Blog

Practical insights on email deliverability, security, and infrastructure — based on real findings from working with 450+ organizations.

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Global Cyber Alliance DMARC training slide titled "DMARC DNS TXT Record", showing basic and complex DMARC record examples that both set rua=mailto:dmarc@gca-emailauth.org as the aggregate reporting address

Email Security

The Abandoned Endpoint: How an Expired DMARC Reporting Domain Exposed 86 Domains Across 20+ Organizations

August 11, 2026

I re-registered an expired DMARC reporting domain for about $10. For eight months, the authentication reports for 86 domains across more than 20 organizations arrived in my inbox. Here is what was exposed, why nobody noticed, and the two-minute check that finds it in your own DNS.

The registrar control panel for gca-emailauth.org, the expired DMARC reporting endpoint re-registered during this research, with its DNS settings open.

Email Security

I Bought an Expired Domain for $10, and a NYSE Company's Customer Map Started Arriving Every Morning

August 11, 2026

For eight months, one $10 domain registration collected the DMARC reports of 86 organizations, a NYSE manufacturer, a state university, two county governments, a school district, and an education agency. Here is what those reports expose, why sophisticated monitoring never noticed, and the two-minute check that closes it.

A daily APRF report from Comcast open in Gmail, showing the sender, the collection mailbox it was delivered to, and the subject line encoding signing domain and selector.

Email Deliverability

We Deployed APRF Across 100+ Domains: What the Reports Show

July 29, 2026

Comcast is sending live APRF reports. After 150 of them, the most useful finding is that the numbers inside are not message counts.

Email Security

A Lapsed Dover-Era Domain Is Still Leaking Email and DMARC Reports for JE Pistons and Wiseco

July 21, 2026

A lapsed corporate domain kept collecting live mail and DMARC telemetry for JE Pistons and Wiseco, two brands still in business. Here's exactly what leaked, and how to find the same gap in your own domain estate.

Email platform stats table showing opens/delivered and unique opens/delivered ratios far exceeding 100 percent across several days, including 1650% unique opens on one date

Email Security

What 1,000% Open Rates Taught Us About Detecting Hijacked Email Accounts

July 13, 2026

Your best-performing message of the month might be the clearest signal that someone else has your sending credentials. Here's how DKIM replay attacks work and why your open-rate dashboard already contains the detection.

Raw Gmail message headers showing list-unsubscribe and list-unsubscribe-post in the ARC-Message-Signature h= tag

Email Deliverability

The List-Unsubscribe Header: Why SendGrid Adding It Isn't Enough

June 29, 2026

SendGrid adds the List-Unsubscribe header for you, so the box gets checked and most people stop looking. But the header being written and the button being shown are two different things, and only one of them is up to Gmail.

Cloudflare DNS dashboard showing four parked domain protection records on sh.live: null MX, DMARC p=reject, wildcard DKIM revocation, and SPF -all

Email Security

How to Secure Parked Domains: The DNS Records Almost Nobody Adds

June 12, 2026

Four DNS records — null MX, SPF -all, DMARC p=reject, and wildcard DKIM revocation — turn every parked domain from impersonation infrastructure into a dead end.

DNS query output for _dmarc.sh.consulting showing v=DMARC1; p=reject; np=reject; rua=mailto:sh@dmarc.sh; ruf=mailto:sh@dmarc.sh; fo=1:d:s with the new np=reject tag highlighted in purple. SH Consulting's production DMARC record deployed against the new RFC

Email Security

The New DMARC Standard (RFC 9989): What Changed and What to Update

May 27, 2026

DMARC just received its first major update since 2015. RFC 9989 replaces RFC 7489 with a new tag for non-existent subdomains, a DNS-based replacement for the Public Suffix List, and the removal of pct, rf, and ri. Most existing records still work — but one change is worth making this week.

Binary breakdown of 135.84.68.123/28 showing the /28 network's base IP is 135.84.68.112, not 135.84.68.123, illustrating why the host address is invalid as a CIDR network specifier in SPF records

Email Security

SPF permerror Under p=reject: The CIDR Bug Your Validator Won't Catch

May 20, 2026

Your SPF validates green. Your DMARC is at p=reject. And legitimate mail is bouncing inconsistently across receivers. The bug isn't in your DMARC — it's a single digit in your SPF that every public validator says is fine.

Cloudflare DNS management dashboard showing a CNAME record and a TXT record both at _dmarc, with the TXT containing v=DMARC1; p=none and the CNAME pointing to dmarc-r.dmarc.cc

Email Security

How Cloudflare DNS Silently Breaks DMARC When ESPs Auto-Deploy Through Entri

May 5, 2026

A specific combination of Cloudflare DNS, a CNAME-based DMARC delegation, and an ESP onboarding through Entri can silently bypass p=reject — leaving domains spoofable while every dashboard reports green. Here's how the conflict happens, how to detect it with dig, and how to fix it.

Terminal output of a dig query showing a production DMARC record with rua=mailto pointing to example@third-party-example.com, the unregistered domain referenced in Cloudflare's documentation.

Email Security

I Registered the Domain in Cloudflare's DMARC Documentation. Eight Other Sites Copied It.

April 30, 2026

Cloudflare's DMARC documentation instructed administrators to send aggregate reports to a domain that had never been registered. We registered it — and within days, real DMARC reports started arriving from 22 production domains. This isn't just a Cloudflare problem.

SURBL blacklist explained — domain listing and removal guide

Email Deliverability

SURBL Blacklist Explained: Why Your Domain Is Listed and How to Get Removed

April 28, 2026

Most blocklists target sending IPs. SURBL targets the URLs inside your email — and that changes everything about how you get listed and how you get off. Here's why domains land on SURBL, what compromised SendGrid API keys and cold outreach campaigns have in common, and the four-step remediation path that gets the listing removed.