Blog

Practical insights on email deliverability, security, and infrastructure — based on real findings from working with 450+ organizations.

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Cloudflare DNS dashboard showing four parked domain protection records on sh.live: null MX, DMARC p=reject, wildcard DKIM revocation, and SPF -all

Email Security

How to Secure Parked Domains: The DNS Records Almost Nobody Adds

June 12, 2026

Four DNS records — null MX, SPF -all, DMARC p=reject, and wildcard DKIM revocation — turn every parked domain from impersonation infrastructure into a dead end.

DNS query output for _dmarc.sh.consulting showing v=DMARC1; p=reject; np=reject; rua=mailto:sh@dmarc.sh; ruf=mailto:sh@dmarc.sh; fo=1:d:s with the new np=reject tag highlighted in purple. SH Consulting's production DMARC record deployed against the new RFC

Email Security

The New DMARC Standard (RFC 9989): What Changed and What to Update

May 27, 2026

DMARC just received its first major update since 2015. RFC 9989 replaces RFC 7489 with a new tag for non-existent subdomains, a DNS-based replacement for the Public Suffix List, and the removal of pct, rf, and ri. Most existing records still work — but one change is worth making this week.

Binary breakdown of 135.84.68.123/28 showing the /28 network's base IP is 135.84.68.112, not 135.84.68.123, illustrating why the host address is invalid as a CIDR network specifier in SPF records

Email Security

SPF permerror Under p=reject: The CIDR Bug Your Validator Won't Catch

May 20, 2026

Your SPF validates green. Your DMARC is at p=reject. And legitimate mail is bouncing inconsistently across receivers. The bug isn't in your DMARC — it's a single digit in your SPF that every public validator says is fine.

Cloudflare DNS management dashboard showing a CNAME record and a TXT record both at _dmarc, with the TXT containing v=DMARC1; p=none and the CNAME pointing to dmarc-r.dmarc.cc

Email Security

How Cloudflare DNS Silently Breaks DMARC When ESPs Auto-Deploy Through Entri

May 5, 2026

A specific combination of Cloudflare DNS, a CNAME-based DMARC delegation, and an ESP onboarding through Entri can silently bypass p=reject — leaving domains spoofable while every dashboard reports green. Here's how the conflict happens, how to detect it with dig, and how to fix it.

Terminal output of a dig query showing a production DMARC record with rua=mailto pointing to example@third-party-example.com, the unregistered domain referenced in Cloudflare's documentation.

Email Security

I Registered the Domain in Cloudflare's DMARC Documentation. Eight Other Sites Copied It.

April 30, 2026

Cloudflare's DMARC documentation instructed administrators to send aggregate reports to a domain that had never been registered. We registered it — and within days, real DMARC reports started arriving from 22 production domains. This isn't just a Cloudflare problem.

SURBL blacklist explained — domain listing and removal guide

Email Deliverability

SURBL Blacklist Explained: Why Your Domain Is Listed and How to Get Removed

April 28, 2026

Most blocklists target sending IPs. SURBL targets the URLs inside your email — and that changes everything about how you get listed and how you get off. Here's why domains land on SURBL, what compromised SendGrid API keys and cold outreach campaigns have in common, and the four-step remediation path that gets the listing removed.

Email Security

When ESP Setup Instructions Break Your DMARC Protection

April 16, 2026

Moving to DMARC p=reject doesn't guarantee spoofing protection if your SPF record authorizes an ESP's shared IP pool. MailerLite prescribes exactly this configuration in their setup UI — and the exposure applies to every ESP that requires a root-domain include.

Email Security

Hazy Hawk Hijacked Subdomains at MIT, Harvard, Stanford, and 30+ Other US Universities

April 15, 2026

In early April 2026, I discovered attackers had hijacked subdomains at 34 major US universities — MIT, Harvard, Stanford, UC Berkeley, Columbia, and more — using them to serve spam that Google was actively indexing under trusted .edu domains. Infoblox confirmed the campaign was the work of Hazy Hawk.

Email Deliverability

SendGrid Professional Services vs. Independent Email Deliverability Consulting: How to Choose

April 12, 2026

How to choose between SendGrid Professional Services and an independent deliverability consultant — and when scope should make the decision for you.

Email Security

Cloudflare's DMARC Documentation Exposed an Unregistered Domain And Dozens of Organizations Paid the Price

April 9, 2026

How an unregistered domain in Cloudflare's DMARC documentation silently exposed infrastructure data from dozens of organizations.

Email Security

FinTech AccessPay Exposed Internal Email Infrastructure Data for Years

April 8, 2026

A misconfigured DMARC record sent sensitive email infrastructure data to an unregistered domain, creating a long-term exposure risk.

Email Security

Coordinated Subdomain Takeover Campaign Targeting US Universities

April 7, 2026

Attackers are hijacking abandoned .edu subdomains via orphaned CNAME records, serving spam under trusted university domains and exploiting SEO authority.