llms.txt
+41 −35
https://www.clientposture.com/llms.txt
− - [Client Posture](https://www.clientposture.com/): Turn any domain into a signed client. Free passive scan, a branded Security Brief, and a Good / Better / Best proposal your client accepts online. Built for MSPs.− - [Free email security tools](https://www.clientposture.com/tools): Ungated DMARC, SPF, and DKIM checkers plus an email grade and cyber-insurance email questions. Same engine as Client Posture. No email required for results.− - [Free DMARC checker](https://www.clientposture.com/tools/dmarc-checker): See whether a domain’s DMARC record is monitor-only or enforcing. We parse p=, t=, and rua (pct is historic), then give the next DNS record and the none → quarantine → reject path.− - [Free SPF checker](https://www.clientposture.com/tools/spf-checker): Count every DNS lookup toward the RFC 7208 limit of 10, name the services in the include chain, and get a flatten or cleanup suggestion when the record would void.− - [Cyber insurance email controls](https://www.clientposture.com/tools/insurance-email-controls): Map public DNS to the email questions carriers actually ask. Every answer is Verified, Unknown, or Not tested, with a paste-ready evidence line. Not insurance advice.− - [DMARC p=none: What It Means and How to Reach Reject](https://www.clientposture.com/guides/dmarc-p-none): DMARC p=none only monitors. Learn the real risk, how rua and ruf reports work, what changed with pct in RFC 9989, and a safe path to quarantine and reject.− - [SPF PermError: Too Many DNS Lookups (10-Lookup Limit Fix)](https://www.clientposture.com/guides/spf-too-many-dns-lookups): Why SPF hits permerror past 10 DNS lookups or 2 void lookups (RFC 7208), how to count them, and fixes: drop unused includes, use subdomains, flatten.− - [Microsoft 365 SPF Record: include:spf.protection.outlook.com](https://www.clientposture.com/guides/spf-microsoft-365): The correct Microsoft 365 SPF record, when to use -all, GCC High and 21Vianet variants, merging other senders into one record, and why not to flatten it.− - [Google Workspace SPF Record: include:_spf.google.com](https://www.clientposture.com/guides/spf-google-workspace): The Google Workspace SPF record, merging other senders into one TXT record, ~all vs -all, the 10-lookup limit, and the DKIM and DMARC steps that come next.− - [Zoho Mail SPF Record: include:zohomail.com and Regions](https://www.clientposture.com/guides/spf-zoho-mail): The Zoho Mail SPF include, why the value can depend on your Zoho data center, include:one.zoho.com for multiple Zoho apps, and merging into one record.− - [Cyber Insurance Email Controls: MFA, DMARC, SPF and DKIM](https://www.clientposture.com/guides/cyber-insurance-email-controls): What cyber insurance applications commonly ask about email security (MFA, DMARC, SPF, DKIM, filtering), quoted from insurer forms, and how MSPs can help.− - [Amazon SES SPF Include: Custom MAIL FROM Setup Guide](https://www.clientposture.com/guides/amazon-ses-spf-include): Why include:amazonses.com goes on a custom MAIL FROM subdomain, not your apex, plus the MX record SES needs and how SPF and DKIM align for DMARC.− - [At-Bay Cyber Application: Email Security Questions (06/2026)](https://www.clientposture.com/guides/at-bay-cyber-insurance-email-controls): What At-Bay's Cyber Short Application (AB-CYB-SAP 06/2026) asks about email: domains, MFA on all email access, and an optional email gateway question.− - [Beazley Ransomware Supplement F00765: Email Questions](https://www.clientposture.com/guides/beazley-cyber-insurance-email-controls): What Beazley's ransomware supplemental form F00765 (052022 ed.) asks about incoming email, DKIM, SPF, DMARC, web email MFA and legacy protocols, for MSPs.− - [Chubb Australia Cyber Proposal Form (11/2023): Email](https://www.clientposture.com/guides/chubb-cyber-insurance-email-controls): What Chubb Australia's Short MarketPlace Cyber Proposal Form (Published 11/2023) asks about email security and MFA, and how MSPs can help clients answer.− - [Corvus Smart Cyber Application v3.2: Email Questions](https://www.clientposture.com/guides/corvus-cyber-insurance-email-controls): What the Corvus Smart Cyber Insurance Application (Version 3.2, September 2024) asks about email filtering, secure email gateways, MFA and payment checks.− - [DKIM Body Hash Did Not Verify: What Changed the Message](https://www.clientposture.com/guides/dkim-body-hash-did-not-verify): 'Body hash did not verify' means the body changed after signing. Usual culprits: footers, disclaimers, lists, re-encoding. How to find the hop and fix it.− - [DKIM Signature Did Not Verify: Causes and How to Fix It](https://www.clientposture.com/guides/dkim-signature-verification-failed): What 'DKIM signature verification failed' means under RFC 6376, how it differs from a body hash failure, and the key, DNS and header causes to check first.− - [DMARC Fail: SPF and DKIM Pass but Not Aligned (Fix Guide)](https://www.clientposture.com/guides/dmarc-fail-not-aligned): Why mail fails DMARC when SPF and DKIM both pass: identifier alignment under RFC 9989, how to read the headers, and the usual fixes for SaaS senders.− - [DMARC p=quarantine: What It Means and When to Use It](https://www.clientposture.com/guides/dmarc-p-quarantine): What DMARC p=quarantine asks receivers to do, how it differs from none and reject, testing with t=y under RFC 9989 (pct is historic), and a safe rollout.− - [HubSpot SPF Include: Connecting an Email Sending Domain](https://www.clientposture.com/guides/hubspot-spf-include): HubSpot generates an account-specific SPF include, two DKIM CNAMEs, an MX and a DMARC record. Where each goes, how to merge SPF, and what to verify.− - [Mailchimp & Mandrill SPF Include: What the Docs Say Now](https://www.clientposture.com/guides/mailchimp-spf-include): Mailchimp's current setup asks for 2 DKIM CNAMEs and a DMARC record, not an SPF include. Mandrill's DKIM CNAMEs and custom return-path, explained.− - [Mailgun SPF Include: include:mailgun.org Setup Guide](https://www.clientposture.com/guides/mailgun-spf-include): Mailgun's documented SPF record, where it goes, the DKIM, MX and tracking records beside it, and why include:mailgun.org costs more lookups than it looks.− - [Mimecast SPF Include: Regional _netblocks Records Explained](https://www.clientposture.com/guides/mimecast-spf-include): Which Mimecast SPF include to use by region, why the global _netblocks include costs extra lookups, the newer mimecastprotect.com records, and the mx trap.− - [No DMARC Record Found: What It Means and How to Fix It](https://www.clientposture.com/guides/no-dmarc-record-found): Why a checker says 'no DMARC record found': missing _dmarc TXT, duplicate records, bad v= tag, or a DNS error. What RFC 9989 says, and a safe first record.− - [Postmark SPF Include: Why You Use a Return-Path Instead](https://www.clientposture.com/guides/postmark-spf-include): Postmark says you no longer need it in your SPF record. Here's the custom Return-Path CNAME that gives aligned SPF, and why include:spf.mtasv.net won't.− - [Proofpoint Essentials SPF Record: dispatch vs _spf Include](https://www.clientposture.com/guides/proofpoint-spf-include): Proofpoint Essentials SPF for outbound relay: the a:dispatch-us entry in Proofpoint's guides, the newer _spf-us include in live DNS, and how to merge them.− - [QuickBooks SPF Include: Why Intuit Doesn't Publish One](https://www.clientposture.com/guides/quickbooks-spf-include): QuickBooks Online sends invoices via Intuit or a connected Gmail account. Intuit documents no SPF include. What to check, and why not include:intuit.com.− - [Salesforce SPF Include: _spf.salesforce.com and DMARC](https://www.clientposture.com/guides/salesforce-spf-include): Salesforce's documented SPF entry is include:_spf.salesforce.com, but default bounce settings stop SPF aligning. Why DKIM is Salesforce's preferred fix.− - [SendGrid SPF Include: Automated Security vs Manual Setup](https://www.clientposture.com/guides/sendgrid-spf-include): When SendGrid needs include:sendgrid.net and when its CNAMEs handle SPF for you, where the record goes, and how it aligns for DMARC. Per Twilio docs.− - [SPF PermError: Multiple Records, Syntax Errors and Fixes](https://www.clientposture.com/guides/spf-permerror): SPF permerror beyond the lookup limit: two v=spf1 records, syntax typos, bad ip4 ranges, dead includes, duplicate redirects. What RFC 7208 says, and fixes.− - [SPF Softfail vs Fail: ~all or -all, and What Receivers Do](https://www.clientposture.com/guides/spf-softfail-vs-fail): SPF softfail (~all) vs fail (-all) per RFC 7208: what each result tells a receiver, how DMARC treats them, why -all can bypass DMARC, and which to pick.− - [Travelers MFA Supplement CYB-14306: Email Questions](https://www.clientposture.com/guides/travelers-cyber-insurance-email-controls): What the Travelers Multi-Factor Authentication Supplement, CYB-14306 Rev. 03-23, asks about email and admin MFA, how answers work, and how MSPs can prep.− - [Zendesk SPF Include: include:mail.zendesk.com Explained](https://www.clientposture.com/guides/zendesk-spf-include): Zendesk's recommended SPF record, the first-layer rule, outdated includes to replace, and the DKIM CNAMEs that let support mail pass DMARC.− - [Client Posture comparisons](https://www.clientposture.com/compare): How Client Posture's passive external checks compare with Network Detective Pro, ConnectSecure and Galactic, and when to use each.+ - [Client Posture](https://www.clientposture.com/): Turn any domain into a signed client. Free passive scan and a branded Security Brief. On Pro, send a Good / Better / Best proposal they accept online.+ - [About](https://www.clientposture.com/about): Learn how Client Posture works, how passive public-data scans run without agents or credentials, and who operates the service.+ - [Free email security tools](https://www.clientposture.com/tools): Free DMARC, SPF, DKIM, and AI vendor DNS checkers, plus an email grade and insurance questions. Same engine as Client Posture. No email required.+ - [Free DMARC checker](https://www.clientposture.com/tools/dmarc-checker): See whether a domain’s DMARC record is monitor-only or enforcing. We parse p=, t=, and rua, then suggest the next record and a none → quarantine → reject path.+ - [Free SPF checker](https://www.clientposture.com/tools/spf-checker): Count every DNS lookup toward the RFC 7208 limit of 10, name the include-chain services, and get a flatten or cleanup suggestion if the record would void.+ - [Cyber insurance email controls](https://www.clientposture.com/tools/insurance-email-controls): Map public DNS to the email questions carriers ask. Answers are Verified, Unknown, or Not tested, with a paste-ready evidence line. Not insurance advice.+ - [Free AI footprint check](https://www.clientposture.com/tools/ai-footprint): See which AI vendors a domain has published a public DNS verification record for, such as OpenAI or Anthropic. One passive lookup. Records, not usage.+ - [DMARC p=none: meaning and path to reject](https://www.clientposture.com/guides/dmarc-p-none): DMARC p=none only monitors. Learn the real risk, how rua and ruf reports work, what changed with pct in RFC 9989, and a safe path to quarantine and reject.+ - [SPF PermError: too many DNS lookups](https://www.clientposture.com/guides/spf-too-many-dns-lookups): Why SPF hits permerror past 10 DNS lookups or 2 void lookups (RFC 7208), how to count them, and fixes: drop unused includes, use subdomains, flatten.+ - [Microsoft 365 SPF record and include](https://www.clientposture.com/guides/spf-microsoft-365): The correct Microsoft 365 SPF record, when to use -all, GCC High and 21Vianet variants, merging other senders into one record, and why not to flatten it.+ - [Google Workspace SPF include record](https://www.clientposture.com/guides/spf-google-workspace): The Google Workspace SPF record, merging other senders into one TXT record, ~all vs -all, the 10-lookup limit, and the DKIM and DMARC steps that come next.+ - [Zoho Mail SPF include and regions](https://www.clientposture.com/guides/spf-zoho-mail): The Zoho Mail SPF include, why the value can depend on your Zoho data center, include:one.zoho.com for multiple Zoho apps, and merging into one record.+ - [Cyber insurance email controls for MSPs](https://www.clientposture.com/guides/cyber-insurance-email-controls): What cyber insurance applications commonly ask about email security (MFA, DMARC, SPF, DKIM, filtering), quoted from insurer forms, and how MSPs can help.+ - [Amazon SES SPF: custom MAIL FROM setup](https://www.clientposture.com/guides/amazon-ses-spf-include): Why include:amazonses.com goes on a custom MAIL FROM subdomain, not your apex, plus the MX record SES needs and how SPF and DKIM align for DMARC.+ - [At-Bay cyber app email questions (06/2026)](https://www.clientposture.com/guides/at-bay-cyber-insurance-email-controls): What At-Bay's Cyber Short Application (AB-CYB-SAP 06/2026) asks about email: domains, MFA on all email access, and an optional email gateway question.+ - [Beazley F00765: email security questions](https://www.clientposture.com/guides/beazley-cyber-insurance-email-controls): What Beazley's ransomware supplemental form F00765 (052022 ed.) asks about incoming email, DKIM, SPF, DMARC, web email MFA and legacy protocols, for MSPs.+ - [Chubb Australia cyber form (11/2023): email](https://www.clientposture.com/guides/chubb-cyber-insurance-email-controls): What Chubb Australia's Short MarketPlace Cyber Proposal Form (Published 11/2023) asks about email security and MFA, and how MSPs can help clients answer.+ - [Corvus Smart Cyber v3.2 email questions](https://www.clientposture.com/guides/corvus-cyber-insurance-email-controls): What the Corvus Smart Cyber Insurance Application (Version 3.2, September 2024) asks about email filtering, secure email gateways, MFA and payment checks.+ - [DKIM body hash did not verify: causes](https://www.clientposture.com/guides/dkim-body-hash-did-not-verify): 'Body hash did not verify' means the body changed after signing. Usual culprits: footers, disclaimers, lists, re-encoding. How to find the hop and fix it.+ - [DKIM signature did not verify: fixes](https://www.clientposture.com/guides/dkim-signature-verification-failed): What 'DKIM signature verification failed' means under RFC 6376, how it differs from a body hash failure, and the key, DNS and header causes to check first.+ - [DMARC fail: SPF and DKIM not aligned](https://www.clientposture.com/guides/dmarc-fail-not-aligned): Why mail fails DMARC when SPF and DKIM both pass: identifier alignment under RFC 9989, how to read the headers, and the usual fixes for SaaS senders.+ - [DMARC p=quarantine: meaning and rollout](https://www.clientposture.com/guides/dmarc-p-quarantine): What DMARC p=quarantine asks receivers to do, how it differs from none and reject, testing with t=y under RFC 9989 (pct is historic), and a safe rollout.+ - [HubSpot SPF include for sending domains](https://www.clientposture.com/guides/hubspot-spf-include): HubSpot generates an account-specific SPF include, two DKIM CNAMEs, an MX and a DMARC record. Where each goes, how to merge SPF, and what to verify.+ - [Mailchimp and Mandrill SPF: current docs](https://www.clientposture.com/guides/mailchimp-spf-include): Mailchimp's current setup asks for 2 DKIM CNAMEs and a DMARC record, not an SPF include. Mandrill's DKIM CNAMEs and custom return-path, explained.+ - [Mailgun SPF include: include:mailgun.org](https://www.clientposture.com/guides/mailgun-spf-include): Mailgun's documented SPF record, where it goes, the DKIM, MX and tracking records beside it, and why include:mailgun.org costs more lookups than it looks.+ - [Mimecast SPF: regional _netblocks includes](https://www.clientposture.com/guides/mimecast-spf-include): Which Mimecast SPF include to use by region, why the global _netblocks include costs extra lookups, the newer mimecastprotect.com records, and the mx trap.+ - [No DMARC record found: meaning and fix](https://www.clientposture.com/guides/no-dmarc-record-found): Why a checker says 'no DMARC record found': missing _dmarc TXT, duplicate records, bad v= tag, or a DNS error. What RFC 9989 says, and a safe first record.+ - [Postmark SPF: use a Return-Path instead](https://www.clientposture.com/guides/postmark-spf-include): Postmark says you no longer need it in your SPF record. Here's the custom Return-Path CNAME that gives aligned SPF, and why include:spf.mtasv.net won't.+ - [Proofpoint Essentials SPF: dispatch vs _spf](https://www.clientposture.com/guides/proofpoint-spf-include): Proofpoint Essentials SPF for outbound relay: the a:dispatch-us entry in Proofpoint's guides, the newer _spf-us include in live DNS, and how to merge them.+ - [QuickBooks SPF: why Intuit has no include](https://www.clientposture.com/guides/quickbooks-spf-include): QuickBooks Online sends invoices via Intuit or a connected Gmail account. Intuit documents no SPF include. What to check, and why not include:intuit.com.+ - [Salesforce SPF: _spf.salesforce.com](https://www.clientposture.com/guides/salesforce-spf-include): Salesforce's documented SPF entry is include:_spf.salesforce.com, but default bounce settings stop SPF aligning. Why DKIM is Salesforce's preferred fix.+ - [SendGrid SPF: automated vs manual setup](https://www.clientposture.com/guides/sendgrid-spf-include): When SendGrid needs include:sendgrid.net and when its CNAMEs handle SPF for you, where the record goes, and how it aligns for DMARC. Per Twilio docs.+ - [SPF PermError: multiple records and syntax](https://www.clientposture.com/guides/spf-permerror): SPF permerror beyond the lookup limit: two v=spf1 records, syntax typos, bad ip4 ranges, dead includes, duplicate redirects. What RFC 7208 says, and fixes.+ - [SPF softfail vs fail: ~all or -all](https://www.clientposture.com/guides/spf-softfail-vs-fail): SPF softfail (~all) vs fail (-all) per RFC 7208: what each result tells a receiver, how DMARC treats them, why -all can bypass DMARC, and which to pick.+ - [Travelers CYB-14306 MFA email questions](https://www.clientposture.com/guides/travelers-cyber-insurance-email-controls): What the Travelers Multi-Factor Authentication Supplement, CYB-14306 Rev. 03-23, asks about email and admin MFA, how answers work, and how MSPs can prep.+ - [Zendesk SPF include: mail.zendesk.com](https://www.clientposture.com/guides/zendesk-spf-include): Zendesk's recommended SPF record, the first-layer rule, outdated includes to replace, and the DKIM CNAMEs that let support mail pass DMARC.+ - [Client Posture comparisons](https://www.clientposture.com/compare): How Client Posture's passive external checks compare with Hookgap, Network Detective Pro, ConnectSecure, and Galactic, and when to use each.+ - [Client Posture vs Hookgap](https://www.clientposture.com/compare/hookgap): Client Posture vs Hookgap: both run passive white-label checks. Hookgap focuses on branded prospect reports; proposals and the Service Library are on Pro.+ ## Blog+ - [Client Posture blog](https://www.clientposture.com/blog): Practical how-tos for MSPs on email authentication, DNS, and passive security assessments of client and prospect domains.