Stopping people sending email as you
SPF, DKIM and DMARC, in the order that matters.
The one that actually blocks spoofing
DMARC. It is a single DNS record and it tells receiving mail servers what to do with a message that forges your address. Without it, someone can email your customers from you@yourdomain.com and it will often land in the inbox.
That is the mechanic behind invoice fraud and fake password-reset emails, and it is aimed at your users rather than at your app.
Roll it out in stages, not in one go
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100
Leave that for two to four weeks and read the reports. Once every legitimate sender you use is passing — your transactional email, your newsletter tool, your own mailbox — move to p=quarantine, then p=reject.
Do not jump straight to p=reject. If a sender is not set up correctly yet, your real email stops arriving and you will not immediately know why.
SPF and DKIM underneath it
SPF lists the servers allowed to send as your domain. You may have exactly ONE SPF record — a second one voids both, which is the most common mistake here. End it with -all.
DKIM signs your outgoing mail. Your provider gives you the record: Google Workspace under Apps → Gmail → Authenticate email; Microsoft 365 in the Defender portal; Resend, SendGrid and Postmark on the domain settings page.
DMARC only passes if one of these two aligns, so it is worth having both.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site