SPF and DMARC for small sites
Anyone can send an email that claims to come from [email protected]. Email was designed that way decades ago. What decides whether such a fake lands in an inbox or gets thrown away are three short records in your domain's DNS settings: SPF, DKIM and DMARC.
Without them, a scammer can send your customers an invoice "from you" with their own bank account on it, and nothing on the receiving side says it is fake. With them, the big mail providers can recognise the fake and reject it. Gmail and Yahoo have also made SPF or DKIM a requirement for delivering mail, so the same records help your real email arrive.
SPF: who may send email for your domain
SPF is one line of text in your DNS that lists the services allowed to send email as your domain: your mail provider, your newsletter tool, your shop system.
A typical record for a company on Google Workspace looks like this:
v=spf1 include:_spf.google.com ~all
and on Microsoft 365:
v=spf1 include:spf.protection.outlook.com -all
Your providers tell you the exact include: part in their setup guides. The ending matters:
| Ending | Meaning |
|---|---|
-all |
Mail from anyone else is not from us. The strictest, and the goal. |
~all |
Mail from anyone else is probably not from us. A common, safe starting point. |
?all |
No opinion. This protects nothing. |
+all |
Anyone may send as us. This is worse than having no record. |
Two rules people trip over:
- A domain must have exactly one SPF record. If a second service tells you to "add an SPF record", merge its
include:into the existing line instead. Two records make receivers ignore both. - SPF allows at most ten DNS lookups in total (every
include:counts, and so do the includes inside it). Past ten, the record fails. If you use many sending services, ask your developer to check the count.
DKIM: a signature on each message
DKIM adds a digital signature to every email your provider sends, and publishes the matching key in your DNS. Receivers check the signature to confirm the message really came through your provider and was not changed on the way.
You do not write DKIM records yourself: your mail provider and each sending service give you one or two records to copy into DNS and a button to switch signing on. Do this for every service that sends as your domain.
DMARC: what to do with fakes
SPF and DKIM let a receiver tell real from fake. DMARC tells it what to do with a fake, and asks it to send you reports about what it saw. It lives in a TXT record at _dmarc.yourdomain.com.
Set it up in three steps, a few weeks apart:
- Watch:
v=DMARC1; p=none; rua=mailto:[email protected]. Nothing is blocked yet. The reports to that address show every service sending as your domain, including ones you forgot about. Report-reading services can turn the reports into something readable. - Quarantine: once all your real senders pass SPF or DKIM, change
p=nonetop=quarantine. Fakes go to the spam folder. - Reject: finally
p=reject. Fakes are refused outright.
Staying on p=none forever is common, and a Scanylo report flags it, because a policy that only watches still lets every fake through.
Adding the records at your DNS provider
The records go wherever your domain's DNS is managed. That is not always where you bought the domain: if your site moved to Cloudflare, for example, the records belong in Cloudflare. Your registrar's panel shows which "nameservers" the domain uses, and those tell you where.
Every provider's panel asks for the same three things. For SPF:
| Field | What to enter |
|---|---|
| Type | TXT |
| Name (or Host) | @ for the domain itself. Some panels want it left empty instead, or show your domain name already filled in. |
| Value (or Content) | the whole SPF line, for example v=spf1 include:_spf.google.com ~all |
For DMARC, the type is again TXT, the name is _dmarc, and the value is your DMARC line. Enter only _dmarc, not _dmarc.yourdomain.com: most panels add your domain themselves, and typing it again creates _dmarc.yourdomain.com.yourdomain.com, which no one ever looks up. DKIM records come from your mail provider with the exact name and value to copy.
In Cloudflare this is under DNS, Records, Add record. At other providers look for "DNS", "DNS zone" or "Advanced DNS". Before you add an SPF record, check whether one already exists (a TXT record starting with v=spf1) and edit that one instead. Changes usually show within minutes, sometimes up to a few hours. Run the free check above again afterwards to confirm.
A domain that sends no email at all
If nobody sends email from a domain (a second brand, a parked domain), say so, so it cannot be abused either:
- SPF:
v=spf1 -all - DMARC:
v=DMARC1; p=reject;
How Scanylo checks your domain
A Scanylo check reads your domain's public DNS records, the same ones every mail server reads. It reports a missing SPF record, an SPF record that allows everyone (+all) or says nothing (?all), more than one SPF record, a missing DMARC record and a DMARC policy of p=none. It also checks whether the address you entered, or its www. version, points to an outside hosting service where the target no longer exists, which someone else could claim and take over.
What it does not check: DKIM. A DKIM key sits under a name your provider chose (the "selector"), and that name is not public, so it cannot be looked up from the outside without guessing. Check DKIM in your mail provider's admin panel. The details are on how the email and DNS check works.
Sources
More guides
- Security headers explained for website owners · The short instructions your site sends to every browser, what each one protects against, and the values to ask your developer for.
- What an external website scan can and cannot see · What any outside-in check, ours included, can learn about your site, where it goes blind, and what a clean report does and does not prove.