SPF, DKIM, DMARC: protecting a domain from spoofing

9 November 2026 · DNS · Email · Security

The three DNS records that stop someone from sending emails in your name, explained simply.

SMTP dates from 1982 and does not check the sender: technically, anyone can write "From: [email protected]". Three DNS records fix that flaw.

SPF

The list of servers allowed to send for the domain. The receiving server compares the sender's IP address with that list.

v=spf1 include:_spf.google.com ~all

DKIM

A cryptographic signature added to every email. The public key is published in DNS: the recipient checks that the message was not altered and really comes from the domain.

DMARC

The policy to apply when SPF or DKIM fails: do nothing (none), quarantine, or reject. DMARC also sends reports showing who sends on behalf of the domain.

v=DMARC1; p=quarantine; rua=mailto:[email protected]

The right approach

• List every service that sends email (mailboxes, website, invoicing tool...)
• Publish SPF and enable DKIM for each of them
• Start DMARC with p=none and read the reports for a few weeks
• Then move to quarantine, and finally reject

To check a domain from a terminal:

nslookup -type=TXT exemple.fr
nslookup -type=TXT _dmarc.exemple.fr