Plain-language writing on email authentication, deliverability and domain health — why these systems break quietly, what that costs, and what keeping them correct actually involves. No scare stories; every piece explains what to do about it.
October’s awareness month is mostly about people and the messages aimed at them. The same question applies to a smaller group: the few people whose logins can change your domain. Five questions, and an hour to answer them.
Since 15 March 2026, newly issued publicly trusted TLS certificates may last at most 200 days, with two further reductions scheduled. If you previously renewed once a year, you now need to renew more often; if a system handles it, check what that system depends on.
The world's largest mailbox providers now expect stronger email authentication, and the requirements reach senders of every size. If quotes, invoices or booking confirmations have started disappearing, this is one of the first places to look — and the fix starts with three DNS records.
The EU's cybersecurity agency studied exactly this assumption, and its conclusion is blunt: criminals often prefer smaller firms. What one documented incident cost, why email is the front door, and a checklist in order of impact.
A domain's email and security posture isn't a wall you build once; it's a garden that grows weeds. Why correctly configured records quietly stop being correct, and why the annual check-up finds out too late.
A scanner, a security questionnaire or a mailbox provider has flagged that your domain has no effective DMARC policy. What that actually exposes you to, and a measured sequence for reducing the risk.
Your message was rejected by Microsoft before reaching the recipient — a permanent failure, not a spam-folder detour. The four usual causes, and the fix for each.
Gmail could not verify that the message legitimately comes from your domain, and unauthenticated mail is increasingly rejected rather than spam-foldered. Where to look, and what to fix.
An SPF evaluation returns permerror when its path exceeds the lookup budget. Why paths differ between senders, where lookups accumulate, and how to reduce the risk.
The receiving server did exactly what your own DMARC policy told it to do. How to tell an incomplete sender inventory from a blocked forgery — and why the answer is finishing the alignment work, not abandoning the policy.