Walters Sentinel
The short version
- SPF lists the servers allowed to send email for your domain.
- DKIM signs each email, so receivers can check it really came from you and was not changed on the way.
- DMARC tells receivers what to do when an email fails both, and sends you reports on everyone sending as you.
- Only DMARC at
p=quarantineorp=rejectactually stops spoofing.p=noneonly watches. - Start at
p=none, fix every legitimate sender the reports show, then tighten. - Domains you never send email from should be locked down completely.
Check your domain first
Mail Shield reads your SPF, DKIM, DMARC, MX, MTA-STS, TLS reporting and BIMI records, and the blocklists your mail servers might be on. It grades the domain out of 100 and gives the exact record to add, in the form you paste into your DNS. No account is needed, and only public records are read.
Why spoofing works
Email was designed with no way to prove who sent a message. The From address is just text the sender types, so anyone can put your domain in it. SPF, DKIM and DMARC are what add that proof, and the largest mailbox providers now require them: Gmail and Yahoo since February 2024, and Outlook.com since May 2025, for anyone sending more than 5,000 messages a day. Smaller senders that skip them see more of their own mail land in spam.
SPF: who may send for you
SPF is one TXT record on your domain listing the servers allowed to send its email. It looks like this:
yourcompany.co.uk. TXT "v=spf1 include:spf.protection.outlook.com ~all"Each service that sends as you adds its own include:. Your email provider gives you theirs, and so does every newsletter, CRM, invoicing and helpdesk tool that sends in your name.
| If your email is hosted on | Add to SPF |
|---|---|
| Microsoft 365 | include:spf.protection.outlook.com |
| Google Workspace | include:_spf.google.com |
| Any other service that sends as you | The include its own setup guide gives you |
- One SPF record per domain. Two records make both fail. Merge them into one.
- No more than 10 DNS lookups. Every
include,a,mx,existsandredirectcounts, and so do the ones inside each include. Past ten, SPF fails for everything. - End with
~allonce DMARC is in place.-allis stricter, but a few receivers reject on it before checking DKIM, which can drop forwarded mail that DKIM would have passed.
SPF alone does not stop spoofing. It checks the hidden "envelope" sender, not the From address people see, and it breaks when mail is forwarded. That is why DKIM and DMARC exist.
DKIM: a signature on every email
With DKIM, the service sending your email signs each message with a private key, and you publish the matching public key in DNS. A receiver checks the signature against the key, which proves the message came from a server you authorised and was not changed on the way.
selector1._domainkey.yourcompany.co.uk. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A..."- You don't write the key yourself. Switch DKIM on in each service that sends as you, and it gives you the record to publish. It is often a CNAME that points to the provider.
- Every sending service needs its own DKIM, signing with your domain, not the tool's. That is what lines it up with DMARC (see alignment, below).
- Use 2048-bit keys where a service offers the choice.
DMARC: the instruction, and the reports
DMARC is a TXT record at _dmarc on your domain. It tells receivers what to do with mail that fails, and where to send reports.
_dmarc.yourcompany.co.uk. TXT "v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.co.uk"| Tag | What it means |
|---|---|
v=DMARC1 | This is a DMARC record. It must come first. |
p= | What to do with mail that fails: none delivers it and only reports, quarantine sends it to spam, reject refuses it. |
rua= | Where receivers send their daily aggregate reports. |
sp= | A different policy for subdomains. Without it they follow p=. |
adkim= / aspf= | How strictly the domains must match: r relaxed (the default) or s strict. |
The reports are XML, one per receiving provider per day. In volume they are unreadable by hand, which is why a reporting tool is worth having. If they go to an address at a different domain, that domain has to publish a record agreeing to receive them; reporting services set this up for you.
Alignment: the part most people miss
DMARC passes when SPF or DKIM passes and the domain it checked matches the domain in the From address. With relaxed alignment a subdomain counts, so mail.yourcompany.co.uk lines up with yourcompany.co.uk.
The classic failure. A newsletter or invoicing tool sends from its own servers and signs with its own domain. SPF and DKIM both pass, but for the wrong domain, so DMARC fails and your real email is quarantined. The fix is the tool's "custom sending domain" or "authenticate your domain" setting, which makes it sign as you.
Reaching p=reject without losing real email
- Publish what you know. SPF with every sender you are aware of, DKIM switched on in every service that sends as you, and DMARC at
p=nonewith a reporting address. - Read the reports for a few weeks. Every source sending as you is either legitimate, so fix its SPF or DKIM, or it is not, and that is exactly the spoofing you are about to block. Look hard for the senders nobody listed: payroll, the website's contact form, the CRM, the scanner in the office.
- Move to
p=quarantineonce every legitimate source passes. - Move to
p=rejectafter a few clean weeks. Spoofed mail is now refused outright. - Keep reading the reports. New tools get added, and a change at a provider can quietly break a sender.
Don't jump straight to p=reject, and don't stay on p=none for years. p=none protects nobody.
Domains that never send email
Old brand names, the typo domains you registered to protect yourself, and domains kept only for a website are easy to spoof precisely because nobody watches them. Lock each one down completely:
yourolddomain.co.uk. TXT "v=spf1 -all"
_dmarc.yourolddomain.co.uk. TXT "v=DMARC1; p=reject;"
yourolddomain.co.uk. MX 0 .The last line is a "null MX": it says the domain accepts no email at all.
Mistakes that break delivery
- Two SPF records on one domain. Merge them.
- More than ten lookups in SPF, usually from adding includes over the years.
- A sender forgotten, then
p=rejectswitched on. - DKIM signing with the tool's domain instead of yours.
- A reporting address nobody reads.
- Leaving subdomains unprotected when they need a different policy (
sp=). - Copying another organisation's record, includes and all.
Beyond the three: MTA-STS and TLS reporting make sure email sent to you travels encrypted, and BIMI shows your logo beside your messages in supporting inboxes once DMARC is at quarantine or reject.
The checklist
Set up
Watch
Enforce
Extras
Let Mail Shield read the reports for you
With an account, Mail Shield reads your DMARC reports and shows every server sending as your domain and whether it passed, so you know exactly when it is safe to tighten the policy. On a paid plan it re-checks every day and emails you if a record changes or disappears.
Questions people ask
Do I need all three?
Yes. SPF and DKIM let receivers check an email is genuine. DMARC is what makes them act on that check, and it is the only one of the three that stops somebody using your exact domain in the From line.
What does p=none do?
Nothing to the mail itself. It turns on reports, so you can see every server sending as your domain before you start blocking anything. It protects nobody until you move on to quarantine or reject.
How long should it take to reach p=reject?
Usually a few weeks to a few months, depending on how many services send email as your domain. Move on once every legitimate sender passes in the reports.
Will DMARC stop all phishing?
No. It stops criminals using your exact domain. Lookalike domains, such as one with an extra word or a swapped letter, need staff awareness and monitoring as well.
Does our DMARC record affect the email we receive?
No. Your record tells other mail servers what to do with mail claiming to be from you. Your own provider uses other senders' records to protect your inbox.
Why does forwarded email fail SPF?
A forwarding server sends the message on from its own address, which is not in your SPF record. DKIM usually survives forwarding, so with DKIM signing for your domain, DMARC still passes.
Keep going
Where this comes from
The records shown are examples with placeholder values. Use the exact values each of your providers gives you.