SenderGuard

Email Compliance 2025 — The Practical Guide

Everything you need to keep SPF/DKIM/DMARC, alignment and one‑click unsubscribe healthy — and a way to prove it with scanId + sha256 + a public Verify flow. This hub prioritizes actionable steps and verifiable outcomes over theory.

Run a check (3s)

Type a domain and get a score + five badges (SPF, DKIM, DMARC, Alignment, One-Click), plus the top three fixes.

Key definitions you can point stakeholders to

SPF 10 lookup limit

Receivers may stop SPF evaluation after 10 DNS lookups (RFC 7208 §4.6.4). When a chain exceeds the cap, alignment fails intermittently and your DMARC policy cannot enforce.

See RFC 7208 andGoogle Workspace guidance.

Run audit/Verify

Why it matters (2 minutes)

  • Authentication: without SPF/DKIM, receivers downgrade or reject.
  • Alignment: DMARC requires Header‑From aligns with SPF or DKIM domains.
  • One‑Click: lowers complaints and meets bulk‑sender rules.
  • Verifiability: evidence anyone can recompute—no black box claims.

What “good” looks like

  1. SPF: single record; ≤10 lookups; no loops; includes match your ESPs.
  2. DKIM: 2048‑bit RSA; two selectors; zero‑downtime rotation SOP.
  3. DMARC: staged none→quarantine→reject; child policy sp= if needed.
  4. Alignment: relaxed at minimum; adopt strict on stable routes.
  5. One‑Click: headers present; endpoint safe (idempotent POST; https).

Proof‑of‑Scan (reproducible evidence)

SenderGuard normalizes JSON (sorted keys, LF, UTC) and hashes with sha256. The proof tail page lists rulepackVersion, resolver set (1.1.1.1/8.8.8.8/9.9.9.9), timeouts, and inputs. Anyone can call /api/verify to recompute and compare hashes.

Operational tactics

  • Guardrails: FAIL↔PASS flips; score Δ≥20; SPF lookups ≥8; One‑Click missing.
  • De‑dup: one scan per domain / 15 min; bulk at 02:00 UTC; anomaly rescan.
  • Evidence retention: JSON 90d; PDF 30d; proof long‑term (or 1y).

Topics

CTA: Download sample PDF · Verify a scan · Start daily monitoring

Next steps