How to Set Up SPF and DMARC: Stop Email Spoofing of Your Domain
By the IDEAVALU team · Updated
Without SPF and DMARC, anyone can send email that claims to come from your domain, and receivers cannot tell the difference. It also makes your app's notification emails more likely to land in spam.
What SPF and DMARC do
SPF declares in DNS which servers may send mail for your domain. DMARC tells receivers what to do with mail that fails SPF or DKIM (signature) checks: nothing, send it to spam, or reject it.
Since 2024 Gmail requires senders to use SPF or DKIM, and bulk senders to use SPF, DKIM and DMARC together.
Check it yourself
Show the DNS TXT records. Lines starting with v=spf1 and v=DMARC1 mean they are set.
SPF (macOS, Linux)
dig +short txt example.com
DMARC (macOS, Linux)
dig +short txt _dmarc.example.com
Windows
nslookup -type=txt _dmarc.example.com
Set up DKIM too
This scan does not check DKIM, because where the public key lives differs by provider. Add the DKIM DNS records shown in your email provider's dashboard as well.
How to fix
SPF
Add exactly one SPF (TXT) record to DNS, with an include for each service that sends your mail.
A domain that sends no email
TXT @ "v=spf1 -all"
Sending with Google Workspace
TXT @ "v=spf1 include:_spf.google.com ~all"
For Brevo, SendGrid, Resend and other senders, add the include shown in their dashboard. Two SPF records cause an error.
DMARC
Add a TXT record at _dmarc. Start with p=none to watch, then tighten to quarantine and reject once nothing breaks.
Start by monitoring
TXT _dmarc "v=DMARC1; p=none; rua=mailto:dmarc@example.com"
A domain that sends no email
TXT _dmarc "v=DMARC1; p=reject"
FAQ
- Should I set these up on a domain that sends no email?
- Yes. With v=spf1 -all and a DMARC record of p=reject, receivers reject every message claiming to be from that domain.