SPF, DKIM and DMARC: stop anyone spoofing your domain

OWASP A07 DNS Updated 17 September 2026 · 9 min read

Here is the uncomfortable default: unless you have configured otherwise, anyone on the internet can send an email with From: billing@yourcompany.com and most receiving servers will deliver it. SMTP was designed in an era that assumed good faith, and the From header is just text the sender chooses.

SPF, DKIM and DMARC are the three records that close that hole. They are DNS entries — no software to install, no server to patch. Most small businesses have one of the three, half-configured, which provides roughly none of the protection.

What each one actually does

DMARC is the one that matters most, and the one most often missing. Without it, SPF and DKIM failures are advisory — receivers decide for themselves what to do, and mostly they deliver anyway.

Step 1 — SPF

One TXT record on your root domain listing every service permitted to send as you.

Type:  TXT
Host:  @
Value: v=spf1 include:_spf.google.com include:sendgrid.net ~all

Three rules that trip people up:

• One SPF record per domain. Two v=spf1 records is a permanent error — receivers treat it as invalid and you lose SPF entirely. Merge them into one.
• Ten DNS lookups maximum. Every include: costs a lookup, and those includes have their own includes. Exceed ten and SPF fails with permerror. If you're close to the limit, flatten your record or drop unused services.
• Use ~all, not -all, at first. The tilde is softfail — mail still arrives but is marked. Move to -all (hardfail) only once DMARC reports confirm you've listed every legitimate sender.

Step 2 — DKIM

DKIM adds a cryptographic signature to every outgoing message. The receiver fetches your public key from DNS and verifies the message really came from you and wasn't altered in transit.

You don't hand-write this one. Your mail provider generates the key pair and gives you a record to publish:

Type:  TXT
Host:  google._domainkey
Value: v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFA...

The google part is the selector — it differs per provider, and you will have one record per sending service. Google Workspace, Microsoft 365, SendGrid, Mailchimp and your CRM each need their own DKIM record if they send as your domain.

After publishing, you must enable signing in the provider's admin console. Publishing the DNS record alone does nothing — this is the single most common half-finished DKIM setup.

Step 3 — DMARC, carefully

DMARC ties the other two together and tells receivers what to do on failure. Start permissive:

Type:  TXT
Host:  _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; fo=1

p=none changes nothing about delivery. It just asks receivers to send you aggregate reports about who is sending mail as your domain. Those reports are the entire point of this stage.

Read them for at least a month. You will almost certainly discover a legitimate sender nobody remembered: the billing system, a recruitment tool, the marketing platform someone signed up for. Fix each one — add it to SPF, enable its DKIM — before tightening.

Then tighten, in two moves

# after ~1 month of clean reports
v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc@yourdomain.com

# after another clean month, raise pct to 100, then:
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

The pct tag applies the policy to a percentage of failing mail, so you can ramp up gradually instead of flipping a switch across all your traffic at once.

Alignment: the part people miss

DMARC doesn't just require SPF or DKIM to pass. It requires them to align with the visible From domain. A message can pass SPF for mail.vendor.com while displaying From: you@yourdomain.com — SPF passes, alignment fails, DMARC fails.

This is why bulk-mail services ask you to configure a custom sending domain or CNAME. That setup exists specifically to make SPF and DKIM align with your visible From address. If you skipped it, your newsletters are failing DMARC right now.

Quick verification

• Check you have exactly one v=spf1 TXT record and it stays under ten lookups.
• Send a test mail to an address you control and confirm the headers show dkim=pass and spf=pass.
• Confirm _dmarc.yourdomain.com resolves and that reports are actually arriving at your rua address.
• Repeat for every subdomain that sends mail — DMARC's sp= tag controls subdomain policy separately.