DeliverabilityDMARCbis is now RFC 9989: what changes for your record
DMARC moved to the standards track as RFCs 9989, 9990 and 9991. Here is what changed: pct is gone, np and psd arrive, and a DNS tree walk replaces the PSL.
4 min read
DeliverabilityA staged path from DMARC p=none to p=reject
A week-by-week DMARC rollout: monitor with p=none, fix every legitimate source, move to quarantine, then reject, with clear exit criteria per stage.
4 min read
DeliverabilityWhy DMARC breaks mailing lists, and how ARC helps
Forwarders and mailing lists modify messages and break SPF and DKIM. Understand the failure, From rewriting, and what ARC chains do and do not fix.
4 min read
GuidesBefore Any Email Migration: Inventory Everything That Sends as You
Most email migrations break something nobody listed: a CRM, a form, a scanner. How to find every service that sends as your domain before you change DNS.
4 min read