SPF, DKIM and DMARC are three DNS records that together make it much harder for attackers to send email that looks like it came from your domain. Here they are explained in plain terms: SPF says which servers are allowed to send mail for you, DKIM adds a tamper-evident signature to every message, and DMARC tells receiving servers what to do when a message fails those checks and where to send the reports. Set all three up correctly and email spoofing of your domain becomes far harder. Leave them missing or half-configured and almost anyone can forge your address.
What email spoofing is, in plain terms
Email spoofing is when someone sends a message with your domain in the "From" address without your permission. The classic version is an invoice or a payment request that appears to come from your founder or your finance team, aimed at a customer or a colleague who trusts the name they see. Because the original email protocol was never designed to verify the sender, nothing in it stops a stranger from typing your address into the "From" field. SPF, DKIM and DMARC are the layer that was added later to close that gap.
SPF, DKIM and DMARC explained
Each record does one job, and they are strongest together.
- SPF (Sender Policy Framework) is a list, published in your DNS, of the servers allowed to send email for your domain. When a receiving server gets a message, it checks whether the sending server is on that list. If you have ever run an SPF record check and seen a line starting with "v=spf1", that is the record doing its job.
- DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message you send, using a private key that only your mail service holds. The matching public key lives in your DNS, and the receiver uses it to confirm the message really came from you and was not altered on the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the first two together. It tells receiving servers what to do with a message that fails SPF and DKIM, whether to let it through, mark it as spam, or reject it, and it asks them to send you reports so you can see who is sending mail as you. It also checks that the domain SPF or DKIM confirmed matches the From address people actually see, which neither of them checks on its own.
Why missing records quietly hurt you
Two things go wrong when these records are absent or weak. The first is spoofing: without a DMARC policy set to quarantine or reject, a forged message can reach an inbox looking exactly like you. The second is deliverability: legitimate email you send can land in spam because receiving servers cannot confirm it is genuine. A young company sending its first customer emails often meets both problems at once. Publishing the records is usually quick; moving DMARC to full enforcement safely takes a few weeks of watching reports.
A common mistake is setting DMARC to "p=none", which only monitors and never blocks, and then leaving it there for months. Monitoring is the right first step, because it lets you see your real senders before you turn on enforcement. The goal is to move to "quarantine" and then "reject" once you have confirmed your legitimate mail is passing.
How to check and fix your records
You can see the state of your own domain in a minute.
- Check SPF. Use our free SPF record checker to see whether your domain publishes an SPF record. If it does, check by hand that it lists every service that sends mail for you and stays within the ten-lookup limit, because going over that limit quietly breaks SPF.
- Check DMARC. Use the free DMARC checker to see whether you have a DMARC record and whether it is enforced or only monitoring. Then check by hand that it includes a reporting address (rua=), so you actually receive the reports.
- Fix in order. Publish or correct SPF first, enable DKIM in your mail provider such as Google Workspace or Microsoft 365, then add DMARC starting at "p=none" to gather reports before you tighten it.
The UK National Cyber Security Centre publishes clear, vendor-neutral guidance on all three in its email security and anti-spoofing collection if you want the detail behind each setting.
Where email fits in your wider security
Email records are one of the clearest signals of how carefully a domain is set up, which is why they sit alongside things like your HTTP headers and TLS in your Surface Score. They belong to the same family of quiet configuration gaps we cover in secrets, keys and config: nothing about your application code is wrong, and yet the exposure is real. Our free Surface Check reads your email records along with the rest of your public surface and gives your domain an honest A-to-F score in about thirty seconds.
Next steps
Start by checking your SPF and DMARC records with the free tools above, fix anything missing in the order described, then run the full Surface Check to see the rest of what you expose. If you want a person to look at the parts an automated pass cannot reach, including how your application handles authentication and data, that is what a full security review covers. When you are ready, you can get in touch through our website.