Blog
News, tips and insights about email security.
Why your DMARC report shows 46% fail — and why only 3% of it matters
Red report, green delivery — how does that add up? You open your DMARC aggregate report and see 46% SPF fail. First instinct: something is broken, or someone i…
Read more
The Undelegated Subdomain Trap: Why p=reject Alone Is Not Enough
p=reject and still spoofed for two weeks via a non-existent subdomain. Why sp= is necessary but not sufficient — and why the wildcard DMARC record fails.
Read more
DMARCPulse May 2026 Update: Hosted Mailbox, App-Only and Honest SPF
Three improvements shipped: hosted DMARC report address, Microsoft-365 App-Only auth without your own certificate, new Aligned column with real DMARC numbers.
Read more
NIS2 is in force — what it means for DMARC, SPF, and MTA-STS
Since 6 Dec 2025, NIS2 in Germany requires 29,500 firms to take technical cyber-risk measures. Email auth is part of it — management is personally liable.
Read more
Robinhood phished its own customers with perfect email authentication — what actually broke
April 2026: Robinhood customers got phishing from Robinhood servers — valid SPF, DKIM, DMARC and BIMI. Defect: HTML injection in a transactional template.
Read more
The $3 billion email problem: What the FBI's 2025 IC3 report means for the DACH mid-market
BEC caused $3 billion in losses per the FBI 2025 IC3 report. For DACH mid-market under NIS2, regulatory and financial risk now align — DMARC remains overlooked.
Read more
What Is DANE? — Anchor Certificates in DNS
DANE binds TLS certificates to DNS, protecting inbound email against downgrades and forged certs. How TLSA records work, MTA-STS comparison, DANE setup.
Read more
What Is DNSSEC? — Sign and Verify DNS Answers
DNSSEC protects against DNS spoofing and cache poisoning via cryptographically signed responses. How it works, how to activate it, and why it matters for DANE.
Read more
Why 46% of All Emails Fail DMARC — And Why Much of It Is Friendly Fire
Cloudflare 2026: nearly half of 450M analyzed emails failed DMARC. Much of it is legitimate mail broken in transit — five common causes and what senders can do.
Read more
DACH Email Security 2026: 503 Domains
SPF, DMARC, MTA-STS and DNSSEC analyzed across 503 DACH domains: a significant enforcement gap, especially in education and government.
Read more