← All articles · ScanMend · Lietuviškai

SPF, DKIM and DMARC: how to stop people sending email as your company

23 October 2026

Email was designed long before anyone worried about fraud: the sender address in a message can be anything. That is why a scammer can send your customer an "invoice" that appears to come from [email protected]. Three DNS records – SPF, DKIM and DMARC – let the receiving server check whether a message really comes from you.

SPF: who may send email for your domain

SPF is a TXT record at the root of your domain (@) that lists the servers allowed to send email for it. For example, if you use Google Workspace:

v=spf1 include:_spf.google.com -all

With Microsoft 365, use include:spf.protection.outlook.com instead of include:_spf.google.com. If a newsletter service or online shop also sends email for you, its include: must be in the same record.

• Only one SPF record. Two separate v=spf1 records are an error; merge all senders into one.
• No more than 10 DNS lookups. Every include: counts; above the limit the SPF check fails (RFC 7208).
• The ending matters. -all rejects everyone else, ~all marks them as suspicious. Without either, SPF protects very little.

DKIM: a signature that cannot be forged

DKIM adds a cryptographic signature to every message, and the public key is published in a DNS record at selector._domainkey.yourcompany.com. You do not write this record yourself: your email provider generates it (the Google Workspace Admin console, the Microsoft 365 Defender portal or your host's email settings). Copy the record they give you into DNS, then turn on signing on their side.

DMARC: what to do with fake messages

DMARC tells the receiving server what to do when a message fails the SPF and DKIM checks, and where to send reports. The record goes at _dmarc.yourcompany.com:

v=DMARC1; p=none; rua=mailto:[email protected]

1. Start with p=none. You only monitor: reports show who sends email in your name, but nothing is blocked.
2. After a few weeks, move to p=quarantine. Once the reports show only your own senders, fake messages go to spam.
3. Finally, p=reject. Fake messages are rejected outright.

Large mailbox providers are getting stricter about these records: since 2024, Google and Yahoo require SPF, DKIM and DMARC from bulk senders. Even if you send little email, messages without them are more likely to land in spam.

Where to set all this up

Wherever your domain's DNS is managed: your hosting panel (Hostinger hPanel – Domains → DNS / Nameservers, cPanel – Zone Editor), your domain registrar or Cloudflare (DNS). Changes usually take effect within minutes, sometimes up to 24 hours.

Bonus: the CAA record

A CAA record says which certificate authorities may issue SSL certificates for your domain, for example 0 issue "letsencrypt.org". It is a simple extra safeguard against certificates being issued without your knowledge.