short posts on the tools this site ships and the plumbing behind them.
· By Arshad Ansari · dmarc · spf · dkim · mta-sts · email authentication · grc · compliance · study
The firms that audit everyone else's email authentication for a living, measured on the same checks. Nearly half can be spoofed. First-party findings.
· By Arshad Ansari · dmarc · spf · dkim · mta-sts · email authentication · security · study
Password managers, VPNs and security platforms sell trust for a living. We ran the same email-authentication checks on their own domains. The results.
· By Arshad Ansari · security-questionnaire · compliance · dmarc · spf · evidence
The DNS, email and TLS questions buyers ask, what each one is really checking, and the evidence that turns a Partial answer into a clean Yes.
· By Arshad Ansari · spf · dkim · dmarc · compliance · evidence
Auditors ask a different question than deliverability does: can you show the control was configured, on a date, and verified? What they accept as proof.
· By Arshad Ansari · dmarc · spf · email · email-security · research
We scanned 994 of the web's top domains for SPF, DKIM, DMARC, MTA-STS and TLS-RPT. Who enforces, who only monitors, and where whole sectors fall short.
· By Arshad Ansari · dmarc · spf · email · email-security · fintech · research
98.5% of the banks and fintechs we scanned enforce DMARC and 86.6% sit at p=reject — yet not one publishes MTA-STS. First-party scan results.
· By Arshad Ansari · dmarc · spf · email · email-security · news · research
95% of the news organizations we scanned publish DMARC, but one in five only monitor — which leaves the From address spoofable. First-party findings.
· By Arshad Ansari · dmarc · spf · email · email-security · ai · research
Every AI lab we scanned publishes SPF, DMARC and DKIM — but most stop at p=quarantine instead of p=reject. First-party findings from 18 companies.
· By Arshad Ansari · dmarc · spf · email · email-security · big-tech · research
Big Tech leads on transport security and is the only cohort meaningfully using MTA-STS — yet several still only monitor at p=none. First-party scan results.
· By Arshad Ansari · mx · dns · email · priority · mail-routing
Priority is a preference number, and lowest wins — senders try it first and fall back only on failure. Equal numbers share load. It says nothing about quality.
· By Arshad Ansari · mx · dns · email · backup-mx · mail-routing
Sending servers already queue and retry for days, so a second MX buys little — and if it is not configured identically, it invites backscatter and relay abuse.
· By Arshad Ansari · google-workspace · mx · dns · email · troubleshooting
Usually leftover MX records from the old host, records on the wrong hostname, a missing trailing dot, or SPF and DMARC rejecting the mail. The checklist.
· By Arshad Ansari · mta-sts · smtp · tls · email-security · dns
Senders need a _mta-sts TXT record with a current id, a policy file over valid HTTPS, and a text/plain content type. Miss one and enforcement is skipped.
· By Arshad Ansari · mta-sts · tls-rpt · email-security · smtp · deliverability
Testing mode reports TLS failures through TLS-RPT but still delivers. Move to enforce only once reports are clean, or senders will refuse to deliver.
· By Arshad Ansari · tls-rpt · smtp · tls · email-security · mta-sts
TLS-RPT reports arrive as JSON telling you which sessions failed and why — certificate mismatch, expired, or no STARTTLS. Here is how to read one.
· By Arshad Ansari · spf · dmarc · email · deliverability · dns
~all softfail asks receivers to accept and flag; -all hardfail asks them to reject. Move to -all once every legitimate sender is in the record.
· By Arshad Ansari · bimi · dmarc · email · dns · branding
A BIMI logo needs DMARC at p=quarantine or p=reject, a default._bimi TXT record pointing at an SVG Tiny PS file, and a VMC for Gmail and Apple Mail.
· By Arshad Ansari · dmarc · alignment · spf · dkim · deliverability
Authentication is not the problem — alignment is. The return-path or DKIM signing domain does not match your From: header. Here is how to line them up.
· By Arshad Ansari · dmarc · email · spoofing · deliverability · policy
p=none monitors and stops nothing. p=quarantine sends failing mail to spam. p=reject bounces it at the SMTP edge. Only reject protects your domain.
· By Arshad Ansari · dmarc · rua · email · deliverability · reporting
A DMARC aggregate report is an XML summary of who sent mail as your domain and whether it passed. Here is how to read every section and what to fix.
· By Arshad Ansari · dmarc · spoofing · phishing · email · deliverability
DMARC only protects the visible From: domain. Lookalike domains, display-name spoofing, and unprotected subdomains all sail straight past p=reject.
· By Arshad Ansari · spf · email · dmarc · deliverability · dns
Each SPF result means something different to a receiver, and only some cause rejection. What every verdict signals, and which ones you should act on.
· By Arshad Ansari · spf · email · dns · deliverability · permerror
A domain may publish exactly one SPF record. Two means a permerror and every check fails. Merge the mechanisms into one record, watching the 10-lookup cap.
· By Arshad Ansari · dkim · email · dmarc · authentication · deliverability
dkim=none means the message arrived with no DKIM-Signature header at all — not the same as dkim=fail. Why it breaks DMARC, and how to get every sender signing.
· By Arshad Ansari · dkim · email · deliverability · authentication · canonicalization
The message body changed after signing, so the hash no longer matches. Mailing lists, footers, and rewriting gateways are the usual culprits.
· By Arshad Ansari · dkim · dns · txt-record · email · deliverability
A 2048-bit DKIM key exceeds the 255-character limit for a single TXT string. Split it into quoted chunks — DNS concatenates them back into one value.
· By Arshad Ansari · mta-sts · tls-rpt · email · smtp · tls
MTA-STS and TLS-RPT secure the TLS connection between mail servers. What they do, how they differ from SPF/DKIM/DMARC, and when they are worth the effort.
· By Arshad Ansari · dnssec · dns · security · registrar · spoofing
DNSSEC stops forged DNS answers, but a stale DS record or an expired signature takes your whole domain offline with SERVFAIL. What breaks, and when.
· By Arshad Ansari · mx · dns · email · deliverability · bounces
Receiving servers cannot work out where to deliver your mail, so it bounces. The usual causes, the fix, and how to confirm it with a single dig.
· By Arshad Ansari · spoofing · dmarc · spf · dkim · email
A domain is spoofable when it lacks an enforced SPF and DMARC posture. How to test for the three records that stop it, and why p=none does not.
· By Arshad Ansari · authentication-results · dmarc · spf · dkim · spoofing
The receiving server records its SPF, DKIM and DMARC verdicts in this header. Read it to tell a genuine message from a spoofed one, field by field.
· By Arshad Ansari · email · spf · dkim · dmarc · deliverability
Work through them in order. SPF and DKIM must pass and align before DMARC can do anything, and enforcing DMARC too early quietly drops real mail.
· By Arshad Ansari · dkim · email · dns · cryptography
A DKIM signature names its key with a selector you can't look up anywhere. How selectors work, why discovery is hard, and the ones common senders use.
· By Arshad Ansari · spf · email · dns · deliverability
Every include, a, mx and redirect costs a DNS lookup. Past ten, SPF returns permerror and every check fails. Flatten or drop senders to get back under.
· By Arshad Ansari · dmarc · email · spf · dkim · deliverability
DMARC tells receivers what to do when SPF and DKIM fail, and reports back who sends as you. How the record reads, and how to verify it is enforcing.
· By Arshad Ansari · soc2 · compliance · evidence · tls · dnssec
Auditors want dated, repeatable proof of your DNS, email and TLS controls — not a screenshot. What to capture, and how to make it stand up on review.
· By Arshad Ansari · whois · rdap · gdpr · domain-ownership · privacy
GDPR forced registrars to hide registrant details, so most WHOIS is blank. What still shows, and the routes that reach a real owner when it matters.
· By Arshad Ansari · whois · dns · ttl · domain-expiry · redemption
Cached DNS records keep answering until their TTL runs out, and the registry adds grace periods. The site goes dark when the registrar sets clientHold.
· By Arshad Ansari · dns · ttl · propagation · nameservers · caching
There is no global push. Resolvers cache each record until its TTL runs out, so the wait is that TTL plus when they last asked. Nameserver changes take longer.
· By Arshad Ansari · dns · cname · apex · alias · aname
RFC 1034 forbids a CNAME beside the SOA and NS records every apex must hold. Providers work around it with CNAME flattening, ALIAS, or ANAME records.
· By Arshad Ansari · dnssec · dns · servfail · ds-record · troubleshooting
A validating resolver returns SERVFAIL when the chain of trust breaks. Check the DS record against your DNSKEY first, then look for expired signatures.
· By Arshad Ansari · caa · dns · certificates · tls · security
A CAA record names which certificate authorities may issue for your domain, so a rogue CA cannot. It is two lines of DNS and it takes effect immediately.
· By Arshad Ansari · subdomain-takeover · dns · cname · attack-surface · security
A CNAME pointing at a deprovisioned service lets anyone who claims that name serve content on your subdomain. How to find and close them.
· By Arshad Ansari · mcp · claude · ai · dns
Point Claude at an MCP server and it can read SPF, DMARC, DKIM, MX and TLS for any domain in the chat — no tab switching, no copying records by hand.
· By Arshad Ansari · dns · doh · cloudflare · privacy
Classic DNS is plaintext anyone can read or forge. DoH encrypts it over HTTPS — here's how Cloudflare's JSON endpoint works for browser-side tools.
· By Arshad Ansari · tls · ssl · certificates · wildcard · san
A wildcard covers unlimited subdomains at one level of one domain. A SAN covers a fixed list across domains. Pick by how names get added, not by price.
· By Arshad Ansari · tls · ssl · certificates · self-signed · acme
The browser warns because nothing vouches for the certificate. Issue a real one from a public CA, or add your own CA to the trust store — never click through.
· By Arshad Ansari · tls · ssl · handshake · openssl · certificates
The handshake fails when client and server share no protocol version, cipher, or curve — or the certificate does not check out. How to find which.
· By Arshad Ansari · redirects · https · hsts · tls · http
Six usual causes: apex-only or www-only rules, nothing listening on port 80, a CDN in Flexible SSL mode looping, no HSTS yet, or a cached old response.
· By Arshad Ansari · tls · ssl · certificates · nginx · openssl
The certificate is renewed on disk but something still serves the old one: an unreloaded service, a second listener, a CDN cache, or the browser itself.
· By Arshad Ansari · redirects · cloudflare · ssl · https · debugging
A page redirects to a page that redirects back. The classic cause is Cloudflare SSL set to Flexible, plus www and HTTPS rules fighting each other.
· By Arshad Ansari · certificate-transparency · tls · ssl · ct-logs · mis-issuance
Every public certificate lands in a Certificate Transparency log. Query crt.sh for your domain to spot certificates nobody on your team asked for.
· By Arshad Ansari · tls · certificates · ssl · openssl · nginx
Browsers can paper over a missing intermediate; curl and older clients cannot. Serve the full chain from your CA — never add the root to fix it.
· By Arshad Ansari · hsts · https · security-headers · tls · web-security
HSTS forces HTTPS for a fixed period, so a wrong max-age or includeSubDomains is hard to undo. Start short, widen slowly, and preload only when certain.
· By Arshad Ansari · tls · ssl · certificates · security
A cert outage is predictable, not unlucky. What to inspect on a live TLS certificate, and the surprises that only show up in the final week before expiry.
· By Arshad Ansari · security · http · headers · csp · hsts
The HTTP response headers that protect modern web apps — HSTS, CSP, X-Content-Type-Options, Referrer-Policy, Permissions-Policy — with a safe value for each.
· By Arshad Ansari · cors · access-control-allow-origin · browser · api · headers
The API is not returning the header the browser requires. CORS is enforced in the browser but configured on the server, so no frontend change can fix it.
· By Arshad Ansari · cors · credentials · access-control-allow-origin · cookies · headers
When a request carries cookies, the spec bans Access-Control-Allow-Origin: * — the server must echo the exact origin and add Allow-Credentials: true.
· By Arshad Ansari · permissions-policy · security-headers · feature-policy · browser-features · privacy
One header tells the browser which APIs your site may use — camera, microphone, geolocation. Denying the rest shrinks what a script injection can reach.
· By Arshad Ansari · referrer-policy · security-headers · privacy · referer · http-headers
The browser sends the full URL same-origin, only your origin cross-origin, and nothing on HTTPS to HTTP. It is the modern default — when to change it.
· By Arshad Ansari · redirects · seo · http
A 301 is permanent — browsers cache it hard and search engines pass ranking signals to the target. A 302 is temporary and keeps the original URL indexed.
· By Arshad Ansari · csp · security-headers · browser · xss · http-headers
A Content-Security-Policy directive does not inherit once you set a more specific one. If script-src exists, default-src no longer covers your scripts.
· By Arshad Ansari · cors · http · browsers · api
The OPTIONS request a browser fires before a non-simple cross-origin fetch. What triggers it, what the server must return, and the five ways it fails.
· By Arshad Ansari · redirects · http · seo · performance
Long redirect chains bleed SEO equity and add latency. What counts as too many hops, how browsers and crawlers follow them, and how to trace one end-to-end.
· By Arshad Ansari · vercel · edge · http-headers · nextjs
Behind a CDN the socket address is always the edge node. The real client IP rides in x-forwarded-for — here's how to read it safely in a Next.js 15 handler.
· By Arshad Ansari · llms.txt · ai · llm · robots.txt · crawlers · seo
llms.txt is a plain-text map of your site for language models — a curated index of the pages worth reading. What goes in it, and what does not.
· By Arshad Ansari · git · dotfiles · secrets · web-security · attack-surface
A reachable /.git/ lets anyone rebuild your source; a served /.env hands over credentials. Block dotfiles at the edge, and rotate anything exposed.
· By Arshad Ansari · mcp · ai · workflow · networking
Give your assistant DNS, TLS and email-auth tools over MCP and it can diagnose a domain mid-conversation instead of telling you which site to visit.
· By Arshad Ansari · json · logging · observability
One JSON object per line is what log collectors parse. Pretty-printing spans many lines and breaks ingestion — keep it for local reading only.
· By Arshad Ansari · ip · networking · geolocation · asn
Country-level lookups are usually right; city-level often is not. ASN and ISP tell you who routes the address, which is not where the user sits.
· By Arshad Ansari · url · javascript · encoding
encodeURIComponent escapes everything unsafe in a value; encodeURI leaves the characters that make a URL work. Use the first for parameters, always.
· By Arshad Ansari · jwt · auth · tokens
iss issued it, sub is who it is about, aud may accept it; exp ends it, nbf starts it, iat stamps it. The RFC 7519 claims, with a worked example.
· By Arshad Ansari · base64 · encoding · security
Base64 is a reversible encoding — anyone can decode it in one line. If a value is secret, Base64 does nothing to protect it. Here's the proof.
· By Arshad Ansari · jwt · auth · security
Reading a JWT's payload is decoding; verifying the signature is a separate trust decision. Here's how to inspect a token safely without conflating them.
· By Arshad Ansari · uuid · postgres · databases · performance
v4 is random and scatters writes across the index. v7 is time-ordered, so inserts stay sequential and range queries work. Use v7 for new tables.