1dollar.website

Stop scammers sending email as your domain

Three DNS records stop scammers from sending email that looks like it's from your domain: SPF lists who may send for you, DKIM signs your real email, and DMARC tells inbox providers to reject anything that fails. You add them once at your DNS provider.

Last updated October 31, 2026

Prefer to fill in a form? Use the free SPF and DMARC record generator or the DMARC checker.

Not sure whether your site has this?

Paste your address. The checkup is free and shows what's flagged.

What our checkup looks for

Our free checkup looks up your domain's DNS. It flags a missing SPF record, an SPF record that lets anyone send, a missing DMARC record, DMARC left in monitor-only mode (p=none), and no DKIM key under the names most email providers use.

SPF: list who may send email for you

SPF is one TXT record on your domain listing the services allowed to send email as you. Use the include for your email provider, and add one for each other service that sends as you, like a newsletter tool or your shop's order emails.

A domain may have only one SPF record. If one already exists, edit it instead of adding a second. End it with -all so everything not listed fails; +all lets anyone send as you.

How to fix it

  1. Log in to wherever you manage your domain's DNS (your registrar, Cloudflare, etc.).
  2. Add (or replace your existing) TXT record on example.com with the value below. Keep only one SPF record.
  3. Use the include for your email provider: Google Workspace is _spf.google.com, Microsoft 365 is spf.protection.outlook.com. If your domain never sends email, use just: v=spf1 -all
dns
Type: TXT
Name: @
Value: v=spf1 include:_spf.google.com -all

DMARC: tell inboxes to block fakes

DMARC is a TXT record named _dmarc that tells Gmail, Outlook and the rest what to do with email that fails SPF and DKIM. p=none only monitors: fake email still gets delivered. p=quarantine sends it to spam, and p=reject blocks it.

If you're not sure every service that sends as you is in your SPF record, start with p=none for two weeks and read the reports sent to the rua address. Then move to p=quarantine, and later p=reject.

How to fix it

  1. Add a TXT record named _dmarc on example.com.
  2. Start with p=quarantine if you're confident all your email services are set up in SPF; otherwise start with p=none for two weeks and read the reports.
dns
Type: TXT
Name: _dmarc
Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com

DKIM: sign your real email

DKIM adds a signature to every email you send, which inbox providers check against a public key in your DNS. You switch it on in your email provider, which gives you the exact record to add.

Our check looks for the key names most providers use. If yours uses an unusual name, we may not find it, so check in your provider's settings before changing anything.

How to fix it

  1. Turn on DKIM signing in your email provider. Google Workspace: Admin console > Apps > Gmail > Authenticate email. Microsoft 365: Defender portal > Email authentication > DKIM.
  2. Your provider will give you a DNS record to add. Add it exactly as shown.
dns
Type: TXT (or CNAME)
Name: <selector>._domainkey
Value: <provided by your email service>

If your domain never sends email

Domains that never send email are a favourite for scammers, because nobody notices the fakes. Lock them down with an SPF record of just v=spf1 -all and a DMARC record with p=reject, which together say no email from this domain is real.

How to check it worked

These print your SPF and DMARC records once they've spread through DNS (usually minutes, sometimes a few hours). Or run our free checkup again.

bash
dig +short TXT example.com | grep spf
dig +short TXT _dmarc.example.com

Common mistakes

  • Adding a second SPF record instead of editing the first. Two SPF records make both fail.
  • Leaving DMARC at p=none forever. It reports problems but blocks nothing.
  • Forgetting a sending service, then moving to p=reject and losing your own invoices or newsletters. Read the reports first.
  • Stacking up includes. SPF allows only 10 DNS lookups in total, some includes use several, and going over makes SPF fail.

What this can't tell you

These records stop others sending as your exact domain. They can't stop look-alike domains (like examp1e.com), and they don't protect your own mailbox from phishing.

Check your own site, free

The free checkup shows how many results are flagged and how serious. For $1, the report picks the ones that matter for your site and writes each fix for your platform, with your own domain filled in.