Fix guides

Stop people sending email as you

Without three DNS records called SPF, DKIM and DMARC, anyone can send an email that looks exactly like it came from example.com, and the receiving mail server has no way to tell. This guide sets up all three, in the order that avoids blocking your own mail.

Who does this
Whoever manages your domain's DNS. Often your IT provider, or whoever set up your email.
How long
About 30 minutes of work, then two to four weeks of watching before the final step.
Fixes
  • No DMARC record found
  • DMARC is published but set to monitor-only (p=none)
  • DMARC is enforced, but no SPF record was found

Before you start

  • DNS records are edited wherever your domain's DNS is hosted. That is usually the company you pay for the domain name, or Cloudflare if you use it. Log in and look for "DNS", "DNS records", "Zone editor" or "Manage DNS".
  • An admin login for your email provider (Google Workspace or Microsoft 365), for step 3.

  1. List everything that sends email as you

    Your mailbox provider is the obvious one. Also think about anything that sends mail from an address at example.com on your behalf: invoicing or accounting software, newsletter tools, your website's contact form, booking or CRM systems.

    Each of these has to be allowed in step 2 or 3. Anything you miss is the thing that starts landing in spam at step 6, so this list is worth five minutes.

  2. Publish one SPF record

    SPF is a list of the services allowed to send mail for example.com. It is a TXT record on the domain itself, often entered as "@".

    There can only be one SPF record. If one already exists (it starts with v=spf1), edit it rather than adding a second; two SPF records break both. For each extra sender on your list, add the include: value its own help pages give you, before the final ~all or -all. More than ten lookups (each include: counts at least once) also breaks SPF, so don't add services you no longer use.

    Google Workspace only

    The record Google gives for mail sent only through Google Workspace:

    Type
    TXT
    Name
    @
    v=spf1 include:_spf.google.com ~all
    Microsoft 365 only

    The record Microsoft gives for mail sent only through Microsoft 365:

    Type
    TXT
    Name
    @
    v=spf1 include:spf.protection.outlook.com -all

  3. Turn on DKIM signing

    DKIM puts a signature on every email you send, which the receiving server checks against a key published in your DNS. Your email provider creates the key; you publish it and then switch signing on.

    Services on your list from step 1 that send as example.com usually have their own DKIM setting too. Look for "domain authentication" or "DKIM" in their settings.

    Google Workspace

    In the Admin console, go to Apps, then Google Workspace, then Gmail, then Authenticate email. Generate a new record, keep the default selector (google), and publish it as a TXT record at google._domainkey. When it has been published, come back to the same page and click Start authentication.

    Microsoft 365

    In the Microsoft Defender portal, open Email authentication settings and the DKIM tab, then select example.com. It shows two CNAME records to publish, at selector1._domainkey and selector2._domainkey. Copy the exact values from there; they are specific to your organisation. Once both are published, switch signing on for the domain.

  4. Publish DMARC in monitor mode

    DMARC tells receiving servers what to do with mail that fails SPF and DKIM, and asks them to send you a daily report. Start with the policy p=none, which changes nothing about delivery: it only turns the reports on.

    Point the reports at a mailbox or alias you set up for the purpose rather than a person's inbox; they are frequent and machine-readable. Perimeter shows this stage as "Needs a look", which is expected until step 6.

    Type
    TXT
    Name
    _dmarc
    v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com

  5. Watch the reports for two to four weeks

    The large mail providers send a report most days, as a compressed XML file. They are hard to read by hand; a DMARC report reader (there are free and paid ones) turns them into a list of who sent mail as example.com and whether it passed.

    You are looking for your own services failing. If one does, go back to step 2 or 3 for it. Mail from addresses you don't recognise that fails is exactly what the next step will stop.

  6. Switch DMARC to enforcement

    When the reports show your own mail passing, change p=none to p=quarantine, which sends failing mail to spam. After a few more weeks of clean reports, change it to p=reject, which refuses it outright.

    Either of these clears the finding in Perimeter. Only the p= part of the record changes; keep the rua= address so the reports keep coming.

    Type
    TXT
    Name
    _dmarc
    v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

Check it worked

DNS changes usually take effect within an hour, and occasionally take up to a day. After that, re-run the checks from the business's report page, or grade the domain again on the home page.

Own a domain that never sends email? Publish "v=spf1 -all" as its SPF record and "v=DMARC1; p=reject;" at _dmarc, so nobody can send as that one either.

The provider's own instructions

Menus move. If a step here doesn't match what you see, these pages are the source of truth.