Internet Tools

SPF, DKIM, and DMARC prove you're legitimate — but engagement rates, complaint rates, list hygiene, and domain age determine whether you land in inbox or spam. Here's the deliverability signals major providers actually use, IP warming schedules, and the 2024 Google/Yahoo requirements in practice.

Learn how DKIM works, what a DKIM DNS record contains, how to find your selector, and how to use a free DKIM checker to verify your email signing key is correctly published.

DMARC requires alignment, not just SPF and DKIM passing individually — SendGrid's default DKIM signature (d=sendgrid.net) fails alignment with your From header even though the signature itself validates correctly. Here's the precise difference between relaxed and strict alignment, how custom DKIM signing via CNAME delegation fixes multi-platform sending, the sp= subdomain policy tag for staged rollout, and why third-party SPF/DKIM authorisation creates a trust relationship worth periodically auditing.

WHOIS privacy protection hides contact details — but creation date, expiry date, registrar, nameservers, and status codes remain visible and tell a detailed story. Here's how to read mass-registration signals from creation date patterns, trace common ownership through shared nameservers, interpret domain status codes (serverHold, redemptionPeriod, pendingDelete), and what RDAP changes about how this data is accessed.

Learn how SSL certificates work, what DV/OV/EV and wildcard certificates mean, how to read SSL checker results, and how to catch certificate expiry before users see browser security warnings.

A PTR record saying "mail.example.com" for an IP doesn't prove that IP is operated by example.com — it proves whoever controls the reverse DNS zone for that IP chose to set that name. Here's the fundamental asymmetry between forward and reverse DNS, why "forward-confirmed reverse DNS" (FCrDNS) provides substantially more confidence than PTR alone, how Google uses FCrDNS to verify Googlebot traffic, and when PTR records are legitimately useful for logging even without cryptographic verification.

SPF validates the envelope sender — the address used during SMTP delivery — not the "From" header address that recipients actually see. This means SPF can pass for an email that appears to be from [email protected], because the attacker set a legitimate envelope sender from their own domain. Here's why DMARC's alignment requirement exists to close this gap, what -all vs ~all vs +all actually mean, and the SPF flattening trade-off.

A nameserver named ns1.example.com creates a circular dependency — to find its IP, you'd normally ask example.com's nameservers, which it is one of. Glue records solve this by storing nameserver IPs directly in the parent zone. Here's how delegation chains work, when glue is required vs unnecessary, and why stale glue at the registrar causes confusing migration failures.

AWS VPCs, GCP VPCs, and Azure VNets follow the same three-tier pattern — public subnets for internet-facing resources, private subnets for application and data tiers. Here's the terminology across providers, NAT Gateway mechanics, VPC peering, and the four most common cloud network design mistakes.

Certificate Transparency logs record every TLS certificate ever issued and became mandatory for Chrome in 2018 — meaning fraudulent certificate issuance is now a publicly auditable event rather than an undetectable attack. Here's how Merkle tree audit proofs make CT logs tamper-evident, what domain owners find when searching their own CT history (unexpected subdomains, unauthorised CAs), and how real-time CT monitoring via Certstream gives organisations a window to act on phishing infrastructure before it launches.