Guides

• How to buy a second domain for team mailA variant domain beside your main one avoids the migration entirely. Which TLDs old validators reject, what the registry's own terms cost you, and the order that avoids a 60-day lock.
• How to do DMARC properly: check the record you already haveA setup wizard hands you a p=none record. Replace yours and you weaken it; add it beside yours and receivers apply no DMARC at all. Plus the records that look published and aren't.
• How to forward Gmail or Outlook to a shared inboxThe confirmation step, the filter path, and the Microsoft 365 policy that blocks external forwarding by default while the setting appears to save — including the bounce code it gives you.
• How to give Claude an email addressConnect Claude to a shared inbox on your own domain in about ten minutes, no code — and the three things about it that surprise people afterwards.
• How to lock down a domain that neither sends nor receives mailA null MX, an empty SPF and DMARC at reject — on the apex and on a wildcard, because apex records do not cover subdomains. Plus the DKIM record most guides tell you to add and M3AAWG says not to.
• How to migrate from HEY to a shared inbox on your own domainLeaving HEY for Domains without losing mail: what the export does and does not carry, the records to swap, the internal-delivery trap, and why you export before cancelling rather than after.
• How to migrate your domain's email without locking yourself outMoving mail onto infrastructure you control puts your login address inside it. The loop that creates, why a second account beats a second address, and the registrar question to answer first.
• How to set up a catch-all email addressThe switch on Google Workspace, Microsoft 365, Cloudflare and cPanel, the header to file by, and the five addresses a catch-all quietly hands to whoever reads it.
• How to set up DKIMSelectors and the one case where two providers do collide, TXT versus CNAME, the 255-octet split that fails silently, key length, rotation, and what alignment actually needs.
• Parsing Authentication-Results: RFC 8601 versus two real edgesThe grammar is regular and the headers in your inbox are not. Three measured variances, why splitting on a semicolon is wrong, and the rule that survives them.
• Routing a multi-tenant catch-all without leaking between tenantsA catch-all turns 'whose mailbox is this?' into a routing decision. Matching a local part without checking the domain put one customer's login code in another customer's inbox.
• SPF checks the envelope, not the From headerWhich SPF record a receiver actually reads, why that means your apex record is often not consulted at all, and the two things that catch people out when it isn't.
• The DS record that takes your whole domain darkChange nameservers with DNSSEC still signed at the registry and every validating resolver returns SERVFAIL — web and mail, globally. Verified on a domain nobody had configured.
• Two SPF records, ten lookups, and why flattening rotsEvery way an apex SPF record fails: the second v=spf1, the eleventh lookup, the two void lookups nobody counts, and why the qualifier everyone argues about matters less than you think.
• What breaks when forwarded mail lands in a shared inboxThe envelope sender stops being the sender, the catch-all closes a loop your own-address check cannot see, and de-duplicating by similarity hides one-time passcodes.
• What RFC 9989 changed about DMARCDMARC stopped being RFC 7489 in May 2026. pct is gone, the Public Suffix List is gone, np and t arrived, and the external reporting record moved.
• Why DKIM fails when the record is already thereAbsent, present-but-stale and never actually measured all show up as one failure. Two of the three get worse if you do the obvious thing, and a fourth is not a record problem at all.