Protecting your domain from spoofing with SPF, DKIM and DMARC

How to stop other people sending scam email that appears to come from your domain.

Anyone can put your domain in the From address of a message they send. Three DNS records let receiving mail servers tell your real mail from a forgery, and they work as a set rather than alternatives. Publishing all three is what closes the gap.

SPF says which servers may send

Sender Policy Framework is a TXT record listing the servers allowed to send mail for your domain. A receiving server looks it up and checks whether the message came from one of them.

A simple record looks like this:

v=spf1 ip4:192.0.2.0 -all

v=spf1 is the version, ip4:192.0.2.0 is a permitted sending address, and -all says that anything from anywhere else should be rejected.

SPF has one important limitation. It checks the address the sending server declares, not the From address your recipient actually sees, so on its own it does not stop someone forging that. This is why the other two matter.

DKIM signs the message

DomainKeys Identified Mail adds a digital signature to the header of every message you send. The receiving server fetches your published key and checks the signature against it.

A valid signature shows the message really came from your domain and has not been altered on the way. An invalid one is grounds for treating the message as spam or refusing it.

DMARC ties them together and tells servers what to do

DMARC is a policy you publish in DNS. It says which of SPF and DKIM you use, and what a receiving server should do with a message that fails: let it through, quarantine it, or reject it.

It also closes the gap SPF leaves, because DMARC checks the From address your recipient sees rather than only the one the servers exchanged. Without a DMARC policy, a receiving server has to guess what you want, and most will let a doubtful message through.

Where to start

Publish SPF first, because it is the simplest and the most widely checked. See creating an SPF record for the values to use.

Add DKIM next, then set a DMARC policy. Start DMARC at the least severe setting and watch the reports before tightening it, because a policy set to reject while a legitimate sending service is missing from your SPF record will stop your own mail reaching people.