TechPrufer
Get started
Cloudflare
Cloudflare logoCloudflare · Feature trail

DNS-based Email Security

2 posts · Jul 2012 – Jun 2026

What this trail covers

Cloudflare's DMARC Management has evolved to general availability with a redesigned experience focused on simplifying the path to full DMARC enforcement. This includes deeper report visibility with source investigation, an email authentication record status view, and an SPF lookup audit. The platform aims to provide self-service tools for understanding and improving DMARC posture, mitigating deliverability penalties, and protecting against brand impersonation.

All Cloudflare trails
  1. Cloudflare DMARC Management is now generally availableThis post announces the general availability of Cloudflare DMARC Management with a redesigned user experience. Key enhancements include: 1. Deeper report visibility with source investigation, surfacing source IP addresses and integrating with Cloudflare's Investigate tab for threat intelligence. 2. An email authentication record status view that checks DMARC, DKIM, SPF, and BIMI records, providing pass/warning/fail statuses and actionable recommendations. 3. An SPF lookup audit to identify and resolve issues related to the 10-lookup limit imposed by RFC 7208. The post also reiterates the importance of DMARC, SPF, and DKIM due to recent stricter enforcement by major email providers.
  2. Why Some Phishing Emails Are Mysteriously DisappearingIntroduced a novel technique for combating phishing by dynamically rewriting DMARC records at DNS query time. This involves identifying phishing domains leveraging Cloudflare's DNS, then modifying their DMARC policy to 'reject' all emails and removing SPF/DKIM records. This mechanism leverages the trust model of SMTP and the DNS infrastructure to prevent email delivery from malicious sources.
  3. Changing Internet Standards to Build A Secure InternetThis post details the proposal of a new Internet Draft (draft-ietf-regext-dnsoperator-to-rrr-protocol) to enable DNS operators to communicate with registries and registrars for user-authorized domain changes, specifically to automate DNSSEC DS record updates. It also describes the successful implementation and testing of this protocol with the .dk registry to automatically enable DNSSEC for .dk domains, simplifying the process for domain owners.
  4. The oldest trick in the ASCII bookThis post details a low-level ASCII character manipulation technique using bitwise AND (AND 0xDF) to perform case-insensitive string comparisons. It explains how this trick works by masking out the 0x20 bit, which differentiates uppercase and lowercase ASCII letters. The post provides a C code example for a fast case-insensitive comparison function and highlights its utility in high-performance scenarios like filtering millions of DNS packets per second.
  5. Protecting CloudFlare sites from phishingThis post details Cloudflare's new process for blocking phishing pages. When a phishing URL is identified, Cloudflare notifies the site owner, begins serving a warning page in place of the bad URL, and provides summary information and notifications when site owners log in. This process aims to stop site visitors from falling victim to identity theft, prevent site owners from being penalized for unknowingly hosting phishing content, and quickly notify site owners so they can clean up malicious files.