Blog

SMTP MTA Strict Transport Security (MTA-STS), defined in RFC 8461, upgrades opportunistic STARTTLS to mandatory encryption by establishing a cryptographic policy served over HTTPS. Backed by Google, Microsoft, and Yahoo, MTA-STS eliminates man-in-the-middle STRIPTLS downgrade att…

Authenticated Received Chain (ARC), standardized under RFC 8617, preserves email authentication results across forwarding intermediaries, mailing lists, and security gateways that modify message content and break SPF and DKIM signatures. ARC introduces a cryptographically sealed …

STARTTLS (RFC 3207) upgrades plain text SMTP connections to encrypted TLS sockets in-band, safeguarding email transmissions against passive wiretapping. Because classic STARTTLS is opportunistic by default, it remains vulnerable to active man-in-the-middle downgrade attacks (STRI…

Brand Indicators for Message Identification (BIMI) is an email specification that displays authenticated organizational logos directly beside inbound messages in supported mail clients (Gmail, Apple Mail, Yahoo, Fastmail). Requiring strict DMARC enforcement and a cryptographicall…

DomainKeys Identified Mail (DKIM) provides end-to-end cryptographic integrity and domain attribution for email transmissions. Standardized under RFC 6376 and extended by RFC 8463, DKIM attaches a digital signature to the message header that receiving MTAs verify against a public …

Sender Policy Framework (SPF), standardized under RFC 7208, provides the foundation of email authentication by allowing domain owners to declare which IP addresses are authorized to send mail using their identity in the SMTP envelope (MAIL FROM). This guide covers SPF record synt…

Domain-based Message Authentication, Reporting, and Conformance (DMARC) is the policy and reporting architecture that bridges SPF and DKIM with domain alignment checks. DMARC empowers domain owners to instruct mailbox providers (such as Google, Microsoft, and Yahoo) on how to han…