How email delivery actually decides

Every guide

• How a receiving server decides a message really came from you SPF, DKIM and DMARC each prove something different about a message. What email authentication checks, why all three are needed, and the order to deploy them in.
• Writing an SPF record that says what you mean How an SPF record is evaluated: mechanisms, qualifiers, the ten-lookup limit, -all against ~all, and the failure modes that quietly break authentication.
• How a DKIM signature is made, published and verified DKIM key pairs, selectors, the public key TXT record, canonicalisation, key length and rotation — and the reasons a valid signature breaks in transit.
• Publishing a DMARC record and tightening it safely The DMARC record tag by tag — p, sp, pct and alignment — with a staged rollout from p=none to p=reject driven by what the aggregate reports actually show.
• Turning DMARC XML into a list of things to fix What a DMARC aggregate report contains, how to read sources, volumes and pass rates, why RUF reports are rare, and how to turn a report into a list of fixes.
• What a blocklist listing means, and what to do about it How a DNSBL query works, the difference between IP and domain lists, why a listing happens, how to check one properly, and how delisting is done.
• How MX records route mail, and how they get broken What an MX record publishes, how preference values are used, when a backup MX helps, the null MX convention, and the misconfigurations that stop delivery.
• Why the name attached to your sending address matters PTR records, forward-confirmed reverse DNS, who controls the PTR for a sending IP address, and why receiving filters treat a missing or generic one as a signal.
• How mail servers negotiate encryption, and how to require it The SMTP conversation step by step, how STARTTLS is negotiated, why opportunistic TLS can be stripped, and how MTA-STS and TLS-RPT make encryption a requirement.
• How to trace a message through its own headers How to read a Received chain from the bottom up, find the hop that added the delay, and interpret Authentication-Results, Return-Path, Message-ID and ARC sets.
• What a rule-based filter measures, and what you control How rule-based spam scoring works, what the rules examine, how thresholds are chosen, and which parts of a score a sender can genuinely change.
• Why a domain that passes every check still lands in spam Why a domain that passes every record check can still land in spam, what a seed or placement test measures, what it cannot measure, and how to read a result.