SPF, DKIM, and DMARC Explained: A Practical Guide to Email Authentication

·1 views

A developer who builds a transactional email API has published a detailed, practitioner-focused guide to the three core email authentication mechanisms: SPF, DKIM, and DMARC. The piece explains that SMTP, designed in 1982, has no built-in authentication, allowing servers to accept unverified sender claims — the root problem these protocols address. DKIM is described as the most reliable mechanism in practice because its cryptographic signature travels with the message, surviving forwarding, unlike SPF which breaks on mailing lists. DMARC ties both mechanisms together by enforcing alignment between the visible From address and the authenticated sending domain, and its governing RFCs were updated on 20 May 2026 when RFC 9989, 9990, and 9991 replaced the 2015 standard. The guide also covers common pitfalls such as DNS TXT record length limits breaking 2048-bit DKIM keys, ESP bounce-domain misalignment causing silent DMARC failures, and the correct rotation sequence for DKIM selectors.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer fixes null-body crash in Formbricks survey SDK flagged by Sentry

A production crash in the Formbricks open-source survey SDK was automatically detected and reported by Sentry as issue FORMBRICKS-CLOUD-3VE. The bug caused an uncaught TypeError in visitors' browsers when the SDK's makeRequest helper attempted to read properties off a null HTTP response body. The same flaw existed in two separate packages — @formbricks/js-core and @formbricks/surveys — leaving the error path entirely unguarded against null or non-JSON responses. Developer Lewis Awe patched both instances by wrapping response.json() calls to handle SyntaxErrors and adding null-safe checks before accessing response properties. Because Formbricks does not accept unsolicited community pull requests, the fix was opened and merged on a personal fork as part of DEV's Summer Bug Smash challenge powered by Sentry.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Video AI APIs silently return durations shorter than requested, developers warned

A software developer has highlighted a systemic issue with video generation APIs, where requesting a specific clip duration — such as 10 seconds — often results in a shorter rendered file with no warning or error returned. The root cause lies in how latent video diffusion models compress frames internally, meaning only certain frame counts are mathematically valid given each model's frame rate and block size. When a requested duration does not align with these legal frame counts, the model silently rounds down to the nearest valid length. This discrepancy becomes a practical problem when multiple clips are assembled into a timeline, causing cumulative sync errors with audio or music. The developer recommends that engineers building on such APIs enumerate valid durations at build time and treat duration as a constrained value rather than a free input.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Swarm Runtime Lets Teams Scale from API Gateway to Multi-Agent AI Without Rewrites

A Rust-based AI runtime called Swarm is designed to eliminate the perceived trade-off between using a lightweight API gateway and a full agent orchestration framework. The tool allows engineering teams to start with a simple OpenAI-compatible proxy and progressively enable more advanced capabilities — such as multi-provider routing, stateful sessions, MCP tool execution, and multi-agent workflows — by changing configuration flags rather than rebuilding infrastructure. Developer teams typically scale their LLM stacks through predictable stages, and Swarm structures these as six configurable 'rungs,' each adding functionality without replacing the underlying runtime. The project is built in pure Rust and aims to avoid the common pattern of patching together separate microservices, vector stores, and evaluation scripts as requirements grow. By keeping the architecture unified, Swarm targets teams that want a production-grade binary at any stage of AI adoption without committing to a full agent framework from day one.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Klick.tools Launches No-Signup QR Code and URL Shortener Platform with Open API

A developer has launched klick.tools, a free web utility platform offering a QR code generator and URL shortener that requires no account creation or email verification. The QR tool supports seven content types, custom styling, and WCAG contrast checking, with all rendering done client-side so no data leaves the user's device. The URL shortener allows link creation in seconds, tracks click statistics, and lets users update destination URLs without reprinting materials. A REST API backs both tools, enabling anonymous use with IP-based rate limiting or authenticated use via API key for higher quotas and full link management. The platform is hosted in Germany, collects no IP logs, sets no tracking cookies, and was designed with GDPR compliance as a core requirement from the outset.

0 comments Read more at DEV Community