Email spoofing protection

SPF and DMARC check

Without SPF and DMARC records, anyone can send an email that appears to come from [email protected]. Scammers use this to send fake invoices to your customers. Two DNS records stop most of it.

Free. About one minute. Safe to run on a live website.

The three records, in plain language

SPF lists the services allowed to send email for your domain (for example Google Workspace or your website).
DKIM adds a digital signature to your emails. Your email provider gives you this record.
DMARC tells receiving servers what to do with email that fails SPF and DKIM: deliver it, send it to spam, or reject it.

Our check looks for SPF and DMARC records and explains what is missing. DKIM uses a provider-specific name, so check it in your email provider's admin panel.

How to fix it

1. Add or check SPF

Add a TXT record on your domain (name @). For Google Workspace it looks like:

v=spf1 include:_spf.google.com ~all

For Microsoft 365 use include:spf.protection.outlook.com. You can only have one SPF record, so combine services in a single line.

2. Add DMARC in monitoring mode

Add a TXT record with the name _dmarc:

v=DMARC1; p=none; rua=mailto:[email protected]

This changes nothing about delivery yet. It sends you reports showing who is sending email with your domain.

3. Turn protection on

After two to four weeks, once your real email services pass, change p=none to p=quarantine (fakes go to spam) and later to p=reject (fakes are refused).

On Cloudflare, add these under DNS → Records → Add record → Type TXT. On GoDaddy and Namecheap, use the domain's DNS management page. Changes usually work within an hour.

Common questions

Will adding DMARC stop my own emails from arriving?

Not with p=none, which only collects reports. Move to quarantine or reject only after the reports show your real senders pass.

I do not send email from my domain. Do I still need this?

Yes, it matters even more. Publish "v=spf1 -all" and a DMARC policy of p=reject so nobody can send email in your name.

Why do my emails go to spam?

Missing or wrong SPF, DKIM or DMARC is a common cause. Gmail and Yahoo now require them for bulk senders.

Check your website now

Enter your domain. You get a score, every problem in plain language, and an action plan that says who should fix what.