{"id":325,"date":"2026-09-02T10:04:30","date_gmt":"2026-09-02T04:34:30","guid":{"rendered":"https:\/\/emailalias.io\/blog\/?p=325"},"modified":"2026-09-09T12:21:41","modified_gmt":"2026-09-09T06:51:41","slug":"what-is-dmarc","status":"publish","type":"post","link":"https:\/\/emailalias.io\/blog\/what-is-dmarc\/","title":{"rendered":"What Is DMARC and Why Your Email Needs It"},"content":{"rendered":"<p>You have probably seen the acronym in a security guide or a warning from your email provider, so let us answer it plainly. <strong>What is DMARC<\/strong>? It is an email authentication standard that lets a domain owner tell the world which servers are allowed to send mail as their domain \u2014 and what receivers should do with anything that fails the check. In practice, DMARC is the layer that stops criminals from convincingly spoofing your address, and the reason your own legitimate mail stays out of the spam folder. This guide explains what DMARC is in plain language, how it works alongside SPF and DKIM, what its policies mean, how to set it up without being a mail admin, and where email aliases fit into the same picture.<\/p>\n\n<nav class=\"post-toc\" aria-label=\"Table of contents\">\n  <h2 class=\"post-toc__title\">Table of contents<\/h2>\n  <ol class=\"post-toc__list\">\n    <li><a href=\"#what-is-dmarc\">What is DMARC?<\/a><\/li>\n    <li><a href=\"#what-is-dmarc-and-how-does-it-work\">What is DMARC and how does it work?<\/a><\/li>\n    <li><a href=\"#why-your-email-needs-dmarc\">Why your email needs DMARC<\/a><\/li>\n    <li><a href=\"#dmarc-policies-none-quarantine-reject\">DMARC policies: none, quarantine, reject<\/a><\/li>\n    <li><a href=\"#dmarc-vs-spf-and-dkim\">DMARC vs SPF and DKIM<\/a><\/li>\n    <li><a href=\"#how-to-set-up-dmarc\">How to set up DMARC<\/a><\/li>\n    <li><a href=\"#dmarc-reports-and-what-they-tell-you\">DMARC reports and what they tell you<\/a><\/li>\n    <li><a href=\"#how-email-aliases-and-dmarc-work-together\">How email aliases and DMARC work together<\/a><\/li>\n    <li><a href=\"#final-thoughts\">Final thoughts<\/a><\/li>\n    <li><a href=\"#faq\">Frequently asked questions<\/a><\/li>\n  <\/ol>\n<\/nav>\n\n<h2 id=\"what-is-dmarc\">What Is DMARC?<\/h2>\n<p>DMARC stands for Domain-based Message Authentication, Reporting and Conformance. Stripped of the jargon, the short answer to what is DMARC is this: it is a public policy, published in your domain&#8217;s DNS, that tells receiving mail servers two things \u2014 how to confirm a message genuinely came from your domain, and what to do if it did not. Before DMARC, a receiver could check some authentication signals but had no instruction from you about whether to trust the result or reject a forgery. DMARC closes that gap, and it is documented in detail on Wikipedia&#8217;s overview of <a href=\"https:\/\/en.wikipedia.org\/wiki\/DMARC\" rel=\"noopener\" target=\"_blank\">DMARC<\/a> and by the standard&#8217;s own body at <a href=\"https:\/\/dmarc.org\/\" rel=\"noopener\" target=\"_blank\">dmarc.org<\/a>.<\/p>\n<p>It helps to be clear about what DMARC is not. It is not an anti-spam filter you install, and it is not something that scans the content of messages. DMARC never reads the body of an email; it only judges whether the message is authorised to use the domain in the visible &#8220;From&#8221; address. It is also not a standalone tool \u2014 it builds on two older standards, SPF and DKIM, and its whole job is to tie them together and add an enforcement policy plus reporting on top. Understanding what is DMARC therefore means understanding how those pieces fit, which the next section walks through.<\/p>\n<p>One more framing helps before the mechanics. A useful way to answer what is DMARC is to picture the missing instruction on an envelope. SPF and DKIM are like checking a return address and a wax seal \u2014 they tell a sorting office whether the markings look genuine, but not what to do when they do not. DMARC is the note you leave the office that says, in effect, if a letter claims to be from me but the seal does not match, do not deliver it. That is why what is DMARC really comes down to policy: the checks were already possible, but until you publish a DMARC policy, no receiver is obliged to act on a forgery sent in your name.<\/p>\n\n<h2 id=\"what-is-dmarc-and-how-does-it-work\">What Is DMARC and How Does It Work?<\/h2>\n<p>To see what is DMARC doing in practice, follow a message as it arrives. The receiving server first runs the two underlying checks. <a href=\"https:\/\/en.wikipedia.org\/wiki\/Sender_Policy_Framework\" rel=\"noopener\" target=\"_blank\">Sender Policy Framework<\/a> (SPF) confirms the sending server&#8217;s address is on the list of servers your domain has authorised. <a href=\"https:\/\/en.wikipedia.org\/wiki\/DomainKeys_Identified_Mail\" rel=\"noopener\" target=\"_blank\">DomainKeys Identified Mail<\/a> (DKIM) verifies a cryptographic signature attached to the message, proving it came from your domain and was not altered in transit. Those two have existed for years. What DMARC adds is a rule that ties their result to the address the reader actually sees.<\/p>\n\n<figure class=\"wp-block-image size-large\">\n  <img data-recalc-dims=\"1\" src=\"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/what-is-dmarc-example.jpg?resize=1080%2C608&#038;ssl=1\"\n       alt=\"What is DMARC doing: a message is checked against SPF and DKIM alignment, then the domain's DMARC policy decides pass, quarantine, or reject\"\n       width=\"1080\" height=\"608\" loading=\"lazy\" decoding=\"async\" \/>\n  <figcaption>What is DMARC in one picture: SPF and DKIM must pass AND align with the visible From domain, then your published policy decides what happens to anything that fails.<\/figcaption>\n<\/figure>\n\n<p>The key idea DMARC introduces is <strong>alignment<\/strong>. It is not enough for SPF or DKIM to pass on some technical domain buried in the headers; DMARC requires that a passing check line up with the domain in the &#8220;From&#8221; line the recipient reads. That single requirement is what defeats the most convincing forgeries, because an attacker can pass SPF on their own domain all day, but they cannot make that align with your domain. Once alignment is evaluated, the receiver looks up your DMARC policy in DNS and does exactly what it says \u2014 deliver, quarantine, or reject. That is the whole loop: authenticate, check alignment, apply your policy.<\/p>\n<p>So the answer to what is DMARC and how does it work is a three-step chain: SPF and DKIM provide the evidence, alignment makes that evidence meaningful for the address people see, and the published policy turns it into an action. Remove any one of the three and forged mail slips through \u2014 which is precisely the state most domains were in before they deployed it.<\/p>\n\n<h2 id=\"why-your-email-needs-dmarc\">Why Your Email Needs DMARC<\/h2>\n<p>There are two sides to why DMARC matters, and both hit ordinary senders, not just big companies. The first is protection against impersonation. Without a DMARC policy set to enforce, anyone can put your domain in the &#8220;From&#8221; line of a scam email, and receiving servers have no instruction to stop it. That is the mechanism behind most <a href=\"https:\/\/emailalias.io\/blog\/what-is-email-spoofing\/\" rel=\"noopener\" target=\"_blank\">email spoofing<\/a> and the business-fraud emails that cost organisations billions each year. A DMARC record set to reject means a message that forges your domain but cannot authenticate is refused before it ever reaches an inbox.<\/p>\n<p>The second side is deliverability \u2014 getting your own genuine mail delivered. Major mailbox providers increasingly treat authentication as a trust signal, and some now require it for bulk senders. A domain with SPF, DKIM, and a DMARC policy in place is far more likely to land in the inbox than one without, because the receiver can verify it is really you. In other words, DMARC is not only a shield against people abusing your name; it is also what keeps your own newsletters, receipts, and password resets out of the spam folder. For a small business or a personal domain, that combination is exactly why the effort pays off.<\/p>\n<p>It is worth stressing that this is not only an enterprise concern \u2014 in fact the answer to what is DMARC matters most to small and personal domains. Attackers spoof them precisely because those owners assume no one would bother, and because, without a DMARC policy, nothing stops them. A one-person business whose domain is used to send invoice-fraud emails can lose customer trust overnight, with no technical breach on their side at all. Publishing a DMARC record is the single cheapest step that closes that door, and it protects your reputation as much as your inbox.<\/p>\n\n<h2 id=\"dmarc-policies-none-quarantine-reject\">DMARC Policies: None, Quarantine, Reject<\/h2>\n<p>A DMARC record carries a policy, written as a <code>p=<\/code> tag, that tells receivers what to do with mail that fails the check. There are three settings, and the usual path is to move through them in order as you gain confidence. The table below summarises them, and the notes after explain how to progress safely.<\/p>\n\n<figure class=\"wp-block-table\"><table><caption>The three DMARC policies and when to use each<\/caption>\n  <thead>\n    <tr><th>Policy<\/th><th>What happens to failing mail<\/th><th>When to use it<\/th><\/tr>\n  <\/thead>\n  <tbody>\n    <tr><td>p=none<\/td><td>Delivered as normal \u2014 nothing is blocked<\/td><td>Monitoring only; start here to see who sends as you<\/td><\/tr>\n    <tr><td>p=quarantine<\/td><td>Sent to the spam or junk folder<\/td><td>Once your legitimate senders reliably pass<\/td><\/tr>\n    <tr><td>p=reject<\/td><td>Refused outright \u2014 never reaches the inbox<\/td><td>Full enforcement; the goal state for real protection<\/td><\/tr>\n  <\/tbody>\n<\/table><\/figure>\n\n<p>Almost everyone begins at <code>p=none<\/code>. It changes nothing about delivery, but it switches on the reporting that shows you every source sending mail as your domain \u2014 your real newsletter tool, your invoicing app, and any impersonators. Once the reports confirm your genuine senders all authenticate and align, you tighten to <code>p=quarantine<\/code> so suspect mail lands in spam rather than the inbox, and finally to <code>p=reject<\/code>, where forgeries are turned away completely. Rushing straight to reject before your legitimate mail passes is the one real risk, because it can block your own messages \u2014 which is why the monitoring stage exists.<\/p>\n\n<h2 id=\"dmarc-vs-spf-and-dkim\">DMARC vs SPF and DKIM<\/h2>\n<p>People often ask how these three relate, and the cleanest way to hold it in your head is that SPF and DKIM are the evidence while DMARC is the verdict and the policy. SPF answers &#8220;was this server allowed to send for the domain?&#8221; DKIM answers &#8220;was this message really signed by the domain and left unaltered?&#8221; Neither, on its own, tells the receiver what to do, and neither checks the address the human actually sees. DMARC sits on top, requires that one of those checks passes and aligns with the visible &#8220;From&#8221; domain, and then enforces your chosen policy.<\/p>\n<p>That is why deploying SPF and DKIM without DMARC leaves a real gap: the checks can pass on a lookalike or unrelated domain and still fool a reader, and the receiver has no instruction to act. It is also why DMARC cannot work alone \u2014 with no SPF or DKIM to draw on, it has no evidence to evaluate. The three are a set. If you want the deeper mechanics of how forgery exploits the gaps these standards close, our explainer on <a href=\"https:\/\/emailalias.io\/blog\/what-is-email-spoofing\/\" rel=\"noopener\" target=\"_blank\">what email spoofing is<\/a> walks through the same chain from the attacker&#8217;s side.<\/p>\n\n<h2 id=\"how-to-set-up-dmarc\">How to Set Up DMARC<\/h2>\n<p>Setting up DMARC does not require running a mail server \u2014 it is a single DNS record, and most of the work is done before you publish it. Here is the accessible version of the process.<\/p>\n<ol>\n  <li><strong>Get SPF and DKIM working first.<\/strong> DMARC has nothing to evaluate without them, so confirm your sending services (your provider, newsletter tool, and so on) are authorised in SPF and signing with DKIM.<\/li>\n  <li><strong>Publish a monitoring record.<\/strong> Add a DNS TXT record at <code>_dmarc.yourdomain.com<\/code> with a value like <code>v=DMARC1; p=none; rua=mailto:you@yourdomain.com<\/code>. The <code>rua<\/code> address is where the daily reports are sent.<\/li>\n  <li><strong>Read the reports for a couple of weeks.<\/strong> They reveal every source sending as your domain and whether each one passes. Fix any legitimate sender that is failing.<\/li>\n  <li><strong>Tighten the policy.<\/strong> Move to <code>p=quarantine<\/code>, watch again, then to <code>p=reject<\/code> once your real mail is clean.<\/li>\n<\/ol>\n<p>That is genuinely the whole job for most domains. The raw reports are hard to read by eye, so many people point the <code>rua<\/code> address at a DMARC reporting service that turns them into a readable dashboard \u2014 and some managed email and alias services handle the enforcement and reporting for you, which is where the next sections come in. If you want the full technical framing, the broader topic of <a href=\"https:\/\/en.wikipedia.org\/wiki\/Email_authentication\" rel=\"noopener\" target=\"_blank\">email authentication<\/a> covers how SPF, DKIM, and DMARC evolved together.<\/p>\n\n<h2 id=\"dmarc-reports-and-what-they-tell-you\">DMARC Reports and What They Tell You<\/h2>\n<p>The reporting part of the name is easy to overlook, but it is one of the most useful things DMARC does. When you publish a policy with an <code>rua<\/code> address, participating receivers send you a daily aggregate report \u2014 an XML summary of every message that used your domain, which servers sent it, and whether it passed SPF, DKIM, and alignment. Read across a week, those reports draw a complete map of who sends mail as you.<\/p>\n<p>That map is valuable in two directions. It shows your legitimate senders you may have forgotten \u2014 a support desk, a payment processor, a marketing tool \u2014 so you can authorise them before tightening the policy and accidentally blocking your own mail. And it shows the impersonators: servers trying to send as your domain that have no business doing so, which is often the first hard evidence that your name is being used in scams. Watching the failures drop toward zero as you move to reject is how you confirm the protection is actually working, rather than hoping it is.<\/p>\n\n<h2 id=\"how-email-aliases-and-dmarc-work-together\">How Email Aliases and DMARC Work Together<\/h2>\n<p>Email aliases and DMARC solve related problems from opposite ends. DMARC protects the domains you send from; aliases protect the address you hand out. Used together they shrink your exposure considerably. An alias is a separate forwarding address you give to a service instead of your real inbox, so a breach at that service leaks only a disposable-feeling alias you can retire \u2014 not the address your domain and identity depend on. Keeping your true address off the open web with a <a href=\"https:\/\/emailalias.io\/private-email-alias\/\" rel=\"noopener\" target=\"_blank\">private email alias<\/a> means there is simply less raw material for the spoofing and phishing campaigns that DMARC is built to defeat. If aliases are new to you, our guides to <a href=\"https:\/\/emailalias.io\/blog\/what-is-an-email-alias\/\" rel=\"noopener\" target=\"_blank\">what an email alias is<\/a> and <a href=\"https:\/\/emailalias.io\/blog\/how-email-aliases-work\/\" rel=\"noopener\" target=\"_blank\">how email aliases work<\/a> cover the basics.<\/p>\n<p>There is a direct technical link, too. At EmailAlias we enforce SPF, DKIM, and DMARC on every domain and alias we handle, so mail that forges your alias domain fails authentication rather than landing in someone&#8217;s inbox \u2014 the same protection DMARC gives a domain you own, applied to the addresses you give out. Because these are permanent forwarding addresses you control \u2014 <a href=\"https:\/\/emailalias.io\/not-disposable-email\/\" rel=\"noopener\" target=\"_blank\">not disposable inboxes<\/a> that expire \u2014 you keep the account and can cut off any single alias the moment it starts attracting hostile mail. You can spin up your first addresses with an <a href=\"https:\/\/emailalias.io\/email-alias-generator\/\" rel=\"noopener\" target=\"_blank\">email alias generator<\/a> or see the plans on our <a href=\"https:\/\/emailalias.io\/pricing\/\" rel=\"noopener\" target=\"_blank\">pricing page<\/a>; the point is that authentication on the domain and separation at the address are two halves of the same defence.<\/p>\n\n<h2 id=\"final-thoughts\">Final Thoughts<\/h2>\n<p>So, one more time, what is DMARC? It is the standard that turns two older authentication checks into a real defence: it requires that SPF or DKIM not only pass but align with the address people see, and it lets you publish a policy telling receivers to reject anything that fails. That is what stops others spoofing your domain and, just as importantly, keeps your own mail trusted and out of the spam folder. The path is gentle \u2014 start in monitoring mode, read the reports, then tighten to reject once your legitimate senders pass \u2014 and it is a one-time DNS job for most domains. Pair a domain that authenticates with aliases that keep your real address private, and you have covered both ends of the problem: no one can convincingly send as you, and there is far less of your identity exposed for them to try. If you have not published a DMARC record yet, a monitoring one today costs nothing and starts showing you exactly who is sending in your name.<\/p>\n\n<h2 id=\"faq\">Frequently Asked Questions<\/h2>\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is DMARC in simple terms?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>DMARC is a policy you publish in your domain&#8217;s DNS that tells receiving mail servers how to confirm a message really came from your domain and what to do if it did not \u2014 deliver it, send it to spam, or reject it. It builds on the SPF and DKIM checks and adds the missing instruction plus reporting, so forged mail using your domain can be turned away instead of trusted by default.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is DMARC used for?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>DMARC is used for two things: stopping other people from spoofing your domain in scam and phishing emails, and improving the deliverability of your own legitimate mail. With an enforcing DMARC policy, receivers reject messages that forge your domain, and because your genuine mail authenticates and aligns, mailbox providers are more likely to place it in the inbox rather than the spam folder.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-3\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How does DMARC work?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>When a message arrives, the receiver runs SPF and DKIM, then DMARC checks that a passing result aligns with the domain in the visible From address. If it aligns, the mail is trusted; if it fails, the receiver applies the policy you published \u2014 none, quarantine, or reject. Alignment is the key idea: an attacker can pass SPF or DKIM on their own domain, but they cannot make it align with yours.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-4\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is a DMARC record?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>A DMARC record is a single DNS TXT record published at _dmarc.yourdomain.com. A basic monitoring record looks like v=DMARC1; p=none; rua=mailto:you@yourdomain.com, where p= is the policy and rua= is the address that receives the daily aggregate reports. You tighten p= from none to quarantine to reject as your legitimate senders are confirmed to pass.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-5\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What is the difference between DMARC, SPF, and DKIM?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>SPF and DKIM are the evidence; DMARC is the verdict and the policy. SPF checks whether a server was authorised to send for the domain, and DKIM verifies a cryptographic signature proving the message was not altered. DMARC sits on top, requires that one of those passes and aligns with the visible From domain, and then enforces your chosen action. The three work as a set \u2014 DMARC has nothing to evaluate without SPF and DKIM.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-6\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">What do p=none, quarantine, and reject mean?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>They are the three DMARC policies. p=none is monitoring only \u2014 nothing is blocked, but you receive reports. p=quarantine sends failing mail to the spam or junk folder. p=reject refuses failing mail outright so it never reaches the inbox. The safe path is to start at none, confirm your legitimate senders pass, then move to quarantine and finally reject for full protection.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-7\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">Do I need DMARC for my email?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>If you send from your own domain, yes \u2014 it is the only way to stop others spoofing that domain, and mailbox providers increasingly treat authentication as a requirement for good deliverability. Even a personal or small-business domain benefits: a monitoring record costs nothing, shows you who is sending in your name, and paves the way to full enforcement. If you only use a free mailbox like Gmail or Outlook, the provider already handles DMARC for its own domain.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-8\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \">How do email aliases relate to DMARC?<\/h3>\n<div class=\"rank-math-answer \">\n\n<p>They cover opposite ends of the same problem. DMARC protects the domain you send from, while an email alias protects the address you hand out by keeping your real inbox private and letting you retire any address that leaks. A good alias service also enforces SPF, DKIM, and DMARC on its alias domains, so forged mail using your alias fails authentication \u2014 the same protection DMARC gives a domain you own, applied to the addresses you give out.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>You have probably seen the acronym in a security guide or a warning from your email provider, so let us answer it plainly. What is DMARC? It is an email&#8230;<\/p>\n","protected":false},"author":3,"featured_media":323,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"rank_math_focus_keyword":"what is dmarc","rank_math_title":"What Is DMARC and Why Your Email Needs It","rank_math_description":"What is DMARC? It is the email standard that stops others spoofing your domain. Here is how it works, what its policies mean, and how to set it up.","_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[5],"tags":[],"class_list":{"0":"post-325","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-security"},"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/what-is-dmarc.jpg?fit=1200%2C630&ssl=1","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":291,"url":"https:\/\/emailalias.io\/blog\/what-is-email-spoofing\/","url_meta":{"origin":325,"position":0},"title":"What Is Email Spoofing?","author":"Troy Hunt","date":"August 17, 2026","format":false,"excerpt":"You get an email that looks like it came from your bank, your boss, or a service you use every day. The sender name is right, the address looks right, and it wants you to click a link or approve a payment. But the message never came from where it\u2026","rel":"","context":"In &quot;Security&quot;","block_context":{"text":"Security","link":"https:\/\/emailalias.io\/blog\/category\/security\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-email-spoofing.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-email-spoofing.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-email-spoofing.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-email-spoofing.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/08\/og-what-is-email-spoofing.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":137,"url":"https:\/\/emailalias.io\/blog\/custom-domain-email-alias\/","url_meta":{"origin":325,"position":1},"title":"Custom Domain Email Alias: Setup, DNS, and Why It Matters","author":"Troy Hunt","date":"June 7, 2026","format":false,"excerpt":"A custom domain email alias is a forwarding address on a domain you own \u2014 something like hello@janedoe.com instead of jane-doe-2026@alias-domain \u2014 that delivers inbound mail to your real inbox without ever exposing it. The domain is yours, the DNS is yours, the address is yours; the alias provider just\u2026","rel":"","context":"In &quot;Email Alias Basics&quot;","block_context":{"text":"Email Alias Basics","link":"https:\/\/emailalias.io\/blog\/category\/email-alias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-custom-domain-email-alias.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":163,"url":"https:\/\/emailalias.io\/blog\/secure-email-forwarding\/","url_meta":{"origin":325,"position":2},"title":"Secure Email Forwarding: How It Works and Why It Matters","author":"Troy Hunt","date":"June 13, 2026","format":false,"excerpt":"Secure email forwarding is the practice of relaying inbound messages through a privacy-aware service that hides your real address from the sender, encrypts the traffic in transit, validates message authenticity, and strips invasive trackers before the message reaches your real inbox. It is the missing layer between \"I gave a\u2026","rel":"","context":"In &quot;Security&quot;","block_context":{"text":"Security","link":"https:\/\/emailalias.io\/blog\/category\/security\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-secure-email-forwarding.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":103,"url":"https:\/\/emailalias.io\/blog\/email-alias-portability-guide\/","url_meta":{"origin":325,"position":3},"title":"Email Alias Portability with a Custom Domain","author":"Troy Hunt","date":"May 31, 2026","format":false,"excerpt":"Email alias portability is the property that lets you move from one alias provider to another without losing your aliases, breaking forwarding, or having to update every service that has your address on file. In 2026 it is the single most important purchase criterion for serious alias users \u2014 more\u2026","rel":"","context":"In &quot;Guides &amp; How-To&quot;","block_context":{"text":"Guides &amp; How-To","link":"https:\/\/emailalias.io\/blog\/category\/guides-how-to\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-email-alias-portability-guide.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-email-alias-portability-guide.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-email-alias-portability-guide.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-email-alias-portability-guide.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/06\/og-email-alias-portability-guide.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":87,"url":"https:\/\/emailalias.io\/blog\/what-is-an-email-forwarding-service\/","url_meta":{"origin":325,"position":4},"title":"What Is an Email Forwarding Service? A 2026 Guide","author":"Troy Hunt","date":"May 28, 2026","format":false,"excerpt":"An email forwarding service is a tool that gives you a public-facing address \u2014 one you can share with websites, retailers, or strangers \u2014 and automatically relays every message that arrives there to your real, private inbox. Done well, it lets you participate in the open internet without ever exposing\u2026","rel":"","context":"In &quot;Email Alias Basics&quot;","block_context":{"text":"Email Alias Basics","link":"https:\/\/emailalias.io\/blog\/category\/email-alias\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-forwarding-service.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-forwarding-service.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-forwarding-service.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-forwarding-service.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/05\/og-what-is-an-email-forwarding-service.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":364,"url":"https:\/\/emailalias.io\/blog\/simplelogin-vs-addy-io-vs-emailalias\/","url_meta":{"origin":325,"position":5},"title":"SimpleLogin vs addy.io vs EmailAlias: 2026 Comparison","author":"Troy Hunt","date":"September 14, 2026","format":false,"excerpt":"The short version All three hide your real inbox behind forwarding aliases \u2014 the differences are price, free-tier generosity, open-source, and each one's standout feature. SimpleLogin is the pick for Proton users and open-source fans; addy.io is the most flexible and cheapest for tinkerers and self-hosters; EmailAlias focuses on a\u2026","rel":"","context":"In &quot;Comparisons&quot;","block_context":{"text":"Comparisons","link":"https:\/\/emailalias.io\/blog\/category\/comparisons\/"},"img":{"alt_text":"SimpleLogin vs addy.io vs EmailAlias compared, shown as three keyed mailboxes","src":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/simplelogin-vs-addy-vs-emailalias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/simplelogin-vs-addy-vs-emailalias.jpg?fit=1200%2C630&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/simplelogin-vs-addy-vs-emailalias.jpg?fit=1200%2C630&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/simplelogin-vs-addy-vs-emailalias.jpg?fit=1200%2C630&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/emailalias.io\/blog\/wp-content\/uploads\/2026\/09\/simplelogin-vs-addy-vs-emailalias.jpg?fit=1200%2C630&ssl=1&resize=1050%2C600 3x"},"classes":[]}],"_links":{"self":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/325","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/comments?post=325"}],"version-history":[{"count":1,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/325\/revisions"}],"predecessor-version":[{"id":326,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/posts\/325\/revisions\/326"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/media\/323"}],"wp:attachment":[{"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/media?parent=325"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/categories?post=325"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/emailalias.io\/blog\/wp-json\/wp\/v2\/tags?post=325"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}