SPF, DKIM and DMARC explained: stop people from spoofing your domain

01The problem: email has no built-in identity check

The original email system lets a sender write any address in the "From" line. Attackers use this to send fake invoices, password resets and "urgent" requests that look like they come from your company. The messages are not hacked from your servers, they are simply forged.

Three DNS records close this gap. You add them once at your DNS provider, and receiving mail servers such as Gmail and Outlook check them on every message.

02SPF: who may send for you

SPF is a list of the servers that are allowed to send email for your domain. It is a single TXT record on the domain itself.

v=spf1 include:_spf.mx.cloudflare.net -all

Read it left to right: use version 1 of SPF, trust whatever the include lists, and -all means "reject everyone else". ~all is the softer version that marks other mail as suspicious instead of rejecting it.

03DKIM: a signature on every message

With DKIM, your email provider signs each outgoing message with a private key. The matching public key sits in your DNS, so the receiver can verify that the message was not changed and really came through your provider. You normally do not write this record yourself: your provider gives you the exact name and value to paste.

v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...

04DMARC: the policy that ties them together

DMARC tells receivers what to do when a message fails SPF and DKIM checks that align with the visible "From" domain, and where to send reports about it.

v=DMARC1; p=none; rua=mailto:reports@example.com

• p=none: only watch and send reports. Nothing is blocked.
• p=quarantine: suspicious mail goes to spam.
• p=reject: forged mail is refused completely.

05Check your own domain

Type your domain below. The check runs in your browser against public DNS, nothing is stored.

06A safe rollout plan

1. Add or fix your SPF record with ~all.
2. Turn on DKIM in your email provider and publish the record it gives you.
3. Add DMARC with p=none and a reporting address you read.
4. After two to four weeks of clean reports, move to p=quarantine.
5. When you are confident, move to p=reject and change SPF to -all.