SPF, DKIM and DMARC Explained: Stop Email Spoofing of Your Domain
Anyone can send an email that claims to be from [email protected] unless your domain tells receiving mail servers how to verify it. SPF, DKIM and DMARC are the three DNS-based standards that do this. Major mailbox providers also require them from bulk senders.
SPF: who may send
Sender Policy Framework lists the servers allowed to send email for your domain.
example.com. TXT "v=spf1 include:_spf.google.com include:sendgrid.net -all"include:adds a provider's sending servers.-allsays to fail everything else.~allis a softer "softfail."
Pitfalls: SPF allows a maximum of 10 DNS lookups; too many include statements break it. SPF checks the envelope sender, not the visible "From" address, which is why DMARC is needed.
DKIM: was it signed?
DomainKeys Identified Mail adds a cryptographic signature to messages. The receiving server checks it against a public key published in DNS.
selector1._domainkey.example.com. TXT "v=DKIM1; k=rsa; p=MIIBIjANBg..."Each sending service, such as your email provider and marketing tool, should sign with your domain using its own selector. Use 2048-bit keys where supported.
DMARC: what to do on failure
Domain-based Message Authentication, Reporting and Conformance ties SPF and DKIM to the visible From address, tells receivers what to do when checks fail, and sends you reports.
_dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; adkim=s; aspf=s"Policies:
p=none: monitor only.p=quarantine: send failures to spam.p=reject: block failures.
A message passes DMARC if SPF or DKIM passes and aligns with the From domain.
Safe rollout plan
- Inventory every service that sends email as your domain: your mailbox provider, marketing, transactional email, CRM, helpdesk and billing.
- Publish SPF including those services.
- Enable DKIM in each service.
- Publish DMARC with
p=noneand a reporting address. - Review reports for a few weeks, fixing legitimate senders that fail.
- Move to
p=quarantine, thenp=reject.
Do not forget unused domains
Domains that never send email are easy spoofing targets. Protect them with:
example.net. TXT "v=spf1 -all"
_dmarc.example.net. TXT "v=DMARC1; p=reject"Beyond the basics
- MTA-STS and TLS-RPT enforce encrypted delivery to your domain.
- BIMI can display your logo in some inboxes once DMARC is enforced.
Checking your configuration
| Record | Good state |
|---|---|
| SPF | Present, under 10 lookups, ends in -all or ~all |
| DKIM | Enabled for every sender, 2048-bit keys |
| DMARC | p=quarantine or p=reject, with reporting |
| Parked domains | SPF -all and DMARC reject |
SecurityInfinity checks SPF, DKIM and DMARC across your domains as part of attack surface testing, and brand intelligence watches for lookalike domains used in phishing. Start free.
Frequently asked questions
Does DMARC stop all phishing?
It stops exact-domain spoofing. Attackers may still use lookalike domains, so monitor for those too.
Will p=reject block my own emails?
Only if a legitimate sender is not properly configured. That is why you start with p=none and review reports.
Do small companies need DMARC?
Yes. Major mailbox providers increasingly require authentication, and spoofing of small companies is common in invoice fraud.