How to Stop Email Spoofing with SPF, DKIM & DMARC

Updated August 2026 · about an 8-minute read

If your domain has no email authentication, anyone can send mail that looks exactly like it came from you — the mechanism behind most phishing, invoice fraud and brand impersonation. Three DNS records fix it: SPF, DKIM and DMARC. This is what each does and the order to deploy them in 2026.

What changed in 2026: in May 2026 the DMARC standard was rewritten as DMARCbis (RFC 9989, 9990 and 9991), replacing the original 2015 specification. And Gmail and Yahoo now issue permanent rejections to bulk senders that skip authentication — so this is now a deliverability requirement, not just a security nicety.

The three records

SPF — who is allowed to send

SPF is a DNS TXT record listing the mail servers permitted to send for your domain. Receiving servers check the sending server against that list.

v=spf1 include:_spf.google.com include:sendgrid.net -all

The -all at the end means "reject everything not listed." Use it once you're sure every legitimate sender is included.

DKIM — a tamper-proof signature

DKIM adds a cryptographic signature to every message. Your mail provider signs outgoing mail with a private key; the matching public key lives in your DNS. The receiver verifies the message really came from you and wasn't altered in transit. You enable it in your email provider's admin console, which gives you the DNS record to publish.

DMARC — the policy that ties it together

DMARC tells receivers what to do when a message fails SPF and DKIM, and — crucially — that the visible "From" address must match the authenticated domain, which is the part that stops exact-address forgery.

v=DMARC1; p=none; rua=mailto:dmarc@example.com

Start at p=none, which monitors and reports without blocking anything, and read the reports (the rua address) to confirm your real senders pass. Then tighten to p=quarantine, and finally p=reject. A record sitting permanently at p=none reports spoofing but never blocks it — a very common half-finished state.

The order matters

1. Publish SPF and enable DKIM. Let them authenticate real mail cleanly for at least 48 hours.
2. Add DMARC at p=none and read the reports.
3. Once your legitimate senders pass consistently, move to p=quarantine, then p=reject.

The most common way this goes wrong is turning on enforcement before your real senders authenticate — which silently blocks your own mail. Don't skip the p=none reporting phase.

Then keep an eye on it

DNS records get edited, providers change, and a well-meaning change can drop your SPF or leave DMARC stuck at p=none. Email authentication is one of the three things a full external check looks at — check your domain below to see whether SPF and DMARC are present and enforcing.