How do I stop people sending email that looks like it came from my domain?
Three DNS records. Without them anyone can forge your address, including to your own customers — and this applies even if you never send email.
Publish SPF, DKIM and DMARC records. SPF lists who may send for you, DKIM signs your messages, and DMARC tells receivers what to do when either fails. Without DMARC the first two achieve very little.
The problem
The "from" address on an email is not verified by the protocol. Anyone can send a message claiming to be billing@yourcompany.com, and without the records below a receiving server has no way to tell it is forged. This is the mechanism behind most invoice fraud and a great deal of phishing.
It applies to domains that never send email at all. If you have not published anything, your domain is an attractive vehicle precisely because there is nothing to check against.
SPF: who may send
v=spf1 include:_spf.google.com include:sendgrid.net -allA TXT record at your domain apex listing the servers permitted to send for you. The ending matters most:
-all— hard fail. Anything not listed should be rejected. This is what you want.~all— soft fail. Suspicious but accepted. A reasonable staging post.?allor+all— effectively no protection at all.
Two constraints that catch people: only one SPF record per domain — two is a permanent error and receivers discard both — and a limit of ten DNS-querying mechanisms. Exceed it and evaluation fails entirely.
If you never send mail, publish this and you are done with SPF:
v=spf1 -allDKIM: cryptographic signing
DKIM adds a signature header to outgoing mail, verifiable against a public key in your DNS. It survives forwarding, which SPF often does not, and it proves the message body was not altered.
Your email provider generates the key pair and gives you a DNS record to publish at a selector name such as selector1._domainkey.yourdomain.com. Every provider you send through needs its own.
DMARC: the one that makes them work
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comPublished at _dmarc.yourdomain.com. It tells receivers what to do when SPF and DKIM fail, and asks them to send you reports about attempts.
Without DMARC, an SPF failure is advisory — the receiving server decides what to do and often delivers anyway. DMARC is what converts your records into enforcement.
| Policy | Effect |
|---|---|
p=none | Monitor only. Collect reports, change nothing. Where you start. |
p=quarantine | Failing mail goes to spam. |
p=reject | Failing mail is refused outright. The destination. |
Rolling it out without losing mail
- Publish DMARC with
p=noneand a reporting address. - Read the reports for two to four weeks. You will discover senders you had forgotten — a CRM, a helpdesk, a newsletter tool.
- Add every legitimate sender to SPF and set up DKIM for each.
- Move to
p=quarantine, optionally withpct=25to phase it in. - Watch, then raise to
p=reject.
p=reject. Nearly every organisation has a sender nobody remembered — the invoicing system, the recruitment platform, the marketing tool set up three years ago. Going straight to reject means their mail silently disappears, and the reports are how you find them before that happens.What our audit reports about this
Every item below is measured directly, not inferred. Run it against your own site and the result names the exact rule or header responsible.
- SPF: presence, whether more than one record exists, the all-mechanism, and the DNS lookup count against the limit of ten.
- DMARC: presence, policy, subdomain policy, percentage and reporting address.
- MX records, and whether the domain is configured to receive mail at all.
- DKIM reported as not tested, with the reason — selectors are not discoverable from DNS, so guessing them would produce false findings.
For agents and scripts, the same measurement is at
/api/v1/dns?url=yoursite.com —
see the API documentation.
Related questions
Do I need this if my domain does not send email?
Yes, and it is easier. Publish v=spf1 -all and a DMARC record with p=reject. That states plainly that nothing legitimate comes from this domain, which makes forgery straightforward to reject.
Why is DKIM not checked automatically by scanners?
DKIM keys live at a selector name chosen by the sender, and selectors are not enumerable from DNS. A scanner can only guess common ones, and a guess that misses looks identical to DKIM being absent. Reporting that as a failure would be a false finding.
What breaks when I set p=reject?
Mail from any sender not covered by SPF or DKIM. In practice that means services you set up and forgot. Run p=none first and read the reports; that is exactly what they are for.
Read next
What are SPF, DKIM and DMARC?
Three DNS records that together decide whether your email arrives and whether anyone can forge it. What each one does, in plain terms.
ReadWhat is a CAA record and do I need one?
A DNS record naming which certificate authorities may issue certificates for your domain. One line, and it closes a real gap.
ReadIs my website secure? How do I check?
What you can verify yourself in twenty minutes, what needs tooling, and what "secure" does and does not mean.
ReadShould I put my email address on my website?
Yes. The spam argument is weaker than it was, and being uncontactable costs more than the spam does.
Read