Domain without email: the Null MX configuration
An explicit DNS zone for a website without email or a defensive domain: Null MX, strict SPF, DMARC reject, no DKIM selector, and an appropriate CAA policy.
DMARC
Domain-based Message Authentication implementation and policy configuration.
29 articles
August 2026
July 2026
June 2026
Hornetsecurity Secure Email Gateway (ex-Vade): architecture, DNS configuration and alternatives
Hornetsecurity 365 Total Protection is the cloud SEG for SMBs and MSPs (ex-Vade, now Proofpoint). Complete guide: architecture, mx01.hornetsecurity.com MX, spf.hornetsecurity.com SPF include, DKIM by CNAME, gateway vs API and a comparison with Proofpoint/Barracuda/Mimecast.
Barracuda Email Gateway Defense: architecture, DNS configuration and alternatives
Barracuda Email Gateway Defense is the cloud SEG for SMBs and MSPs (200,000+ customers). Complete guide: architecture, *.ess.barracudanetworks.com MX, SPF/DKIM/DMARC, DNS detection, the distinction with the ESG appliance (CVE-2023-2868) and a comparison with Mimecast/Proofpoint/Defender.
ARC moves to "Historic" status at the IETF: should you still care in 2026?
The IETF is reclassifying ARC (RFC 8617) as "Historic." But deprecated on paper does not mean dead in practice: Apple, Google and Microsoft still require it. Here is what really changes and what you should do.
May 2026
Email deliverability score: what it's made of and how to improve it
The email deliverability score is not a black box. It rests on five measurable pillars: authentication, reputation, transport security, BIMI and engagement. This guide breaks them down and gives the thresholds to aim for.
April 2026
Cloudflare Email Service: Email Routing, Security, and DMARC Management explained
Cloudflare now covers 4 email layers: free Email Routing, transactional Email Service (public beta April 2026), anti-phishing Email Security (formerly Area 1), and DMARC Management. Complete guide covering architecture, DNS, Proofpoint/Mimecast comparison, and pricing.
Cisco Secure Email Cloud Gateway (CES): SaaS architecture, iphmx.com DNS and ESA migration
Cisco Secure Email Cloud Gateway (CES) is Cisco's primary SaaS offering in 2026, the successor to the legacy ESA appliances inherited from Ironport. Complete guide: CES onboarding, iphmx.com MX records by region (NA/EU/APJ), SPF/DKIM/DMARC, migration from ESA to CES, 2024-2025 Gartner Magic Quadrant exit, zero-day CVE-2025-20393, comparison with Proofpoint, Mimecast, Defender and Abnormal.
Abnormal Security: behavioral AI, API deployment, and email gateway alternatives
Abnormal Security is an API-native ICES platform that detects BEC, VEC, and Account Takeover attacks using behavioral AI, with no MX change required. Complete guide: Attune 1.0 architecture, Proofpoint/Mimecast/Defender comparison, limitations, and DNS record audit.
Proofpoint Secure Email Gateway: architecture, DNS configuration and alternatives
Proofpoint is the enterprise SEG benchmark, used by 87 of the Fortune 100. Complete guide: Nexus AI architecture, TAP, SPF/DKIM/DMARC configuration, the 2024 EchoSpoofing incident and a comparison with Mimecast, Microsoft Defender and Abnormal Security.
Mimecast Secure Email Gateway: how it works, DNS setup, and alternatives
Mimecast is a cloud email gateway (SEG) that intercepts all traffic via MX redirection. Full guide: architecture, SPF/DKIM/DMARC setup, Proofpoint/Abnormal Security comparison, and DNS audit.
March 2026
Test Email Deliverability: The Complete Guide Before Sending
One in five emails never reaches the inbox. This guide shows you how to test your email deliverability before sending and fix every issue.
DMARCbis: the complete guide to understanding and migrating to the new DMARC standard
DMARCbis replaces RFC 7489, drops the PSL in favor of the DNS Tree Walk, adds three tags and splits reporting into three documents. This guide covers everything: how it works, migration, compliance.
February 2026
How to spot a phishing email in 2026
91% of cyberattacks start with an email. Learn how to spot the warning signs, verify a suspicious link, and protect your inbox with the right protocols.
Why Your Emails End Up in Spam: The Complete Diagnostic Guide
Are your emails consistently landing in spam? This guide analyzes the 5 main causes and gives you a concrete action plan to restore optimal deliverability.
January 2026
.brand TLD: why major brands create their own domain extension
From .dvag (10,562 domains) to .ferrari, .zara, and .google: discover why 494 global companies have invested in their own .brand TLD.
December 2025
Connect CaptainDNS to ChatGPT via MCP: 3 widgets for DNS audits and deliverability
Add the CaptainDNS MCP server to ChatGPT and use 3 widgets to troubleshoot DMARC/DNS and analyze email headers without leaving the conversation.
BIMI, VMC, CMC: compatibility and DNS prerequisites (Gmail, Yahoo, Apple Mail)
Putting your logo in the inbox: what you actually need to configure in DNS for BIMI, and how to choose between VMC and CMC.
Gmail/Yahoo one-click unsubscribe: what RFC 8058 changes and how to implement it
Gmail and Yahoo require a one-click unsubscribe via RFC 8058-compliant List-Unsubscribe headers. Here's the expected format, the server-side POST, and the compliance checklist.
November 2025
BIMI logo cache: run a brand refresh and make the new logo show up everywhere
Your logo changed but inboxes still display the old one? It is not only a DNS issue: mailbox providers cache BIMI assets. Discover how the cache layers work and how to plan a smooth BIMI migration.
Gmail tightens its sending rules: what's changing for senders starting November 2025
Starting in November 2025, Google enforces new security requirements for bulk senders: full SPF/DKIM/DMARC authentication, TLS encryption and strict unsubscribe management.
October 2025
AI-Powered Phishing: What the MDDR 2025 Reveals
AI-automated phishing emails average a click-through rate of roughly 54%. At scale, automation can make these campaigns up to ×50 more profitable. Both figures come from the Microsoft Digital Defense Report 2025 (MDDR 2025).