Check SPF, DKIM and DMARC before someone sends email as you
Run our free email security checker on your domain. One scan shows whether SPF, DKIM and DMARC are set up, and whether a scammer could send email that looks like it came from your business.
A fake invoice in your name hurts your customer first
Email spoofing never touches your inbox. It goes straight to your customers, using your address and your name.
Here is how it usually goes. Your customer gets an email from your accounts address, signed by your bookkeeper. It says your bank details have changed and the attached invoice is due today.
Nothing looks wrong, because the From line really shows your address. The scammer sent it from their own server. If your domain has no DMARC policy, many inboxes will still deliver it.
Your customer pays the wrong account. You are still owed the money, and they start doubting every email you send after that.
Agencies that take deposits by bank transfer are an obvious target, but any business that invoices by email can be used this way.
- Business email compromise: How scammers pose as a business or its staff to redirect payments, explained in our glossary.
- Phishing: The wider family of fake emails that spoofing makes more convincing, explained in plain English.
Photo by Department of Foreign Affairs and Trade on Wikimedia Commons (CC BY 2.0)
.jpg){kind=link}
What SPF, DKIM and DMARC check, and what a pass or fail
Pick a record to see what it does in plain English and what your checker result is telling you.
SPF
SPF is a list in your domain's DNS of the services allowed to send email for you, such as Microsoft 365, Google Workspace or your invoicing software. Pass: the record exists and receiving servers can check senders against it. Fail or missing: any server can claim to send as you, and some genuine emails may land in junk. A common fault is having two SPF records, which breaks both.
DKIM
DKIM adds a hidden signature to each email your systems send. The receiving server checks it against a public key published in your DNS. Pass: the message came from a service you set up and was not changed on the way. Fail or not found: a key is missing, or a service you use has not been set up to sign email for your domain. Each sending service needs its own key.
DMARC
DMARC tells receiving servers what to do with email that fails SPF and DKIM: let it through (none), send it to junk (quarantine) or refuse it (reject). It can also send you reports. Pass: a record exists. Protected: the policy is quarantine or reject. A none policy is a sensible first step for watching, but it does not stop spoofed email reaching inboxes.
Can it be spoofed?
The checker reads all three records together. Your domain is hard to spoof when SPF and DKIM pass and DMARC is set to quarantine or reject. If DMARC is missing or set to none, a scammer can still send email showing your exact address in the From line. The Australian Cyber Security Centre at cyber.gov.au publishes guidance on these same records.
What to ask your email provider or web designer to fix
You do not need to edit DNS yourself. Whoever manages your domain, often your web designer or IT provider, can make these changes. Send them this list in this order.
Send them your checker result
Copy the result from the free email security checker into an email. It shows which record is missing or failing, so nobody has to guess.
List every service that sends as you
Include your mailbox provider, invoicing and accounting software, newsletter tool, booking system and website contact form. Anything missing from this list will fail once DMARC is tightened.
Merge SPF into one record
Ask for a single SPF record that names every service on your list. Two records, or a record that is too long, can stop SPF working at all.
Turn on DKIM for each service
Each sending service gives its own DKIM key to publish in your DNS. Ask your provider to confirm every service on the list is signing your email.
Start DMARC at none, with reports
A DMARC record set to none, with a reporting address, shows who is sending as your domain without blocking anything yet.
Move to quarantine, then reject
Once the reports show your genuine email passing, ask for quarantine, then reject. This is the step that stops spoofed email reaching inboxes. Then run the checker again to confirm.
Questions owners ask after they check SPF, DKIM and DMARC
Frequently Asked Questions
- Do I need all three records?
- Yes. SPF and DKIM let receiving servers confirm an email is genuine, and DMARC tells them what to do when it is not. Without DMARC at quarantine or reject, passing SPF and DKIM still leaves room for spoofed email to get through.
- Will tightening DMARC stop my own emails arriving?
- It can if a service that sends for you was left off SPF or has no DKIM key. That is why the fix starts at a none policy with reports, so your provider can see every genuine sender before moving to quarantine or reject.
- Who should I ask to fix my records?
- Whoever manages your domain's DNS. That is usually your web designer, your IT provider or the company you registered the domain with. Your mailbox provider, such as Microsoft 365 or Google Workspace, also has setup steps for DKIM.
- Does this stop lookalike domains?
- No. SPF, DKIM and DMARC protect your exact domain. A scammer who registers a similar name, with one letter changed, sets up their own records. Our lookalike domain monitoring page explains how to watch for copies of your business name.
- A customer received a fake invoice in our name. What now?
- Tell the customer straight away and ask them to contact their bank. Report it through ReportCyber at cyber.gov.au. Then run the email security checker and send the result to whoever manages your domain so the gap is closed.
- Is the email security checker free?
- Yes, it is one of our free tools and you can run it on any domain. If you want ongoing alerts, start with the free plan. Paid add-ons are from a few dollars a month, and current prices are on our pricing page.