Email Security articles and guides from the kant.au team.
You publish a DMARC record once, mail keeps flowing, and you assume the job is done. A published record doesn’t mean anyone is actually blocked from spoofing your domain. That depends entirely on the DMARC policy inside it, and almost nobody goes back to check. We picked 100 well-known, mostly mid-to-large SaaS, developer-tool, and cybersecurity […]
Read more →
The DMARC spec your clients’ records were written against stopped being current in May 2026. RFC 9989, known as DMARCbis, officially replaced RFC 7489, the document that has defined DMARC since 2015. If you set up a client’s DMARC record any time in the last decade, it was written against the old spec. That doesn’t […]
Read more →
A client emails to say their invoices have been going to spam for two weeks. You check the domain. The SPF record looks fine on the surface, but a third-party tool was added three months ago and nobody updated the policy to include it. Every email sent from that tool has been failing authentication checks, […]
Read more →