Stop email spoofing: how to set up SPF and DMARC

Last reviewed

Email was designed without any way to prove who sent a message. SPF and DMARC are two DNS records that fix that for your domain.

Without them, anyone can send invoices, password resets or payment requests that appear to come from you.

Check your own site for this in about a minute

Your domain doesn’t list who may send its email

What it is. There’s no SPF record saying which mail servers may send email for your domain.

Why it matters. Fake emails "from" you are more likely to land in people’s inboxes.

Time to fix. About 10 minutes

Any host

Add a DNS TXT record on your domain (ask your email provider for the exact value):
Type: TXT   Name: @
Value: v=spf1 include:_spf.google.com ~all

Your email record lets any server send as you

What it is. Your SPF record ends in +all or ?all, which approves (or doesn’t reject) mail from every server on the internet.

Why it matters. It makes your SPF record useless, so fake emails from your domain look legitimate.

Time to fix. About 10 minutes

Any host

Edit your SPF TXT record so it ends in ~all (or -all once you’re sure every sender is listed):
v=spf1 include:_spf.google.com ~all

Anyone can send email pretending to be you

What it is. Your domain publishes no DMARC policy, so mail servers can’t reject fakes.

Why it matters. This is how most fake-invoice scams against your customers start.

Time to fix. About 15 minutes

Any host

Add a DNS TXT record:
Type: TXT   Name: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

Your email protection is in watch-only mode

What it is. Your DMARC policy is set to p=none, which reports fakes but still delivers them.

Why it matters. Fake emails from your domain still reach inboxes.

Time to fix. About 5 minutes, after checking your reports

Any host

Once your DMARC reports show your real mail passes, change the record to:
v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

Email sent to you can be downgraded to unencrypted

What it is. Your domain receives email but has no MTA-STS policy requiring encrypted delivery.

Why it matters. Someone on the network path can quietly strip encryption and read messages sent to your company.

Time to fix. About 30 minutes

Any host

1. Publish https://mta-sts.yourdomain.com/.well-known/mta-sts.txt containing:
   version: STSv1
   mode: testing
   mx: your-mx-host.example.com
   max_age: 86400
2. Add a DNS TXT record:  _mta-sts  ->  v=STSv1; id=20260101
Switch mode to "enforce" once reports look clean.