How to stop people sending fake email from your domain

Anyone can send an email that says it comes from hello@yourdomain.com. The "From" line is just text, much like the return address on an envelope. What stops a stranger from using your name is a set of DNS records that tell Gmail, Outlook and every other mail server which senders are really yours, and what to do with the rest.

When those records are missing or broken, two things happen. Scammers can send invoices, password resets or "urgent" requests that look like they came from you. And your own real emails are more likely to land in spam, because mail servers can't tell them apart from the fakes.

In our audits this is one of the most common problems we find on small business sites, and one of the quickest to fix.

#The three records, in plain words

SPF and DKIM prove that an email is genuine. DMARC is the part that tells receivers what to do when it isn't. Without DMARC, the other two are mostly advice: many receivers will still deliver the fake.

#First, check what you have

You can look up your records with any DNS lookup tool, or from a terminal:

dig +short TXT yourdomain.com
dig +short TXT _dmarc.yourdomain.com
dig +short MX yourdomain.com

You're looking for one line starting with v=spf1 on the domain, and one starting with v=DMARC1 at _dmarc. If either is missing, keep reading.

#If your domain sends email

#1. Publish one SPF record that lists every sender

List every service that sends email as you: your mailbox provider (Google Workspace, Microsoft 365), your newsletter tool, your shop or booking system. Each provider documents the include: to use.

v=spf1 include:_spf.google.com include:spf.protection.outlook.com ~all

The ending matters. ~all means "anything else is suspicious", which is the safe setting while you're still finding all your senders. -all means "anything else is not me", and is the goal once you're sure the list is complete.

#2. Turn on DKIM with each sender

DKIM is switched on inside each service (in Google Workspace it's under Apps → Gmail → Authenticate email). The service gives you a TXT record to add, usually at a name like google._domainkey. Do this for every service on your SPF list, because DMARC passes when either SPF or DKIM matches your domain, and DKIM survives email forwarding where SPF often doesn't.

#3. Add DMARC, and tighten it in steps

Start by watching, not blocking:

_dmarc   TXT   v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com

p=none changes nothing about delivery. It asks receivers to send you daily reports of who is sending as your domain. After two to four weeks, those reports show whether any real sender is missing from SPF or DKIM. Fix those, then move to p=quarantine (fakes go to spam) and finally p=reject (fakes are refused).

#If your domain never sends email

Many domains only host a website: a brochure site, a landing page, a domain you bought to protect your brand. These are the easiest targets, because nobody watches them. Lock them completely:

@        TXT   v=spf1 -all
_dmarc   TXT   v=DMARC1; p=reject;
@        MX    0 .

The first line says no server may send for this domain. The second tells receivers to refuse anything that claims to. The third, a "null MX" record (RFC 7505), says the domain accepts no email at all, so senders don't even try. Together they make your domain useless to spoofers.

#The mistakes we see most

• Two SPF records. Usually because two tools each said "add this record". Merge them into one line.
• An include: that points nowhere. If a domain you include has no SPF record of its own (often a typo, or an old address the provider stopped using), the whole check fails with a permanent error. Copy includes from the provider's current documentation, and remove ones for services you no longer use.
• Too many lookups. SPF allows at most 10 DNS lookups in total, counting the includes inside your includes. Big providers use several each. If you're over, remove unused senders first.
• DMARC stuck at p=none for years. It reports, but protects nothing. Plan the move to reject.
• Forgetting subdomains and spare domains. mail.yourdomain.com and the .net you bought years ago can be spoofed too. Lock the ones that don't send.

#How to check it's working

Send an email from each of your services to a Gmail address, open it, and choose Show original. You want to see SPF: PASS, DKIM: PASS and DMARC: PASS. Any FAIL tells you which sender still needs fixing.

An AHX audit checks these records for you as part of every site audit: whether SPF and DMARC exist, whether SPF is valid (one record, includes that resolve, under the lookup limit), how strict DMARC is, and whether a domain that sends no email is locked. It also gives you the exact records to add for your situation.