Defaults.Exposed — September 2026 census (v10)

Contact form emails going to spam

Mon, 07 Sep 2026 12:00:00 GMT

Your web server sends form mail unauthenticated, with no SPF authorisation and no DKIM signature. Route it through authenticated SMTP and the spam stops.

DKIM broke after switching email tools

Mon, 07 Sep 2026 12:00:00 GMT

Your DNS panel appended your own zone to the new tool's CNAME target, or the old tool's selectors went before its mail drained. Check both with dig.

DKIM no key for signature means the selector is missing from DNS

Mon, 07 Sep 2026 12:00:00 GMT

No key for signature means the receiver queried s._domainkey.yourdomain and found nothing. Read the s= tag off a real message, publish that record.

DKIM signature not valid, and how to fix it

Mon, 07 Sep 2026 12:00:00 GMT

A DKIM signature that is not valid means the key was found and the check failed. Read the header wording, then the published key, then the signer.

DMARC fails but SPF and DKIM pass, and what to fix

Mon, 07 Sep 2026 12:00:00 GMT

DMARC fails while SPF and DKIM pass because both passed on someone else's domain. Compare header.from with smtp.mailfrom and header.d, then align one leg.

Gmail 550-5.7.1 message blocked, and how to fix it

Mon, 07 Sep 2026 12:00:00 GMT

Gmail 550-5.7.1 is a policy block. The sentence after the code names the cause: your own DMARC, missing reverse DNS on IPv6, or spam filtering.

How to set up SPF, DKIM and DMARC on a new domain

Mon, 07 Sep 2026 12:00:00 GMT

A new domain needs one SPF record naming your provider, custom-domain DKIM signing, and DMARC p=none with a rua address. About 20 minutes of DNS work.

Newsletter emails failing DMARC? Authenticate your domain

Mon, 07 Sep 2026 12:00:00 GMT

Your platform signs as itself, so nothing aligns with your From domain. Turn on its custom domain authentication, add the DKIM CNAMEs, set the bounce domain.

Outlook rejecting your email, 550 5.7.515 and 5.7.509

Mon, 07 Sep 2026 12:00:00 GMT

Consumer Outlook bounces unauthenticated high-volume senders with 550 5.7.515. Exchange Online returns 5.7.509 when your own DMARC policy says reject.

Someone is sending emails from my domain, what to do

Mon, 07 Sep 2026 12:00:00 GMT

Read the From address character by character first. An exact-domain forgery is a DNS fix, a lookalike is a takedown, and they share no steps.

SPF broke after switching email provider

Mon, 07 Sep 2026 12:00:00 GMT

The new provider's record went in next to the old one. Two v=spf1 records are a PermError, so merge to one, delete the rest, verify at your nameservers.

Our CSP adoption number was measuring the wrong thing, and here is the corrected one

Mon, 07 Sep 2026 12:00:00 GMT

10.01% of domains that sent headers carry a CSP header; 2.49% carry one that constrains script. Cite the second, with its denominator.

The DMARC records sitting at p=none that never asked for a report

Mon, 07 Sep 2026 12:00:00 GMT

rua= is the DMARC tag that names where aggregate reports go. A p=none record without it asks for nothing, so nothing arrives. Add it, then read a fortnight.

Most Content-Security-Policy headers are not content security policies

Mon, 07 Sep 2026 12:00:00 GMT

A CSP without default-src or script-src constrains no script; only 24.86% of the CSP headers in the September 2026 census have either.

63% of the internet's failing domains are within twenty points of a pass

Mon, 07 Sep 2026 12:00:00 GMT

An F is a range: 63.18% of the domains graded F score 40 to 59, within twenty points of the 60 mark where F ends, with records unfinished rather than absent.

What is a google-site-verification TXT record, and how many domains publish one?

Mon, 07 Sep 2026 12:00:00 GMT

A google-site-verification TXT record is an inert ownership proof for a Google property. 29,145,803 domains carry one, and it is safe to leave in place.

Only 2.79% of failing domains score under ten

Mon, 07 Sep 2026 12:00:00 GMT

Only 2.79% of the 234,955,475 F-graded domains score under ten; 63.18% sit at 40 to 59, live sites a few DNS records short of a pass.

How many TXT verification records does one domain carry?

Mon, 07 Sep 2026 12:00:00 GMT

Most domains with a verification token in DNS carry exactly one; a small band carries three or more, and that's where unaccounted-for records live.

How many domains carry a Microsoft 365 tenant marker, and how many route mail there today?

Mon, 07 Sep 2026 12:00:00 GMT

8,218,984 domains carry an MS= tenant marker; 14,697,578 of 173,425,856 domains with MX route mail to Microsoft 365. Two signals, two denominators.

How many domains have declared themselves to OpenAI?

Mon, 07 Sep 2026 12:00:00 GMT

230,938 domains publish an openai-domain-verification TXT record at the apex, of the 167,692,006 with any apex TXT record in the September 2026 census.

What the web announces about itself: server and x-powered-by headers

Mon, 07 Sep 2026 12:00:00 GMT

The most common Server header is cloudflare, 44,468,182 of 214,006,060 header-sending domains in the September 2026 census, and one config line hides yours.

How many domains show a Stripe verification record?

Mon, 07 Sep 2026 12:00:00 GMT

92,560 domains publish a stripe-verification TXT record at the apex: 0.06% of the 167,692,006 domains with an apex TXT record, seen in 381 TLDs.

83 million domains are three records away from a C

Mon, 07 Sep 2026 12:00:00 GMT

Do the DMARC policy first, then the SPF fail qualifier, then HSTS. Three records are the shortest honest route from the top band of F to a C.

unsafe-inline, and frame-ancestors versus X-Frame-Options: what the web sends

Mon, 07 Sep 2026 12:00:00 GMT

unsafe-inline silences CSP errors by switching off the script guard; most counted policies only control framing. A nonce or hash restores the guard.

The verification-token census: every third-party token in the internet's DNS, ranked

Mon, 07 Sep 2026 12:00:00 GMT

The ranked table of DNS verification tokens: 44,285,266 domains carry one, out of 167,692,006 with any apex TXT record, over 1285 TLD partitions.

Zoho, Meta, Atlassian, Canva, Klaviyo: the long tail of domain verification, counted

Mon, 07 Sep 2026 12:00:00 GMT

The exact apex TXT verification strings 22 services publish, counted over 167,692,006 domains with a TXT record, with the vendors that use two strings named.

How to add a CAA record in Cloudflare

Mon, 07 Sep 2026 12:00:00 GMT

In Cloudflare DNS, add a CAA record with name @, flags 0, tag Only allow specific hostnames, and your CA's domain, such as letsencrypt.org.

GoDaddy CAA record, step by step

Mon, 07 Sep 2026 12:00:00 GMT

In GoDaddy DNS add a record of type CAA with name @, flags 0, tag issue and your certificate authority as the value. One record per authority.

Namecheap CAA record, step by step

Mon, 07 Sep 2026 12:00:00 GMT

In Namecheap Advanced DNS, add a CAA Record with host @, flag 0, tag issue, and your certificate authority's domain as the value.

Route 53 CAA record setup, step by step

Mon, 07 Sep 2026 12:00:00 GMT

In Route 53, create a record with an empty name, type CAA, and value 0 issue "letsencrypt.org". List every authority you use, including amazon.com for ACM.

How to set up DKIM on Beget with a subzone

Mon, 07 Sep 2026 12:00:00 GMT

In Beget, create a subzone named for your DKIM selector first, then add the TXT or CNAME record your email provider gave you inside it.

How to set up DKIM on Bluehost

Mon, 07 Sep 2026 12:00:00 GMT

Your email provider generates the DKIM key; you publish it in Bluehost DNS as a TXT or CNAME record with only the selector in the Host Record field.

How to set up DKIM on Cloudflare

Mon, 07 Sep 2026 12:00:00 GMT

Your mail provider generates the DKIM key; Cloudflare publishes it. Add a TXT record named for the selector alone, and leave your domain off the name.

How to set up DKIM on GoDaddy DNS

Mon, 07 Sep 2026 12:00:00 GMT

Your mail provider generates the DKIM key; GoDaddy publishes it. Put only the selector in the Name field, save, then hit verify at the provider.

Google Workspace DKIM setup and the record to publish

Mon, 07 Sep 2026 12:00:00 GMT

Google generates the key in Admin console under Gmail, Authenticate email. Publish it as a TXT record at google._domainkey, then click Start authentication.

How to set up DKIM on Hostinger in hPanel

Mon, 07 Sep 2026 12:00:00 GMT

Your mail provider generates the DKIM key and selector, you publish it in the hPanel DNS zone as TXT, or as two CNAMEs for Microsoft 365.

How to set up DKIM on IONOS DNS

Mon, 07 Sep 2026 12:00:00 GMT

Your mail provider generates the DKIM key and selector, and you publish it in IONOS DNS as a TXT or CNAME record with the selector alone in Host name.

How to set up DKIM on Microsoft 365

Mon, 07 Sep 2026 12:00:00 GMT

Publish Microsoft's two CNAME records, selector1._domainkey and selector2._domainkey, in your DNS host, then turn DKIM signing on at security.microsoft.com.

DKIM on Porkbun, the record and where it goes

Mon, 07 Sep 2026 12:00:00 GMT

Your mail provider generates the DKIM key. You publish it in Porkbun's DNS editor: selector alone in Host, the whole value in Answer, no added quotes.

How to set up DKIM on Reg.ru

Mon, 07 Sep 2026 12:00:00 GMT

Your email provider generates the DKIM key and selector; you add it as a TXT or CNAME record in the Reg.ru zone editor, using the selector alone as the host.

How to add a DKIM record in AWS Route 53

Mon, 07 Sep 2026 12:00:00 GMT

In your Route 53 hosted zone, enter the selector alone as the record name, wrap a TXT key in double quotes, and paste a CNAME target with none.

Squarespace DKIM record, step by step

Mon, 07 Sep 2026 12:00:00 GMT

Your email provider generates the DKIM key. You publish it in Squarespace DNS as a TXT record with only the selector in Host, such as google._domainkey.

Timeweb DKIM setup in the DNS editor

Mon, 07 Sep 2026 12:00:00 GMT

Your mail provider makes the DKIM key and selector. You publish it in Timeweb's DNS editor, selector only in the host field, domain appended for you.

How to add a DKIM record in Wix DNS

Mon, 07 Sep 2026 12:00:00 GMT

Your mail provider generates the DKIM key. Wix publishes it: add a TXT record with the selector alone in Host Name and the whole value in Text.

Beget DMARC record setup, step by step

Mon, 07 Sep 2026 12:00:00 GMT

In Beget, create a subzone called _dmarc, then add a TXT record holding v=DMARC1; p=none; rua=mailto:you@yourdomain.com inside it.

How to add a DMARC record in Bluehost

Mon, 07 Sep 2026 12:00:00 GMT

In Bluehost DNS add a TXT record named _dmarc with value v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then raise the policy once reports look clean.

How to set up DMARC on Cloudflare

Mon, 07 Sep 2026 12:00:00 GMT

In Cloudflare DNS, add a TXT record named _dmarc holding v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then raise the policy once the reports look clean.

How to set up DMARC on GoDaddy

Mon, 07 Sep 2026 12:00:00 GMT

Add one TXT record at the host name _dmarc in GoDaddy DNS, starting v=DMARC1; p=none; rua=mailto:, then check it before you tighten the policy.

How to set up DMARC on Google Workspace

Mon, 07 Sep 2026 12:00:00 GMT

DMARC for Google Workspace is one TXT record at _dmarc in your DNS host. Google Admin has no DMARC switch. Start at p=none with a rua you read.

How to add a DMARC record in Hostinger hPanel

Mon, 07 Sep 2026 12:00:00 GMT

In hPanel open your domain's DNS zone, add a TXT record named _dmarc with the value v=DMARC1; p=none; rua=mailto:you@yourdomain.com, leave TTL default.

How to set up DMARC on IONOS

Mon, 07 Sep 2026 12:00:00 GMT

In IONOS, open Domains & SSL, then DNS, and add a TXT record with host name _dmarc and value v=DMARC1; p=none; rua=mailto:you@yourdomain.com.

How to set up DMARC on Microsoft 365

Mon, 07 Sep 2026 12:00:00 GMT

DMARC on Microsoft 365 is a TXT record named _dmarc, added wherever your DNS lives. Start with v=DMARC1; p=none; rua=mailto:you@yourdomain.com.

How to add a DMARC record in Namecheap

Mon, 07 Sep 2026 12:00:00 GMT

In Namecheap Advanced DNS add a TXT record, host _dmarc, value v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then ramp the policy.

DMARC on Porkbun, from p=none to enforcing

Mon, 07 Sep 2026 12:00:00 GMT

Add a TXT record in Porkbun with Host _dmarc and Answer v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then raise the policy once reports look clean.

Reg.ru DMARC record, add it and verify it

Mon, 07 Sep 2026 12:00:00 GMT

In the Reg.ru personal account, add a TXT record with subdomain _dmarc holding v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then confirm it resolves.

How to set up DMARC on AWS Route 53

Mon, 07 Sep 2026 12:00:00 GMT

In Route 53, create a TXT record named _dmarc with the value in double quotes: "v=DMARC1; p=none; rua=mailto:you@yourdomain.com", then raise the policy.

How to set up DMARC on Squarespace

Mon, 07 Sep 2026 12:00:00 GMT

In Squarespace DNS add a TXT record with host _dmarc and value v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then check reports before enforcing.

How to set up DMARC on Timeweb

Mon, 07 Sep 2026 12:00:00 GMT

Add a TXT record named _dmarc in Timeweb's DNS editor with the value v=DMARC1; p=none; rua=mailto:you@yourdomain.com, then check for a duplicate.

How to add a DMARC record in Wix DNS

Mon, 07 Sep 2026 12:00:00 GMT

In Wix DNS add a TXT record, host name _dmarc, value v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com, then read the reports before you tighten it.

How to enable DNSSEC on Cloudflare

Mon, 07 Sep 2026 12:00:00 GMT

Turn on DNSSEC in Cloudflare under DNS then Settings, then lodge the DS record it shows at your registrar. It isn't live until both halves are done.

How to enable DNSSEC on GoDaddy safely

Mon, 07 Sep 2026 12:00:00 GMT

Flip GoDaddy's DNSSEC toggle when GoDaddy also hosts your DNS. If your DNS lives elsewhere, sign there first and paste the DS record into GoDaddy.

How to enable DNSSEC on Namecheap

Mon, 07 Sep 2026 12:00:00 GMT

Turn DNSSEC on in Namecheap's Advanced DNS tab. On Namecheap's own nameservers it signs and lodges the DS record for you; on Custom DNS you paste it in.

How to enable DNSSEC on Reg.ru

Mon, 07 Sep 2026 12:00:00 GMT

DNSSEC at Reg.ru needs Premium DNS and the ns1.reg.ru nameservers. Switch it on in the zone management tab and Reg.ru lodges the keys for you.

Route 53 DNSSEC setup with a KMS key and DS record

Mon, 07 Sep 2026 12:00:00 GMT

Route 53 signs your zone with an asymmetric ECC_NIST_P256 KMS key in us-east-1, then you copy the DS record it shows to your registrar.

How to set up SPF on Beget and add a second sender

Mon, 07 Sep 2026 12:00:00 GMT

Beget publishes v=spf1 redirect=_spf.beget.com for you. To add another sender, rewrite that one TXT record in include: form and end it with ~all.

How to set up SPF on Bluehost

Mon, 07 Sep 2026 12:00:00 GMT

In Bluehost DNS edit the existing TXT record that starts v=spf1 rather than adding a second: Host Record @, value v=spf1 include:yourprovider -all.

How to add an SPF record in Cloudflare DNS

Mon, 07 Sep 2026 12:00:00 GMT

Add one TXT record in Cloudflare DNS: name @, content v=spf1 include: ~all, TTL Auto. Check Cloudflare answers your DNS first.

How to add an SPF record in GoDaddy DNS

Mon, 07 Sep 2026 12:00:00 GMT

Add one TXT record at the apex: name @, value your provider's v=spf1 string, no quotes, one SPF record only. First check GoDaddy runs your DNS.

How to set up SPF on Google Workspace

Mon, 07 Sep 2026 12:00:00 GMT

SPF for Google Workspace is one TXT record you add at your DNS host: v=spf1 include:_spf.google.com ~all. Google Admin has no SPF setting.

Hostinger SPF record, and why yours may not work

Mon, 07 Sep 2026 12:00:00 GMT

Add one TXT record at @ in Hostinger's DNS zone with your provider's SPF value, and only if your nameservers point at Hostinger. One v=spf1 record only.

How to set up SPF on IONOS DNS

Mon, 07 Sep 2026 12:00:00 GMT

In IONOS, open Domains & SSL, then DNS, and add one TXT record with Host name @ and value v=spf1 include:spf.protection.outlook.com -all.

Microsoft 365 SPF record and where to add it

Mon, 07 Sep 2026 12:00:00 GMT

Microsoft 365 needs one TXT record, v=spf1 include:spf.protection.outlook.com -all, added at your DNS host rather than in the admin centre.

How to add an SPF record on Namecheap

Mon, 07 Sep 2026 12:00:00 GMT

In Namecheap's Advanced DNS, add a TXT record with host @ and a value starting v=spf1, and keep the domain to one SPF record.

How to set up SPF on Porkbun

Mon, 07 Sep 2026 12:00:00 GMT

Add one TXT record in Porkbun's DNS Records, leave Host blank for the root, paste the SPF string with no quotes, and keep it to a single record.

How to set up SPF on Reg.ru

Mon, 07 Sep 2026 12:00:00 GMT

Add one TXT record on host @ carrying your mail provider's include value and ~all, in the Reg.ru panel that matches the domain's nameservers.

SPF record in AWS Route 53, step by step

Mon, 07 Sep 2026 12:00:00 GMT

In Route 53 create a TXT record, leave the record name empty, and type the SPF value inside double quotes. Route 53 does not add the quotes for you.

How to add an SPF record on Squarespace

Mon, 07 Sep 2026 12:00:00 GMT

Squarespace holds the SPF record but does not supply its value. Add one TXT record at host @, using the string your mailbox provider gives you.

Timeweb SPF record, how to edit it

Mon, 07 Sep 2026 12:00:00 GMT

Timeweb publishes v=spf1 include:_spf.timeweb.ru ~all for delegated domains. Edit that record to add your other senders, never add a second one.

Let's Encrypt TLS setup with Certbot

Mon, 07 Sep 2026 12:00:00 GMT

Run sudo certbot --nginx on a server you control: it issues a free Let's Encrypt certificate, installs it, forces HTTPS and renews it around day 60.

The DMARC policy mix across three editions: none, quarantine, reject

Mon, 07 Sep 2026 12:00:00 GMT

Across three 2026 editions about half of published DMARC records sat at p=none, quarantine edged up, reject edged down. A p=none record changes nothing.

HSTS and CSP presence across three editions

Mon, 07 Sep 2026 12:00:00 GMT

HSTS share of answering domains: 19.89%, 19.11%, 19.24% over July to September 2026; CSP: 7.64%, 7.93%, 8.02%. Counts rose for both, the HSTS share did not.

TLS 1.3 across three census editions: what moved and what didn't

Mon, 07 Sep 2026 12:00:00 GMT

TLS 1.3 was negotiated on 94.81%, 94.87% and 94.41% of completed handshakes across July, August and September 2026; TLS 1.2 on 5.19%, 5.13% and 5.59%.

What we will and will not compare between census editions

Mon, 07 Sep 2026 12:00:00 GMT

Two census figures are compared only when both denominators are an observed record set in the same edition; shares of all domains are not compared.

Why .nl and .fr look safer this month, and what changed in the counting

Mon, 07 Sep 2026 12:00:00 GMT

September grades .nl at 39.8% F and .fr at 48.3% F of domains carrying a grade; what moved since the last edition is the inventory counted.

BIMI needs more than a logo: the DMARC gate in front of it

Sun, 06 Sep 2026 12:00:00 GMT

Your BIMI logo won't render while DMARC says p=none. Receivers check aligned DKIM, then an enforcing DMARC policy, and only then read the BIMI record.

Can someone send email as your domain right now?

Sun, 06 Sep 2026 12:00:00 GMT

Yes, unless your DMARC record says p=quarantine or p=reject. Anyone can type your domain into a From: line; that record is what makes receivers refuse it.

DKIM: signing, selectors, and the failures you will actually see

Sun, 06 Sep 2026 12:00:00 GMT

A dkim=fail line names its own cause: the body changed in transit, a signed header changed, or no key answers at the selector. Each is fixed at the sender or in DNS.

DMARC: what your record instructs a receiver to do

Sun, 06 Sep 2026 12:00:00 GMT

A DMARC record only changes anything when p= says quarantine or reject. p=none tells every receiver to deliver forged mail as normal and send you a report.

Do subdomains inherit your DMARC policy? The sp= tag nobody sets

Sun, 06 Sep 2026 12:00:00 GMT

Subdomains inherit p= unless sp= overrides it. sp=none on a p=reject record delivers forged mail from any subdomain, real or invented. Delete it or set reject.

quarentine, quarantaine, and the DMARC typos that void a record

Sun, 06 Sep 2026 12:00:00 GMT

A DMARC record whose p= says quarentine, policy or nothing at all is read as p=none or ignored outright. Find your typo in the ranked list and fix one word.

DNS and DNSSEC: what signing changes and what it breaks

Sun, 06 Sep 2026 12:00:00 GMT

DNSSEC signs your DNS answers so resolvers can reject forged ones. A broken chain makes the domain vanish; 6.9% of domains checked have a valid one.

SERVFAIL after turning on DNSSEC: signed, broken, or off

Sun, 06 Sep 2026 12:00:00 GMT

SERVFAIL after DNSSEC means the DS at your registrar doesn't match a live key, or the signatures lapsed. Pull the DS to fail open, then repair the chain.

Bounce codes: reading the rejection your receiver actually sent

Sun, 06 Sep 2026 12:00:00 GMT

Your bounce names the reason in a code like 550 5.7.26. Match the code here, open the page that fixes it, and check your domain free before the next send.

How to find the DKIM selector your provider uses

Sun, 06 Sep 2026 12:00:00 GMT

Your DKIM selector is the s= tag in the DKIM-Signature header of a message you send. Read it from a raw message, then look it up under _domainkey in DNS.

550-5.7.26 This email has been blocked because the sender is unauthenticated

Sun, 06 Sep 2026 12:00:00 GMT

Gmail sends 550-5.7.26 when a message fails both SPF and DKIM. Get either one passing for the sending domain and the block clears once DNS is visible.

DKIM "body hash did not verify"

Sun, 06 Sep 2026 12:00:00 GMT

Body hash did not verify means something rewrote your message after it was signed; find the gateway, appliance, list or relay that edits it and sign after that hop.

dkim=pass, dmarc=fail: when the signing domain belongs to your provider

Sun, 06 Sep 2026 12:00:00 GMT

DKIM passes and DMARC fails because the signature belongs to gappssmtp.com or onmicrosoft.com, not your From domain. Turn on custom-domain signing to align it.

p=none, p=quarantine, p=reject: what each one tells a receiver

Sun, 06 Sep 2026 12:00:00 GMT

p=none reports and delivers, p=quarantine sends failures to junk, p=reject refuses them. Move up in that order, one free DNS edit at a time.

DMARC quarantine/reject policy not enabled: answering the scanner finding

Sun, 06 Sep 2026 12:00:00 GMT

The warning means no DMARC record or a record at p=none. Publish v=DMARC1; p=none; rua= today, read the reports, then step to quarantine and reject.

Mail forwarding breaks SPF, and what survives it

Sun, 06 Sep 2026 12:00:00 GMT

Forwarded mail fails SPF because the forwarder sends from an IP you never listed; no record fixes that, and DKIM signed with your own domain is what survives.

Is .com safer than .net or .org? The measured answer with the denominator stated

Sun, 06 Sep 2026 12:00:00 GMT

On the September 2026 census .net carries the highest F share of the legacy three and .com the lowest; the gap measures who buys each ending.

No SPF record found: what the checker means and what to publish

Sun, 06 Sep 2026 12:00:00 GMT

No SPF record found is urgent if your domain accepts mail. Check MX, count the v=spf1 lines at the authoritative nameserver, then publish one or merge to one.

Not secure: the five things that put that label on your site

Sun, 06 Sep 2026 12:00:00 GMT

Not secure means the browser couldn't trust the page: no HTTPS, an expired, mismatched or untrusted certificate, or one http:// asset on a valid HTTPS page.

What is an SOA record

Sun, 06 Sep 2026 12:00:00 GMT

An SOA record sits at the top of your zone and names the primary nameserver, a contact and five timers. Read yours field by field.

SPF failing for a SaaS sender in Europe: alignment or the lookup cliff

Sun, 06 Sep 2026 12:00:00 GMT

When a SaaS tool fails SPF, read Return-Path against Authentication-Results: usually SPF passed on the vendor's domain and DMARC failed alignment.

SPF PermError: too many DNS lookups, and how to get back under ten

Sun, 06 Sep 2026 12:00:00 GMT

Past ten DNS lookups a receiver returns PermError and voids your whole SPF record. Count the resolved chain, prune dead includes, use subdomains.

554 5.7.9 Message not accepted for policy reasons

Sun, 06 Sep 2026 12:00:00 GMT

554 5.7.9 is Yahoo's permanent policy rejection: SPF or DKIM must pass for a domain matching your From address. Test four causes in order, then fix DNS.

Your connection is not private: which of the five certificate faults you have

Sun, 06 Sep 2026 12:00:00 GMT

The browser can't trust the site's certificate. Match the NET::ERR_ code under the warning to one of five faults, then fix that one, free, in an afternoon.

Why gappssmtp.com is signing your mail

Sun, 06 Sep 2026 12:00:00 GMT

Google signs your mail as gappssmtp.com because your own DKIM key was never published; publish the record in DNS and the signature moves to your domain.

HTTP security headers: what each one does and what the web actually sets

Sun, 06 Sep 2026 12:00:00 GMT

Each HTTP security header, the attack it stops, the share of the web that sets it, and a one-line verdict on whether the audit finding is real or pedantic.

The September 2026 edition: how 347,691,016 domains were counted

Sun, 06 Sep 2026 12:00:00 GMT

The September 2026 census scanned 347,691,016 domains: three feeds, minus 154,021,121 NXDOMAIN names and 15,109,274 wildcard phantoms, then graded.

How the grade is built: 34 checks, 100 points, and the 40 that email carries

Sun, 06 Sep 2026 12:00:00 GMT

A domain grade is a score out of 100 from 25 scored checks, with 40 points on email; F is the grade of 74.2% of the 316,600,902 domains that carry one.

HSTS: the header most HTTPS sites still skip

Sun, 06 Sep 2026 12:00:00 GMT

Send Strict-Transport-Security: max-age=31536000; includeSubDomains over HTTPS, ramp max-age up in stages, and the browser stops sending plaintext first.

'may be forged' in your headers is a reverse DNS problem, not a spoofing alert

Sun, 06 Sep 2026 12:00:00 GMT

'(may be forged)' means the receiving server could not confirm the sending IP's reverse DNS. The fix is a PTR record at the IP's owner, not a DMARC record.

A parked domain sends no mail and can still be spoofed

Sun, 06 Sep 2026 12:00:00 GMT

A domain that sends no mail still needs SPF -all and DMARC p=reject, because receivers can't tell it's parked; a null MX is the optional third record.

DKIM on Namecheap: where the key comes from and where it goes

Sun, 06 Sep 2026 12:00:00 GMT

Generate the key in your mail provider's console, then add it in Namecheap Advanced DNS: selector only in Host, the whole value pasted, no quotes.

SPF for Wix, and the records Wix does not publish for you

Sun, 06 Sep 2026 12:00:00 GMT

Wix holds your DNS and serves the site. SPF, DKIM and DMARC come from your mail provider, and you add them in Wix DNS at @, the selector and _dmarc.

SPF: what your record says, how it fails, and how to fix it

Sun, 06 Sep 2026 12:00:00 GMT

An SPF record is a DNS TXT line naming the servers allowed to send as your domain. Read yours, match the error in your headers, fix it in minutes.

Should your SPF record end in ~all or -all, and what +all authorises

Sun, 06 Sep 2026 12:00:00 GMT

End it in ~all and let DMARC do the rejecting; -all breaks forwarded mail before DMARC can rescue it, and +all authorises anyone on the internet to send as you.

Answering the email-authentication questions on a supplier or insurance questionnaire

Sun, 06 Sep 2026 12:00:00 GMT

Pull three DNS records, read the p= tag, write the sentence a reviewer can verify with the same lookup, and attach the free scan as the evidence.

TLS and certificates: every browser warning and what causes it

Sun, 06 Sep 2026 12:00:00 GMT

Match the exact browser error code to its cause (expired, wrong name, untrusted issuer, dead handshake) and fix each one with the command shown.

Our headline F rate fell, and the internet did not get safer

Sun, 06 Sep 2026 12:00:00 GMT

74.2% of 316,600,902 graded and dead domains carry an F in September 2026. The population was rebuilt, so the share is edition-scoped and not comparable.