Understanding email headers: the complete guide to reading and analyzing every field
Every email carries an invisible logbook. This guide teaches you how to extract it, read it field by field, and diagnose deliverability or security issues.
DNS
Core DNS concepts, record types, and domain name system fundamentals.
53 articles
March 2026
DNS Propagation Time: How Long Does It Really Take?
The 24 to 48 hour myth is wrong. The actual delay depends on TTL, and you can control it.
NIST SP 800-81r3: what the new DNS security guide changes
Full analysis of NIST SP 800-81r3, released March 19, 2026. Protective DNS, DNSSEC, encrypted DNS: the key recommendations for securing your infrastructure.
Ballot SC-085v2: certificate authorities now verify DNSSEC before issuing a TLS certificate
Since March 15, 2026, the CA/Browser Forum requires CAs to verify DNSSEC during domain validation. This guide covers the context, impact, and how to check your configuration.
Domain name lifecycle: expiration, protection, and best practices
From registration to release: understand every stage of the domain lifecycle, the risks at each phase, and the protections to enable.
RDAP vs WHOIS: the complete guide to the transition (EPP codes, GDPR, domain locks)
WHOIS is retiring. RDAP replaces it. This guide covers everything: technical comparison, EPP codes, GDPR impacts, domain locks, and a migration plan.
Microsoft 365 MX Migration to mx.microsoft: Automatic DNSSEC, Mandatory Graph API, and Action Items Before July 2026
Microsoft is changing DNS provisioning for Exchange Online domains. MX records are moving from mail.protection.outlook.com to mx.microsoft to streamline DNSSEC adoption. Here's what's changing and what you need to do.
February 2026
SERVFAIL after enabling DNSSEC: diagnosis and fix
A SERVFAIL after enabling DNSSEC points to a broken chain of trust. This guide covers the five causes, three diagnostic commands, and exact fixes for each scenario.
Understand the DNSSEC chain of trust in 5 minutes
The chain of trust is the core principle behind DNSSEC. This guide explains every link, from the DNS root to your domain, with clear diagrams.
Enable DNSSEC: step-by-step guide by registrar
DNSSEC protects your visitors from DNS spoofing. This guide covers step-by-step activation for the 6 most popular registrars, with instant verification.
IPv6 subnets: understanding /48, /56, and /64
Which IPv6 prefix should you use for your network? Detailed comparison of /48, /56, and /64 sizes with a table, decision tree, and real-world examples.
Spamhaus vs Barracuda vs SpamCop: Complete Email Blocklist Comparison
Detailed comparison of the 3 main email blocklists: detection methods, false positive rates, delisting procedures, and impact on Gmail, Outlook, and Yahoo deliverability.
Why Your Emails End Up in Spam: The Complete Diagnostic Guide
Are your emails consistently landing in spam? This guide analyzes the 5 main causes and gives you a concrete action plan to restore optimal deliverability.
How to Remove Your IP from a Blacklist: The Complete Delisting Guide
Is your IP on a blacklist and your emails getting rejected? This guide details the delisting procedures for each major blacklist, including processing times and best practices to avoid getting listed again.
January 2026
Global .brand Benchmark: 5 Strategic Models Decoded
From DVAG (10,562 domains) to Toyota: analysis of 5 .brand models by country. Discover which strategy to adopt based on your industry.
How Much Does a gTLD Really Cost? Complete ICANN 2026 Budget
From $350K for a .brand to over a million for a commercial gTLD: discover all ICANN 2026 application costs.
ICANN Next Round 2026: First Opportunity in 14 Years
On April 30, 2026, ICANN opens applications for new domain extensions. A complete breakdown for decision-makers.
Amazon SES: Complete Guide to DNS Configuration and Email Authentication
Complete Amazon SES configuration with Easy DKIM, Custom MAIL FROM, strict DMARC alignment. Everything you need for optimal deliverability and GDPR compliance.
Public DNS Resolver Comparison: Privacy, Security, Filtering
A comprehensive guide to compare the best public DNS resolvers: privacy, security, family filtering, DoH/DoT/DoQ, and deployment methods.
Surfshark DNS: how it works, benefits, and setup
Surfshark DNS is a free public DNS resolver (IPv4/IPv6, DoH) focused on privacy. Here's when to use it, how to configure it, and what to check.
DNS4EU: the European DNS resolver (DoH/DoT), profiles and setup
DNS4EU is a European public DNS with 5 variants (security, kids, ad blocking, neutral) and IPv4/IPv6 + DoH/DoT addresses. Deployment and verification guide.
CleanBrowsing DNS: Family/Adult/Security profiles, DoH/DoT, and parental control
CleanBrowsing is a public filtering DNS resolver (Family/Adult/Security) with DoH/DoT. Practical guide: router, mobile, checks, and anti-bypass.
December 2025
NextDNS DNS: how it works, benefits, and setup
NextDNS is a customizable DNS resolver: DoH/DoT encryption, filtering, profiles, and logs. Here's how to deploy it cleanly at home or in an SMB.
AdGuard DNS (94.140.14.14): filtering, privacy, and Family mode
AdGuard DNS is a public DNS resolver that can block ads/trackers (and, in Family mode, adult content). Addresses, DoH/DoT/DoQ, and an action plan.
Cloudflare DNS (1.1.1.1): privacy, DoH/DoT, deployment
1.1.1.1 is Cloudflare's public DNS resolver. Here's how to use it properly (addresses, DoH/DoT/ODoH, tests, pitfalls) and deploy it.
Quad9 DNS (9.9.9.9): how it works, benefits, alternatives
Quad9 (9.9.9.9) is a public DNS resolver focused on security and privacy: malware blocking, DNSSEC validation, and encrypted DoT/DoH options. Here's how to deploy it properly.
Connect CaptainDNS to ChatGPT via MCP: 3 widgets for DNS audits and deliverability
Add the CaptainDNS MCP server to ChatGPT and use 3 widgets to troubleshoot DMARC/DNS and analyze email headers without leaving the conversation.
BIMI, VMC, CMC: compatibility and DNS prerequisites (Gmail, Yahoo, Apple Mail)
Putting your logo in the inbox: what you actually need to configure in DNS for BIMI, and how to choose between VMC and CMC.
Gmail/Yahoo one-click unsubscribe: what RFC 8058 changes and how to implement it
Gmail and Yahoo require a one-click unsubscribe via RFC 8058-compliant List-Unsubscribe headers. Here's the expected format, the server-side POST, and the compliance checklist.
IPv4 vs IPv6: understand the differences and plan the transition
IPv4 vs IPv6: address sizes, performance, security, NAT, DNS... Learn how to differentiate ipv4 and ipv6, what ipv6 vs ipv4 really means, the ipv4 and ipv6 difference for DNS, and how to keep both stacks coexisting.
Google DNS 8.8.8.8: how it works, benefits and alternatives
Learn what Google Public DNS 8.8.8.8 is, how it works, its speed and reliability benefits, privacy drawbacks, how to configure it on Windows 11 or a router, and which alternatives (Cloudflare 1.1.1.1, OpenDNS, etc.) to consider.
Auth0 + MCP CaptainDNS: our full postmortem
How we connected Auth0 to our CaptainDNS MCP server: dedicated audiences, PRM, Resource Parameter Compatibility Profile, JWT validation, identity propagation into profiles and api_requests, with optional auth today and protected tools ready for later.
November 2025
Behind the scenes of the CaptainDNS MCP
How we wired CaptainDNS to AIs through MCP: architecture, HTTP+SSE transport, JSON-RPC, 424 errors, timeouts, and what we learned along the way.
BIMI logo cache: run a brand refresh and make the new logo show up everywhere
Your logo changed but inboxes still display the old one? It is not only a DNS issue: mailbox providers cache BIMI assets. Discover how the cache layers work and how to plan a smooth BIMI migration.
New in CaptainDNS: central history and continuous DNS monitoring
Diagnose, archive, share, then monitor: CaptainDNS now supervises the full lifecycle of a DNS query from the first lookup to automated watch jobs.
Gmail tightens its sending rules: what's changing for senders starting November 2025
Starting in November 2025, Google enforces new security requirements for bulk senders: full SPF/DKIM/DMARC authentication, TLS encryption and strict unsubscribe management.
October 2025
France's domains: the local digital divide
Behind 4.3M .fr domains, geography reveals a two-speed country: from 21 to 235 domains per 1,000 inhabitants depending on the department.
EDNS Client Subnet (ECS): understanding how DNS adapts responses to your location
EDNS Client Subnet (ECS) lets a DNS resolver pass a client address prefix to improve geolocation of the answers.
Building Resilient DNS Monitoring
Ensure visibility of your domains by combining zone differences, active queries and propagation tests.