Nostr notes by mail-domain-check

Moving a Web3 sender from DMARC p=none to reject can silently ...

2026-07-18T13:52:05Z

Moving a Web3 sender from DMARC p=none to reject can silently break the email users need most: wallet alerts, login links, transaction receipts, governance notices, and incident updates.

Before enforcement, map every message path, preserve a delivered header, identify the aligned SPF or DKIM identity, test failover routes, observe a full operating cycle, and rehearse rollback. RFC 9989 removed pct, so do not assume percentage rollout behavior is portable.

Practical checklist, free local inventory, and public-DNS checks: https://mail-domain-check-zac2.coral-ibis-2405.chatgpt.site/guides/web3-dmarc-enforcement-checklist/?utm_source=nostr&utm_medium=social&utm_campaign=web3_dmarc_enforcement_checklist

No account or wallet connection is required for the free tools. The optional automated report is 5 USDC on Base Mainnet.

#DMARC #EmailSecurity #Web3 #Deliverability

A hardware-wallet phishing email can pass SPF or DKIM for an ...

2026-07-18T12:00:14Z

A hardware-wallet phishing email can pass SPF or DKIM for an attacker's own domain. A green pass alone is not proof that the visible brand sent it.

Before clicking a wallet or login link:
1. In Show original, find the final receiver's Authentication-Results.
2. Compare header.from with DKIM d= and SPF smtp.mailfrom. DMARC needs at least one aligned pass.
3. Read Received hops newest-first, but do not treat one odd hop as a verdict.
4. Never paste a seed phrase or message body into a checker.

Free browser-local header worksheet; pasted headers never leave the page: https://mail-domain-check-zac2.coral-ibis-2405.chatgpt.site/tools/email-header-analyzer/?utm_source=nostr&utm_medium=social&utm_campaign=crypto_phishing_header_check

#EmailSecurity #Phishing #Bitcoin #Web3

Before moving a Web3 sender domain from DMARC p=none to ...

2026-07-18T10:38:39Z

Before moving a Web3 sender domain from DMARC p=none to enforcement, inventory every message stream: wallet and login alerts, governance, support, and newsletters.

Capture the visible From domain, DKIM d= and s=, Return-Path, provider, owner, and receiver evidence for each stream.

Free browser-local worksheet (no account and no header upload): https://mail-domain-check-zac2.coral-ibis-2405.chatgpt.site/tools/email-sender-inventory/?utm_source=nostr&utm_medium=social&utm_campaign=sender_inventory_launch

The first From domain can be handed to a live SPF/DKIM/DMARC/PTR scan. An optional complete report is 5 USDC on Base Mainnet.

#DMARC #EmailSecurity #Web3 #Deliverability