Domain & Email Hygiene

Guides to fixing common domain and email security gaps like SPF, DKIM, DMARC, and DNSSEC — the checks you can fix yourself through your DNS provider.

• Fixing SPF Record Issues

  What it does SPF (Sender Policy Framework) lists which mail servers are allowed to send email on behalf of your domain. Without it, anyone...

• Fixing DKIM Record Issues

  What it does DKIM (DomainKeys Identified Mail) lets receiving mail servers verify that a message wasn't altered in transit, by checking a...

• Fixing DMARC Record Issues

  What it does DMARC (Domain-based Message Authentication, Reporting & Conformance) tells receiving mail servers what to do with messages that...

• Enabling DNSSEC for Your Domain

  What it does DNSSEC (Domain Name System Security Extensions) digitally signs your DNS records so that resolvers can verify they haven't been...

• Setting Up DANE for Email

  What it does DANE (DNS-Based Authentication of Named Entities) lets you publish a record (TLSA) in DNS that tells other mail servers exactly...

• Understanding Provider-Controlled Security Checks

  Some scan checks — TLS configuration, certificates, IPv6, RPKI, and post-quantum cryptography — live on your mail or hosting provider's...

• Fixing SPF in Cloudflare for Google Workspace

  The exact SPF record to add in Cloudflare when your mail runs on Google Workspace.

• Fixing SPF in Cloudflare for Microsoft 365

  The exact SPF record to add in Cloudflare when your mail runs on Microsoft 365.

• Fixing SPF in GoDaddy for Google Workspace

  The exact SPF record to add in GoDaddy when your mail runs on Google Workspace.

• Fixing SPF in GoDaddy for Microsoft 365

  The exact SPF record to add in GoDaddy when your mail runs on Microsoft 365.

• Fixing SPF in AWS Route 53 for Google Workspace

  The exact SPF record to add in AWS Route 53 when your mail runs on Google Workspace.

• Fixing SPF in AWS Route 53 for Microsoft 365

  The exact SPF record to add in AWS Route 53 when your mail runs on Microsoft 365.

• Fixing SPF in SiteGround for Google Workspace

  The exact SPF record to add in SiteGround when your mail runs on Google Workspace.

• Fixing SPF in SiteGround for Microsoft 365

  The exact SPF record to add in SiteGround when your mail runs on Microsoft 365.

• Fixing DKIM in Cloudflare for Google Workspace

  How to generate a DKIM key in Google Workspace and publish it as a TXT record in Cloudflare.

• Fixing DKIM in Cloudflare for Microsoft 365

  How to publish the two CNAME records Microsoft 365 needs for DKIM in Cloudflare.

• Fixing DKIM in GoDaddy for Google Workspace

  How to generate a DKIM key in Google Workspace and publish it as a TXT record in GoDaddy.

• Fixing DKIM in GoDaddy for Microsoft 365

  How to publish the two CNAME records Microsoft 365 needs for DKIM in GoDaddy.

• Fixing DKIM in AWS Route 53 for Google Workspace

  How to generate a DKIM key in Google Workspace and publish it as a TXT record in AWS Route 53.

• Fixing DKIM in AWS Route 53 for Microsoft 365

  How to publish the two CNAME records Microsoft 365 needs for DKIM in AWS Route 53.

• Fixing DKIM in SiteGround for Google Workspace

  How to generate a DKIM key in Google Workspace and publish it as a TXT record in SiteGround.

• Fixing DKIM in SiteGround for Microsoft 365

  How to publish the two CNAME records Microsoft 365 needs for DKIM in SiteGround.

• Fixing DMARC in Cloudflare

  How to add or update your DMARC TXT record in Cloudflare's DNS dashboard.

• Fixing DMARC in GoDaddy

  How to add or update your DMARC TXT record in GoDaddy's DNS management console.

• Fixing DMARC in AWS Route 53

  How to add or update your DMARC TXT record in AWS Route 53's hosted zone console.

• Fixing DMARC in SiteGround

  How to add or update your DMARC TXT record in SiteGround's DNS Zone Editor.

• Fixing DNSSEC in Cloudflare

  How to enable DNSSEC for your domain in Cloudflare, including the DS record step at your registrar if it's not also Cloudflare.

• Fixing DNSSEC in GoDaddy

  How to enable DNSSEC for your domain in GoDaddy, and when it isn't available for your specific TLD.

• Fixing DNSSEC in AWS Route 53

  How to enable DNSSEC signing for your hosted zone in AWS Route 53, including the KMS key and DS record steps.

• Fixing DNSSEC in SiteGround

  Why SiteGround doesn't support DNSSEC, and the practical path if your domain needs it.

• Fixing DANE in Cloudflare for Google Workspace

  Why DANE isn't achievable for a Google Workspace domain, and the mechanism Google actually documents instead (MTA-STS).

• Fixing DANE in Cloudflare for Microsoft 365

  How to enable inbound SMTP DANE for a Microsoft 365 domain hosted on Cloudflare — a managed flow, not a manual TLSA record.

• Fixing DANE in GoDaddy for Google Workspace

  Why DANE isn't achievable for a Google Workspace domain on GoDaddy, and the mechanism Google actually documents instead (MTA-STS).

• Fixing DANE in GoDaddy for Microsoft 365

  How to enable inbound SMTP DANE for a Microsoft 365 domain hosted on GoDaddy — a managed flow, not a manual TLSA record.

• Fixing DANE in AWS Route 53 for Google Workspace

  Why DANE isn't achievable for a Google Workspace domain, and the mechanism Google actually documents instead (MTA-STS).

• Fixing DANE in AWS Route 53 for Microsoft 365

  How to enable inbound SMTP DANE for a Microsoft 365 domain hosted on Route 53 — a managed flow, not a manual TLSA record.

• Fixing DANE in SiteGround for Google Workspace

  Why DANE isn't achievable for a Google Workspace domain on SiteGround, and the mechanism Google actually documents instead (MTA-STS).

• Fixing DANE in SiteGround for Microsoft 365

  Why DANE isn't achievable for a Microsoft 365 domain on SiteGround, and the practical path if it matters to you.

• Fixing SPF in Vodien for Google Workspace

  The exact SPF record to add in Vodien's DNS editor when your mail runs on Google Workspace.

• Fixing SPF in Vodien for Microsoft 365

  The exact SPF record to add in Vodien's DNS editor when your mail runs on Microsoft 365.

• Fixing DKIM in Vodien for Google Workspace

  How to generate a DKIM key in Google Workspace and publish it as a TXT record in Vodien.

• Fixing DKIM in Vodien for Microsoft 365

  How to publish the two CNAME records Microsoft 365 needs for DKIM in Vodien.

• Fixing DMARC in Vodien

  How to add or update your DMARC TXT record in Vodien's DNS editor.

• Fixing DNSSEC in Vodien

  Vodien's nameservers don't sign DNSSEC themselves — here's the external-nameserver-plus-support-ticket path that actually works.

• Fixing DANE in Vodien for Google Workspace

  Why DANE isn't achievable for a Google Workspace domain on Vodien, and the mechanism Google actually documents instead (MTA-STS).

• Fixing DANE in Vodien for Microsoft 365

  How inbound SMTP DANE could work for a Microsoft 365 domain on Vodien, and the DNSSEC prerequisite that makes it a multi-step process.