Scan your site

Stop people sending email as your business: SPF, DKIM and DMARC

Last updated

By the FocalScore team at Astrolabix LLC. First published . Sources last checked .

The short answer

Three short DNS records let receiving mail servers tell real email from your business apart from forgeries. SPF lists who may send for your domain, DKIM signs your messages, and DMARC tells receivers what to do with mail that fails and sends you reports. Add SPF and DKIM through your email provider, start DMARC in monitoring mode, read the reports, then tighten it.

What SPF, DKIM and DMARC are

Why it matters to a small business

Without these records anyone can send email that claims to come from your address: a fake invoice to your customers, a change of bank details to a supplier. Receiving providers check these records, and mail from a domain without them is more likely to be treated as suspicious, including your own real messages. Setting them up costs nothing but a few DNS entries.

How the free scan decides

The scan looks up your domain's DNS records:

Setting them up, by email provider

Each record is added where your domain's DNS is managed. That is not always where you bought the domain: if your site sits behind Cloudflare, for example, the records go in Cloudflare. Change only the records named here, and keep a note of anything you replace.

Google Workspace

  1. SPF: a TXT record on the domain itself (often entered as @) with the value v=spf1 include:_spf.google.com ~all.
  2. DKIM: in the Google Admin console, generate the DKIM key for your domain, add it as the TXT record it shows (named google._domainkey by default), then return to the console and start authentication. Google's DKIM steps walk through it.
  3. DMARC: a TXT record named _dmarc, starting in monitoring mode (below). Google's DMARC page explains each part.

Microsoft 365

  1. SPF: a TXT record on the domain with v=spf1 include:spf.protection.outlook.com -all.
  2. DKIM: Microsoft gives you two CNAME records, selector1._domainkey and selector2._domainkey, whose values are unique to your organisation. Add them as shown in the Defender portal, then switch DKIM signing on there. Microsoft's DKIM steps show where.
  3. DMARC: a TXT record named _dmarc, as below; Microsoft's DMARC page covers the details.

Other providers, and services that send for you

Your provider's help pages give its SPF include: and its DKIM records. For each extra service that sends as your domain, add its include: to the same SPF record and set up its DKIM in that service's settings. Two rules from RFC 7208 trip people up: a domain must have only one SPF record (merge them; two are an error), and checking one may need no more than ten DNS lookups, so don't keep adding services you no longer use.

Type  Name     Value
TXT   @        v=spf1 include:_spf.google.com include:servers.newsletter-tool.example ~all
TXT   _dmarc   v=DMARC1; p=none; rua=mailto:dmarc-reports@yoursite.com

A domain that never sends email can be forged too, so tell receivers it sends nothing: publish v=spf1 -all and v=DMARC1; p=reject on it.

Tightening DMARC safely

  1. Start with p=none and a rua=mailto: address you read. Receivers then send daily summary reports listing the servers that sent mail as your domain.
  2. Read the reports. Any service of yours that fails SPF or DKIM needs adding to SPF or setting up with DKIM; anything you don't recognise is either a service someone forgot or a forger.
  3. When the reports show only your own services passing, change to p=quarantine, which sends failing mail to spam.
  4. When that has run cleanly, change to p=reject, which refuses forged mail outright.

Going straight to p=reject before step 2 can stop your own invoices or contact-form emails arriving, because a service you forgot to list fails too.

Three more records: MTA-STS, TLS-RPT and CAA

How to check yours

Run the free scan: the Security section shows the SPF, DMARC, MTA-STS and CAA records it found and what each one is missing. The sample report shows the layout. To test a real message, send one from your domain to a personal Gmail address, open it, and choose Show original: it lists SPF, DKIM and DMARC as PASS or FAIL. For your website's own settings, see the security settings guide.

Checklist

What the free scan checks for this

These are the FocalScore checks that cover this guide's subject. Each one in your report says what it found, shows the evidence and gives the fix.

Sources

Last checked . Documentation, settings and rules change; if one of these pages now says something different, it is right and this guide is out of date. Tell us at info@focalscore.com.

  1. RFC 7208: Sender Policy Framework (SPF)
  2. RFC 7489: DMARC
  3. Google Workspace Admin Help: Set up DKIM
  4. Google Workspace Admin Help: Set up DMARC
  5. Microsoft Learn: Set up DKIM for your Microsoft 365 domain
  6. Microsoft Learn: Set up DMARC for your Microsoft 365 domain
  7. RFC 8659: DNS Certification Authority Authorization (CAA)