Why this matters for a website owner
Email was designed without any check of who the sender is. Phishing emails pretending to be from your business, invoice fraud and password-reset scams all use this. Mail providers now use SPF, DKIM and DMARC to decide whether a message claiming to be from your domain is genuine, and many reject or spam-folder mail from domains that do not publish them.
SPF: which servers may send for you
SPF is a TXT record on your domain listing the servers allowed to send its email. A receiving server checks whether the sending server is on the list.
Example: v=spf1 include:_spf.google.com include:sendgrid.net ~all. The include: parts come from your email and newsletter providers; ~all marks everything else as suspicious (-all rejects it). Keep one SPF record per domain and stay under 10 DNS lookups.
DKIM: a signature on every message
DKIM adds a cryptographic signature to outgoing mail. Your email provider gives you a public key to publish as a DNS record (at a name like selector._domainkey.example.com), and receivers use it to check that the message really came from a server holding the private key and was not changed on the way.
DMARC: what to do when checks fail
DMARC is a TXT record at _dmarc.example.com that tells receivers what to do with mail that fails SPF and DKIM for your domain, and where to send reports.
p=none: only report; nothing is blocked. Start here.p=quarantine: send failing mail to spam.p=reject: refuse failing mail. The goal once reports look clean.
Example: v=DMARC1; p=none; rua=mailto:dmarc@example.com. The rua address receives daily summary reports from large mail providers.
How the three work together
Imagine a message arrives claiming to be from billing@example.com. The receiving server checks SPF: is the sending server on example.com's list? It checks DKIM: does the message carry a valid signature for a domain? Then DMARC asks the key question: does at least one of those passing checks belong to the same domain as the visible From address? If yes, the message is treated as genuine. If not, the receiver follows your DMARC policy and reports the result to you. This alignment step is what stops a spammer who passes SPF for their own domain from putting yours in the From line.
A safe order to set them up
- List every service that sends email as your domain: your mailbox provider, newsletter tool, shop, CRM, invoicing and website contact forms.
- Publish SPF with all of them, and turn on DKIM in each service that supports it.
- Publish DMARC with
p=noneand a report address. Watch the reports for two to four weeks. - Fix any legitimate sender that fails, then move to
p=quarantine, and laterp=reject. - Domains that never send email should publish
v=spf1 -alland a DMARC record withp=reject, so they cannot be spoofed either.
Common mistakes
- Two SPF records. A domain may have only one; with two, receivers treat SPF as broken. Merge them into one record with several
include:parts. - Too many lookups. SPF allows at most 10 DNS lookups. Each
include:,a,mxandredirectcounts, including the ones inside the providers' own records. Remove services you no longer use. - Forgetting a sender. Invoices from an accounting tool or notifications from a shop plugin often send as your domain too. DMARC reports show them before you enforce.
- Staying at `p=none` forever. Monitoring alone stops nothing. Plan the move to quarantine and reject once reports are clean.
- Using `+all` in SPF. It allows every server in the world to send as your domain, the opposite of what SPF is for.
Reading DMARC reports
The daily reports are XML files listing which servers sent mail as your domain, how many messages, and whether SPF and DKIM passed. Large volumes from your own providers that fail usually mean a missing include: or DKIM not switched on. Small volumes from unknown servers that fail are usually spoofing attempts, exactly what p=reject will stop. Free and paid DMARC report services turn the XML into readable dashboards if you do not want to read it yourself.
Checking your domain
A Webforta scan checks your domain's SPF and DMARC records in public DNS and explains anything missing or weak. DKIM is not checked automatically, because its record name depends on a selector only your email provider knows.