Imagine a customer receives an invoice from "[email protected]" asking them to pay into a new bank account. It looks real. It is not from you. Anyone can send email that pretends to be from your domain unless you tell the world which servers are allowed to send it.
Three simple records do that: SPF, DKIM and DMARC. They are free, and many businesses in Sri Lanka and abroad have none of them set up.
Why it matters
- Fraud: scammers send fake invoices and payment requests in your name
- Reputation: if someone fakes your domain, your real emails can end up in spam
- Delivery: large email providers increasingly expect these records, and may block or filter email from domains without them
- Trust: customers learn to trust your emails more when they reliably arrive
SPF: who is allowed to send
SPF (Sender Policy Framework) is a record in your domain's settings that lists the servers allowed to send email for you. When a message arrives, the receiving server checks the sender against the list.
An SPF record is a line of text such as:
v=spf1 include:your-email-provider.com ~all
The ending matters. ~all means "treat others with suspicion", and -all means "reject others". A record ending in +all or ?all lets almost anyone send as you, which defeats the purpose.
DKIM: a signature that proves it is genuine
DKIM (DomainKeys Identified Mail) adds a hidden digital signature to each email you send. The receiving server checks it against a public key in your domain settings. If the message was changed on the way, or was not sent by you, the check fails.
Your email provider usually creates the keys. You add the record they give you to your domain.
DMARC: what to do when checks fail
DMARC ties SPF and DKIM together and tells receivers what to do with email that fails: nothing, send it to spam, or reject it. It also sends you reports of who is sending email as your domain.
A DMARC record starts like this:
v=DMARC1; p=none; rua=mailto:[email protected]
The p= part is the policy:
none: just watch and collect reports (a safe place to start)quarantine: send failures to spamreject: block failures completely
How to set it up safely
- List everything that sends email for you: your mailbox provider, your website's contact form, newsletter tools, invoicing software
- Create the SPF record including all of them
- Turn on DKIM in each sending service and publish the keys
- Add DMARC with
p=noneand read the reports for a few weeks - Fix anything legitimate that fails, then move to
quarantine, and laterreject
Rushing to reject before you have listed every sender can block your own invoices or newsletter, so go step by step.
How to check yours in a minute
Use our free security scanner. It looks up your SPF and DMARC records and tells you in plain English what is missing and how to fix it. It also checks your SSL certificate and website security headers in the same scan.
Common mistakes
- Two SPF records on one domain (there must be only one)
- Forgetting a service that sends email for you, such as a website form or invoicing app
- Jumping straight to
p=reject - Setting it up once and never reviewing the reports
- Leaving old domains you no longer use unprotected, since scammers use those too
Need a hand?
Email authentication is quick for someone who does it often, and easy to get wrong if you do not. Our security service checks and sets up these records as part of every site we build and care for. Contact us if you would like it done for you.
