The three records that stop email spoofing
Email was designed without any check of who the sender is. Three DNS records fix that, and they only work together:
| Record | What it says | Where |
|---|---|---|
| SPF | Which servers may send mail for the domain. | TXT on example.com |
| DKIM | A public key to verify the digital signature on every mail. | TXT on selector._domainkey.example.com |
| DMARC | What receivers should do when SPF and DKIM fail, and where to send reports. | TXT on _dmarc.example.com |
Without DMARC at quarantine or reject, anyone can send an invoice, password reset or CEO request that shows your exact domain in the From line, and most inboxes will deliver it.
How to get to DMARC p=reject safely
- Publish SPF with every service that sends for you (your mailbox provider, newsletter tool, CRM, invoicing system) ending in
~all. - Turn on DKIM signing in each of those services. They give you the record to add.
- Publish
v=DMARC1; p=none; rua=mailto:dmarc@yourdomainand read the reports for 2 to 4 weeks. - When all your real mail passes, change to
p=quarantine, thenp=reject.
Use the DMARC record generator to write the record.
What the grade means
The score starts at 100. Missing or broken SPF and DMARC cost the most, because they decide whether your domain can be spoofed. A DMARC policy of none, more than 10 SPF lookups, missing DKIM and missing MTA-STS cost less. BIMI never lowers the grade. A or B means spoofing is blocked and the setup is solid. D or F means fake mail from your domain would likely reach the inbox.
Frequently asked questions
What is DMARC?
DMARC (Domain-based Message Authentication, Reporting and Conformance) is a DNS record that tells receiving mail servers what to do with mail that claims to be from your domain but fails SPF and DKIM: deliver it (none), send it to spam (quarantine) or refuse it (reject). It also gives you reports about who sends mail as your domain.
Why does SPF have a 10 lookup limit?
The SPF standard (RFC 7208) allows at most 10 DNS lookups for include, a, mx, ptr, exists and redirect. Each service you add usually costs one or more. Above 10, receivers return a permanent error and SPF fails for all your mail. This checker counts them recursively.
Why can't you find my DKIM record?
DKIM keys live under a selector name that only your mail provider knows. We test 50 common selectors. Open an email you sent, view the original or headers, find DKIM-Signature and the s= value, and enter it under 'DKIM selector'.
Is p=none enough?
No. p=none only collects reports. Fake mail is still delivered. It is the right first step, but you need quarantine or reject to actually stop spoofing.
Do Gmail and Yahoo require DMARC?
Yes. Since February 2024, Gmail and Yahoo require SPF, DKIM and a DMARC record for anyone sending more than 5,000 mails a day to their users, and they strongly favour authenticated mail from all senders.
What are MTA-STS and TLS-RPT?
MTA-STS tells other mail servers that they must use a valid encrypted connection when sending to you, which stops downgrade attacks. TLS-RPT asks them to send you daily reports about encryption problems.
My domain does not send email. Do I need this?
Yes, unused domains are popular for spoofing. Publish 'v=spf1 -all', a DMARC record with p=reject and a null MX record. The checker shows the exact three records.