Understanding email headers: the complete guide to reading and analyzing every field
Every email carries an invisible logbook. This guide teaches you how to extract it, read it field by field, and diagnose deliverability or security issues.
CaptainDNS Blog
DNS, email authentication, AI integrations and product updates.
Technical guides, comparisons and insights on public DNS resolvers (Cloudflare, Google, Quad9), email authentication (SPF, DKIM, DMARC, BIMI, ARC) and deliverability. Learn how to configure Amazon SES, Brevo, SendGrid or Mailjet, and explore our AI integrations with ChatGPT and the MCP protocol. Whether you're a sysadmin, developer or marketing manager, find best practices here to secure your domains and optimize your email delivery.
Articles
March 2026
10 email filter gaps: the subtle header signals your gateway misses
Your email gateway blocks 99% of threats. But the 1% that gets through is what matters. Here are the 10 header indicators that most filters ignore.
Test Email Deliverability: The Complete Guide Before Sending
One in five emails never reaches the inbox. This guide shows you how to test your email deliverability before sending and fix every issue.
DNS Propagation Time: How Long Does It Really Take?
The 24 to 48 hour myth is wrong. The actual delay depends on TTL, and you can control it.
URL Shorteners: Why bit.ly, t.ly and Their Peers Have Become Phishing's Weapon of Choice
t.ly, Is.gd, Goo.su: URL shorteners fuel phishing, malware, and security filter evasion. Learn the exploitation techniques and how to verify every link before you click.
NIST SP 800-81r3: what the new DNS security guide changes
Full analysis of NIST SP 800-81r3, released March 19, 2026. Protective DNS, DNSSEC, encrypted DNS: the key recommendations for securing your infrastructure.
HTTP redirects: how to detect loops, chains and suspicious shortened links
Complete guide to identifying redirect loops, excessive chains and suspicious shortened links. Diagnosis, fixes and security best practices.
Ballot SC-085v2: certificate authorities now verify DNSSEC before issuing a TLS certificate
Since March 15, 2026, the CA/Browser Forum requires CAs to verify DNSSEC during domain validation. This guide covers the context, impact, and how to check your configuration.