DMARC, DKIM, SPF Explained: Email Security for Website Owners

SPF, DKIM, and DMARC are three DNS records that work together to stop attackers from spoofing your domain — sending phishing emails that appear to come from you. Without them, anyone can forge your "from" address.

SPF — who is allowed to send

SPF lists the servers permitted to send mail for your domain:

v=spf1 include:_spf.google.com ~all

DKIM — a tamper-proof signature

DKIM adds a cryptographic signature to every message so receivers can verify it wasn't altered and really came from you. Your email provider gives you a TXT record to publish on a selector like google._domainkey.

DMARC — the policy that ties it together

DMARC tells receivers what to do when SPF or DKIM fails, and where to send reports:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100

• p=none — monitor only (start here).
• p=quarantine — send failures to spam.
• p=reject — block failures outright (the goal).

Recommended rollout

Start at p=none, read the aggregate reports for two weeks, fix any legitimate senders that fail, then move to quarantine and finally reject. VitalSite grades your DMARC policy strictness on every scan.