Stop Scammers Sending Email in Your Name: SPF, DKIM and DMARC Explained Simply
Fake invoices sent "from" your company are easy to stop. A plain-English guide to SPF, DKIM and DMARC, with the safe order to set them up.
A customer receives an email "from" your company asking them to pay an invoice into a new bank account. It looks real — it even shows your address. This is called email spoofing, and it works because, by default, email does not check who the sender really is.
Three free DNS records fix this: SPF, DKIM and DMARC.
SPF: who is allowed to send
SPF is a list of the servers allowed to send email for your domain — for example your mail server and Google Workspace or Zoho. Receiving mail servers check it. It is one TXT record that starts with v=spf1. Your domain should have only one SPF record.
DKIM: a signature on every email
DKIM adds a digital signature to each email you send. The receiving server checks it against a public key published in your DNS. If anyone changes the email on the way, or forges it, the signature fails. Your email provider gives you the DKIM record to add.
DMARC: what to do with fakes
DMARC tells receiving servers what to do when an email fails SPF and DKIM:
| Policy | What happens to fake emails |
|---|---|
p=none | Delivered normally; you only get reports. Good for the first few weeks. |
p=quarantine | Sent to the spam folder. |
p=reject | Blocked completely. |
A DMARC record looks like: v=DMARC1; p=quarantine; rua=mailto:you@yourdomain.com and is added as a TXT record on the host _dmarc.
The safe order to set them up
- Add SPF listing every service that sends your email (website forms, billing software, newsletters too).
- Turn on DKIM with your email provider.
- Add DMARC with
p=noneand watch for a couple of weeks. - Send a test email to Gmail, open "Show original" and confirm SPF, DKIM and DMARC all say PASS.
- Change DMARC to
p=quarantine, and laterp=reject.
Is your own website healthy? Check SSL, speed, mobile and email security in seconds.
Free website check