What we found, what we built, and what changed.
Original research on how the internet actually uses DMARC, engineering write-ups from building an open-source analyzer, and monthly release roundups.
The rest of this site is reference material. The guides explain how to get a domain from no protection to enforcement, the glossary defines the terms, and the docs cover running the application. Those pages are kept current and corrected in place.
Posts here are different: they are dated, signed, and written from our own point of view. Research posts report aggregate findings from the DNS survey described on the research page, with the population, date and method stated for every figure, so a number can be checked rather than taken on trust. Engineering posts explain how a part of the analyzer was built and why, including the mistakes. Release roundups summarise a month's changes for people who run an instance; per-release detail stays in the GitHub releases. A post that turns out to be wrong gets a dated correction rather than a silent rewrite.
The blog deliberately does not chase search terms. If a question starts with "how do I" or "what does this mean", the answer belongs in a guide or the glossary, where it can be kept correct. What appears here is the material those pages cannot hold: a measurement taken on a particular date, a design decision and the reasoning behind it, or a bug and what it taught us. Figures from the survey are aggregates only; no post names an individual domain's configuration.
Written by Michael Fjeldsted. Subscribe with the RSS feed.