The Useful Byte

DNS trust series
SPF, DKIM and DMARC: why passing authentication is not enough

DNS trust, part 3 of 3 · Reviewed October 24, 2026 A message can pass an authentication check and still fail DMARC. That sounds contradictory until you ask which domain passed. A…
byAlex R. •October 25, 2026
DANE
DANE and TLSA: How DNSSEC Can Authenticate a Mail Server

DNS trust, part 2 of 3 · Reviewed October 24, 2026 DNSSEC lets a validating resolver check whether DNS data is authentic. DANE takes the next step: an application can use authen…
byAlex R. •October 25, 2026
DNS
DNS and DNSSEC: what a validated answer protects, and what it does not

DNS trust, part 1 of 3 · Reviewed October 24, 2026 A domain can resolve successfully and still leave an important question unanswered: did the DNS answer survive the journey with…
byAlex R. •October 25, 2026
<script type='text/javascript'>
//<![CDATA[
/* Related Posts Loader */
(function(){function loadRelatedPosts(){var d=document.querySelector('.related-tag');if(!d)return;var label=d.getAttribute('data-label');var pid=d.getAttribute('data-id');if(!label)return;fetch(window.location.origin+'/feeds/posts/default/-/'+encodeURIComponent(label)+'?alt=json&max-results=7').then(function(r){return r.json();}).then(function(data){var entries=(data.feed&&data.feed.entry?data.feed.entry:[]).filter(function(e){return !e.id.$t.includes(pid) && (e.category||[]).some(function(c){return c.term==='lang-he';}) === document.documentElement.classList.contains('ss-he-page');}).slice(0,4);if(!entries.length){var w=document.getElementById('related-wrap');if(w)w.style.display='none';return;}d.innerHTML=entries.map(function(e){var t=e.title.$t;var u=((e.link||[]).find(function(l){return l.rel==='alternate';})||{}).href||'#';var th=(e['media$thumbnail']&&e['media$thumbnail'].url)?e['media$thumbnail'].url.replace('s72-c','s300-c'):'';var ds='';if(e.published&&e.published.$t){var dd=new Date(e.published.$t);ds=dd.toLocaleDateString('en-US',{month:'short',day:'numeric',year:'numeric'});}return'<a href="'+u+'" class="related-item">'+(th?'<div class="related-thumb" style="background-image:url('+th+')"></div>':'')+'<div class="related-info"><span class="related-title">'+t+'</span><span class="related-date">'+ds+'</span></div></a>';}).join('');}).catch(function(){});}if(document.readyState==='loading'){document.addEventListener('DOMContentLoaded',loadRelatedPosts);}else{loadRelatedPosts();}})();
//]]>
</script>
<script type='text/javascript'>
//<![CDATA[
(function(){
  function loadRelatedPosts(){
    var d=document.querySelector('.related-tag');
    if(!d)return;
    var label=d.getAttribute('data-label');
    var pid=d.getAttribute('data-id');
    if(!label)return;
    fetch(window.location.origin+'/feeds/posts/default/-/'+encodeURIComponent(label)+'?alt=json&max-results=7')
      .then(function(r){return r.json();})
      .then(function(data){
        var entries=(data.feed&&data.feed.entry?data.feed.entry:[])
          .filter(function(e){return !e.id.$t.includes(pid) && (e.category||[]).some(function(c){return c.term==='lang-he';}) === document.documentElement.classList.contains('ss-he-page');})
          .slice(0,4);
        if(!entries.length){
          var w=document.getElementById('related-wrap');
          if(w)w.style.display='none';
          return;
        }
        d.innerHTML=entries.map(function(e){
          var t=e.title.$t;
          var u=((e.link||[]).find(function(l){return l.rel==='alternate';})||{}).href||'#';
          var th=(e['media$thumbnail']&&e['media$thumbnail'].url)
            ?e['media$thumbnail'].url.replace('s72-c','s300-c'):'';
          var ds='';
          if(e.published&&e.published.$t){
            var dd=new Date(e.published.$t);
            ds=dd.toLocaleDateString('en-US',{month:'short',day:'numeric',year:'numeric'});
          }
          return'<a href="'+u+'" class="related-item">'
            +(th?'<div class="related-thumb" style="background-image:url('+th+')"></div>':'')
            +'<div class="related-info"><span class="related-title">'+t+'</span>'
            +'<span class="related-date">'+ds+'</span></div></a>';
        }).join('');
      })
      .catch(function(){});
  }
  if(document.readyState==='loading'){
    document.addEventListener('DOMContentLoaded',loadRelatedPosts);
  }else{
    loadRelatedPosts();
  }
})();
//]]>
</script>

<script type="text/javascript" src="https://www.blogger.com/static/v1/widgets/3961732468-widgets.js"></script>
<script type='text/javascript'>
window['__wavt'] = 'AKZvMzshaN7rqDqhh4nm97SSN-yu:1792943343984';_WidgetManager._Init('//www.blogger.com/rearrange?blogID\x3d2139279071038304164','//www.sysseder.com/search/label/DNS%20trust%20series','2139279071038304164');
_WidgetManager._SetDataContext([{'name': 'blog', 'data': {'blogId': '2139279071038304164', 'title': 'The Useful Byte', 'url': 'https://www.sysseder.com/search/label/DNS%20trust%20series', 'canonicalUrl': 'https://www.sysseder.com/search/label/DNS%20trust%20series', 'homepageUrl': 'https://www.sysseder.com/', 'searchUrl': 'https://www.sysseder.com/search', 'canonicalHomepageUrl': 'https://www.sysseder.com/', 'blogspotFaviconUrl': 'https://www.sysseder.com/favicon.ico', 'bloggerUrl': 'https://www.blogger.com', 'hasCustomDomain': true, 'httpsEnabled': true, 'enabledCommentProfileImages': true, 'gPlusViewType': 'FILTERED_POSTMOD', 'adultContent': false, 'analyticsAccountNumber': 'G-YP8XPR9YJJ', 'analytics4': true, 'encoding': 'UTF-8', 'locale': 'en', 'localeUnderscoreDelimited': 'en', 'languageDirection': 'ltr', 'isPrivate': false, 'isMobile': false, 'isMobileRequest': false, 'mobileClass': '', 'isPrivateBlog': false, 'isDynamicViewsAvailable': true, 'feedLinks': '\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22The Useful Byte - Atom\x22 href\x3d\x22https://www.sysseder.com/feeds/posts/default\x22 /\x3e\n\x3clink rel\x3d\x22alternate\x22 type\x3d\x22application/rss+xml\x22 title\x3d\x22The Useful Byte - RSS\x22 href\x3d\x22https://www.sysseder.com/feeds/posts/default?alt\x3drss\x22 /\x3e\n\x3clink rel\x3d\x22service.post\x22 type\x3d\x22application/atom+xml\x22 title\x3d\x22The Useful Byte - Atom\x22 href\x3d\x22https://www.blogger.com/feeds/2139279071038304164/posts/default\x22 /\x3e\n', 'meTag': '', 'adsenseClientId': 'ca-pub-9348007134072555', 'adsenseHostId': 'ca-host-pub-1556223355139109', 'adsenseHasAds': false, 'adsenseAutoAds': false, 'boqCommentIframeForm': true, 'loginRedirectParam': '', 'view': '', 'dynamicViewsCommentsSrc': '//www.blogblog.com/dynamicviews/4224c15c4e7c9321/js/comments.js', 'dynamicViewsScriptSrc': '//www.blogblog.com/dynamicviews/fa12fcebe36ff135', 'plusOneApiSrc': 'https://apis.google.com/js/platform.js', 'disableGComments': true, 'interstitialAccepted': false, 'sharing': {'platforms': [{'name': 'Get link', 'key': 'link', 'shareMessage': 'Get link', 'target': ''}, {'name': 'Facebook', 'key': 'facebook', 'shareMessage': 'Share to Facebook', 'target': 'facebook'}, {'name': 'BlogThis!', 'key': 'blogThis', 'shareMessage': 'BlogThis!', 'target': 'blog'}, {'name': 'X', 'key': 'twitter', 'shareMessage': 'Share to X', 'target': 'twitter'}, {'name': 'Pinterest', 'key': 'pinterest', 'shareMessage': 'Share to Pinterest', 'target': 'pinterest'}, {'name': 'Email', 'key': 'email', 'shareMessage': 'Email', 'target': 'email'}], 'disableGooglePlus': true, 'googlePlusShareButtonWidth': 0, 'googlePlusBootstrap': '\x3cscript type\x3d\x22text/javascript\x22\x3ewindow.___gcfg \x3d {\x27lang\x27: \x27en\x27};\x3c/script\x3e'}, 'hasCustomJumpLinkMessage': true, 'jumpLinkMessage': 'Blog Posts', 'pageType': 'index', 'searchLabel': 'DNS trust series', 'pageName': 'DNS trust series', 'pageTitle': 'The Useful Byte: DNS trust series', 'metaDescription': 'The Useful Byte: everyday technology, online safety, AI, hardware and energy explained simply. Small reads. Smarter digital life.'}}, {'name': 'features', 'data': {}}, {'name': 'messages', 'data': {'edit': 'Edit', 'linkCopiedToClipboard': 'Link copied to clipboard!', 'ok': 'Ok', 'postLink': 'Post Link'}}, {'name': 'template', 'data': {'name': 'custom', 'localizedName': 'Custom', 'isResponsive': true, 'isAlternateRendering': false, 'isCustom': true}}, {'name': 'view', 'data': {'classic': {'name': 'classic', 'url': '?view\x3dclassic'}, 'flipcard': {'name': 'flipcard', 'url': '?view\x3dflipcard'}, 'magazine': {'name': 'magazine', 'url': '?view\x3dmagazine'}, 'mosaic': {'name': 'mosaic', 'url': '?view\x3dmosaic'}, 'sidebar': {'name': 'sidebar', 'url': '?view\x3dsidebar'}, 'snapshot': {'name': 'snapshot', 'url': '?view\x3dsnapshot'}, 'timeslide': {'name': 'timeslide', 'url': '?view\x3dtimeslide'}, 'isMobile': false, 'title': 'The Useful Byte', 'description': 'The Useful Byte: everyday technology, online safety, AI, hardware and energy explained simply. Small reads. Smarter digital life.', 'url': 'https://www.sysseder.com/search/label/DNS%20trust%20series', 'type': 'feed', 'isSingleItem': false, 'isMultipleItems': true, 'isError': false, 'isPage': false, 'isPost': false, 'isHomepage': false, 'isArchive': false, 'isSearch': true, 'isLabelSearch': true, 'search': {'label': 'DNS trust series', 'resultsMessage': 'Showing posts with the label DNS trust series', 'resultsMessageHtml': 'Showing posts with the label \x3cspan class\x3d\x27search-label\x27\x3eDNS trust series\x3c/span\x3e'}}}, {'name': 'widgets', 'data': [{'title': 'Default Thumbnail', 'type': 'Image', 'sectionId': 'pbt-panel', 'id': 'Image52'}, {'title': 'JSON Variables', 'type': 'HTML', 'sectionId': 'pbt-panel', 'id': 'HTML50'}, {'title': 'The Useful Byte', 'type': 'Image', 'sectionId': 'main-logo', 'id': 'Image50'}, {'title': 'Explore', 'type': 'LinkList', 'sectionId': 'xdfcb-main-menu', 'id': 'LinkList200'}, {'title': 'Explore topics', 'type': 'LinkList', 'sectionId': 'headerbar', 'id': 'LinkList201'}, {'title': 'Watch on YouTube', 'type': 'LinkList', 'sectionId': 'headerbar', 'id': 'LinkList202'}, {'title': 'Blog Posts', 'type': 'Blog', 'sectionId': 'main', 'id': 'Blog1', 'posts': [{'id': '6501406250824821212', 'title': 'SPF, DKIM and DMARC: why passing authentication is not enough', 'showInlineAds': false}, {'id': '186759534048396741', 'title': 'DANE and TLSA: How DNSSEC Can Authenticate a Mail Server', 'showInlineAds': false}, {'id': '2166333354754198209', 'title': 'DNS and DNSSEC: what a validated answer protects, and what it does not', 'featuredImage': 'https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_ticB7dtikEPeDptHC9r796RXpNazAiZeDVZBXX6sXHv6swQTAYWr-QbaYPxHgTfyy6yhdg1S5GUYZ0OuDBtzQz_JWWxgZhAEbl8kq6b4BjlRVIQw', 'showInlineAds': false}], 'headerByline': {'regionName': 'header1', 'items': [{'name': 'share', 'label': ''}, {'name': 'author', 'label': 'by'}, {'name': 'timestamp', 'label': '\u2022'}]}, 'footerBylines': [{'regionName': 'footer1', 'items': [{'name': 'comments', 'label': '$type\x3d{blogger}'}, {'name': 'icons', 'label': ''}]}, {'regionName': 'footer2', 'items': [{'name': 'labels', 'label': 'Tags'}]}], 'allBylineItems': [{'name': 'share', 'label': ''}, {'name': 'author', 'label': 'by'}, {'name': 'timestamp', 'label': '\u2022'}, {'name': 'comments', 'label': '$type\x3d{blogger}'}, {'name': 'icons', 'label': ''}, {'name': 'labels', 'label': 'Tags'}]}, {'title': 'You might like', 'type': 'HTML', 'sectionId': 'xdfcb-related-posts', 'id': 'HTML51'}, {'title': 'The Useful Byte (Header)', 'type': 'Header', 'sectionId': 'sidebar', 'id': 'Header1'}, {'title': 'Most Popular Posts', 'type': 'PopularPosts', 'sectionId': 'sidebar', 'id': 'PopularPosts1', 'posts': [{'title': 'Tailscale SSH TS-2026-009: Affected Hosts and the Correct Fix', 'id': '5391173494884210373'}, {'title': 'Chrome 158 and Edge 159 XSLT Removal: Timeline and Migration Checklist', 'id': '106873693354530591'}, {'title': 'Resurrecting Dead Silicon: How to Unlock and Repurpose Meta Portal Hardware via ADB', 'id': '1501510556877560431'}, {'title': 'DeepSeek V4.1 Flash 1017: A Self-Hosting Evaluation Checklist', 'id': '557104440701388671'}, {'title': 'Website Calling Localhost: HTTP \x26 WebSocket Options in Chrome, Firefox \x26 Edge (2025 Guide)', 'id': '2261677133722517573'}, {'title': 'Why Gentoo Dropped Chromium: The End of an Era for Source-Based Browsers', 'id': '5949147462481981901'}]}, {'title': '', 'type': 'LinkList', 'sectionId': 'footer-menu', 'id': 'LinkList204'}]}]);
_WidgetManager._RegisterWidget('_ImageView', new _WidgetInfo('Image52', 'pbt-panel', document.getElementById('Image52'), {'resize': true}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML50', 'pbt-panel', document.getElementById('HTML50'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_ImageView', new _WidgetInfo('Image50', 'main-logo', document.getElementById('Image50'), {'resize': true}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList200', 'xdfcb-main-menu', document.getElementById('LinkList200'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList201', 'headerbar', document.getElementById('LinkList201'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList202', 'headerbar', document.getElementById('LinkList202'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_BlogView', new _WidgetInfo('Blog1', 'main', document.getElementById('Blog1'), {'cmtInteractionsEnabled': false, 'navMessage': 'Showing posts with label \x3cb\x3eDNS trust series\x3c/b\x3e. \x3ca href\x3d\x22https://www.sysseder.com/\x22\x3eShow all posts\x3c/a\x3e', 'lightboxEnabled': true, 'lightboxModuleUrl': 'https://www.blogger.com/static/v1/jsbin/3797967716-lbx.js', 'lightboxCssUrl': 'https://www.blogger.com/static/v1/v-css/828616780-lightbox_bundle.css'}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HTMLView', new _WidgetInfo('HTML51', 'xdfcb-related-posts', document.getElementById('HTML51'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_HeaderView', new _WidgetInfo('Header1', 'sidebar', document.getElementById('Header1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_PopularPostsView', new _WidgetInfo('PopularPosts1', 'sidebar', document.getElementById('PopularPosts1'), {}, 'displayModeFull'));
_WidgetManager._RegisterWidget('_LinkListView', new _WidgetInfo('LinkList204', 'footer-menu', document.getElementById('LinkList204'), {}, 'displayModeFull'));
</script>
</body>