How to Configure SPF, DMARC, and DKIM for Email Security
Email spoofing is one of the easiest ways to attack your customers. SPF, DKIM, and DMARC are the three DNS records that stop it — here is how they work and how to configure them correctly.
Anyone can send an email that claims to be from your domain. That is not a flaw in the protocol — it is how SMTP was designed in the 1980s. SPF, DKIM, and DMARC are the three DNS-based standards that close this gap, and together they stop attackers from impersonating your domain in phishing campaigns. Here is what each does and how to set it up.
SPF: which servers may send your mail
SPF (Sender Policy Framework) publishes a DNS record listing every server authorized to send email for your domain. Receiving servers check the record and reject or flag mail from anywhere else.
yourdomain.com. IN TXT "v=spf1 include:_spf.google.com ~all"
The ~all (soft fail) is a safe starting point; move to -all (hard fail) once you are sure the list is complete. Important: the record must list every legitimate sender — your mail provider, your billing system, your CRM — or their mail starts failing.
DKIM: a cryptographic signature on every message
DKIM (DomainKeys Identified Mail) adds a private-key signature to each outgoing email. Receiving servers verify it with the public key you publish in DNS, proving the message was genuinely sent by you and was not modified in transit.
default._domainkey.yourdomain.com. IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq..."
Your email provider generates the key pair and the record for you — enable DKIM in its admin console and publish what it gives you.
DMARC: the policy that ties them together
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when SPF or DKIM fails, and sends you daily reports about who is sending mail as your domain.
_dmarc.yourdomain.com. IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
Roll out in stages: start with p=none and read the daily reports to find every legitimate sender you missed, move to p=quarantine, and finally p=reject. Jumping straight to reject is how companies silently break their own invoices and password resets.
Verify before and after
Check your records with dig TXT yourdomain.com and free online inspectors, then send test messages to accounts at Gmail and Outlook and inspect the Authentication-Results header. All three should pass.
Once email authentication is in place, keep it that way: the 2MNY Security scanner monitors your DNS records — SPF, DKIM, DMARC, MX, and more — and alerts you when anything changes. Run a free scan to check your current email security posture.
1 What do SPF, DKIM, and DMARC actually do?
SPF lists which mail servers are allowed to send email for your domain; DKIM cryptographically signs each message so receivers can verify it was not tampered with; DMARC ties them together with a policy that tells receivers what to do when checks fail (nothing, quarantine, or reject) and where to send reports. Together they prevent attackers from spoofing your domain in phishing campaigns.
2 How do I add SPF and DMARC records to my domain?
Both are plain DNS TXT records. SPF goes on your root domain (for example "v=spf1 include:_spf.google.com ~all") and must be a single record listing all legitimate senders. DMARC goes on _dmarc.yourdomain.com with a policy like "v=DMARC1; p=quarantine; rua=mailto:[email protected]". Start with p=none to collect reports, then tighten once you see legitimate traffic patterns.
3 Will DMARC stop phishing emails that use my domain?
It stops exact-domain spoofing — attackers sending mail that claims to be from yourdomain.com — once you enforce a quarantine or reject policy. It does not stop lookalike domains (yourdornain.com) or display-name spoofing, which is why monitoring for typosquat registrations is a useful complement. 2MNY checks your SPF/DMARC posture and flags common misconfigurations like multiple SPF records.
4 How can I check if my SPF, DKIM, and DMARC are configured correctly?
A free scan at 2mny.com/free-security-scan includes an email security audit that verifies your SPF syntax and look-up count, DMARC policy strength, and related DNS records like MTA-STS and DKIM selector presence. Many sites discover they have two conflicting SPF records or a DMARC policy stuck at p=none forever.
