SPF tells receiving mail servers which IP addresses are authorised to send email for your domain. Without it, anyone can send emails pretending to be you.

The SPF specification limits DNS lookups to 10 per evaluation. Each `include:`, `a:`, `mx:`, and `redirect=` mechanism counts as a lookup. Exceeding this limit causes SPF evaluation to fail with a permanent error (PermError), meaning receiving servers may reject or junk your legitimate emails.

DKIM adds a cryptographic signature to your outgoing emails, proving they haven't been tampered with in transit. The receiving server verifies the signature against a public key published in your DNS.

DMARC tells receiving servers what to do when an email fails SPF and DKIM checks. A policy of `none` only monitors — `quarantine` or `reject` actively protects against spoofing.

Your DMARC policy is set to `none`, which means you're monitoring email authentication failures but not blocking them. Anyone can still send email pretending to be your domain. Consider moving to `quarantine` or `reject` once you've confirmed your legitimate email sources pass authentication.

SSL certificates encrypt the connection between your visitors and your server. An expired or missing certificate causes browsers to show security warnings, blocking visitors from reaching your site.