DNS Security Records Check

Q: Do I need SPF, DKIM, and DMARC all three?

Yes. SPF authorizes senders, DKIM signs messages so they cannot be altered, and DMARC enforces what happens on failure. Together they stop domain spoofing.

Q: My DMARC says p=none — is that enough?

No. p=none only reports; spoofed mail is still delivered. Move to p=quarantine and then p=reject once your reports look clean.

VitalSite validates SPF, DMARC, DKIM, and CAA DNS records that stop attackers spoofing your domain in email and abusing certificate issuance.

📡

Your DNS records do more than point a domain at a server — they decide who can send email as you and which authorities can issue certificates for you. Misconfigured email DNS is how phishers spoof your brand. VitalSite checks the four records that matter using Node's native dns module.

What VitalSite checks

SPF (Sender Policy Framework). A TXT record listing which servers may send mail for your domain. Missing SPF makes spoofing easy.
DMARC. A policy record that tells receivers what to do with mail that fails SPF/DKIM. We grade the policy: p=reject is strong, p=quarantine is moderate, and p=none only monitors. Read DMARC, DKIM, and SPF explained.
DKIM. A cryptographic signature that proves a message wasn't altered. We probe common selectors (google, default, mail, smtp, and others).
CAA. Restricts which certificate authorities may issue certificates for your domain, reducing mis-issuance risk.

Why it matters

Without SPF and DMARC, anyone can send email that appears to come from your domain — a direct path to phishing your customers, partners, and staff. A weak DMARC policy (p=none) looks configured but still lets spoofed mail through. CAA is a lighter control, but it meaningfully limits who can mint certificates in your name.

How to fix it

Add these as DNS records at your registrar or DNS host.

SPF (TXT on the root domain):

v=spf1 include:_spf.google.com ~all

DMARC (TXT on _dmarc.yourdomain.com) — start at none to monitor, then tighten:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com

DKIM is enabled in your email provider's admin console, which gives you a selector and a public key to publish. CAA (on the root) authorizes your CA, e.g. 0 issue "letsencrypt.org".

Work up to p=reject once your reports confirm legitimate mail is passing. Our email security guide covers the full rollout.

Verify the fix

Re-scan your domain. SPF, DKIM, and CAA should report present, and DMARC should reflect your chosen policy. Aim to see DMARC graded as reject for full protection.

Run a free full-domain scan to see whether this affects your site — every page, with an exact fix guide. Pro and Agency plans add PDF export and monitoring.

See if this affects your site

Run a free full-domain scan — this check runs on every page, with an exact fix guide.

Scan Your Domain — Free See pricing

Frequently asked questions

Do I need SPF, DKIM, and DMARC all three?

My DMARC says p=none — is that enough?

DMARC, DKIM, SPF Explained

Email security for site owners.

Malware / Blacklist

Check your domain reputation.