Anyone can type your domain into the "From" line of an email. Without the right DNS records, nothing stops a scammer sending invoices, password resets or payment requests that appear to come from you. Three records, SPF, DKIM and DMARC, close that gap, and setting them up usually takes less than an hour.
This guide applies to any domain, whichever platform your website runs on and whichever email provider you use, such as Google Workspace, Microsoft 365, Zoho or your hosting company's mailboxes.
Why email spoofing matters to a website owner
- Your customers get scammed by messages that look like they came from you, and they blame your brand.
- Your real emails land in spam, because Gmail, Outlook and Yahoo now expect authenticated mail, especially from senders who email in bulk.
- Your reputation suffers. Once a domain is used for phishing, it can end up on blocklists.
The three records in plain language
SPF: who may send
SPF is a DNS text record listing the servers allowed to send email for your domain. Receiving servers check the sending server against that list. A typical record looks like v=spf1 include:_spf.google.com ~all. A domain must have only one SPF record, and it must include every service that sends mail for you: your mailbox provider, your newsletter tool, your invoicing system and your website's contact form.
DKIM: a signature that proves the message is genuine
DKIM adds a digital signature to each outgoing message. The matching public key sits in your DNS under a name called a selector, for example google._domainkey.yourdomain.com. If someone alters the message on the way, or sends it without your private key, the signature fails.
DMARC: what to do when checks fail
DMARC ties the two together. It tells receiving servers what to do with messages that fail SPF and DKIM, and it sends you reports about who is using your domain. A starting record looks like v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com.
Step 1: check where you stand today
Run your domain through the SPF, DKIM and DMARC checker. It shows which records exist, flags mistakes such as two SPF records, and tells you what is missing. If you know your DKIM selector, enter it for a full check. You can also look at the raw records with our DNS lookup.
Step 2: list every service that sends your email
Write down every tool that sends mail as your domain: the main mailbox provider, marketing and newsletter software, helpdesk, billing, your site's forms and any server scripts. Missing one is the most common reason legitimate mail fails after tightening the rules.
Step 3: set up SPF and DKIM
- In each provider's settings, find the "domain authentication" or "email authentication" section. It gives you the exact SPF include and DKIM record to add.
- Add them in your DNS provider's panel. Merge everything into a single SPF record.
- Turn on DKIM signing in the provider after the DNS record has appeared.
- Send a test message to a Gmail address and open Show original. It should show SPF and DKIM as
PASS.
Step 4: add DMARC, starting gently
- Monitor: publish
p=nonewith a reporting address. Nothing is blocked, and you start receiving reports. Keep this for two to four weeks. - Quarantine: once legitimate senders all pass, move to
p=quarantineso failing messages go to spam. - Reject: finally use
p=rejectso spoofed messages are refused outright.
Moving straight to reject before you have checked the reports can block your own invoices or newsletters, so take the stages in order.
Common mistakes
- Two or more SPF records on one domain. Only one is allowed, so merge them.
- Going over the SPF limit of 10 DNS lookups, which makes the record fail.
- Ending SPF with
+all, which allows anyone to send. - Forgetting subdomains or a new tool added after the original setup.
- Publishing DMARC with no reporting address, so you never see problems.
Common questions
Do I need all three?
Yes. SPF and DKIM prove a message is genuine, and DMARC makes receivers act on the result and reports abuse back to you.
Will this stop all phishing against my customers?
It stops others sending mail from your exact domain. It does not stop look-alike domains such as a similar spelling, so watch for those separately.
How long do DNS changes take?
Often minutes, but allow up to 24 to 48 hours for a change to reach everyone.
Free tools for this problem
- SPF, DKIM and DMARC checker: Check SPF, DKIM, DMARC and MX records so your email reaches the inbox.
- DNS lookup: A, AAAA, MX, NS, TXT, SOA and CAA records, with a propagation check.
- Domain expiry checker: Expiry date, registrar, status, name servers and domain age.