What do SPF, DKIM and DMARC do?

SPF lists which servers may send email for your domain. DKIM cryptographically signs outgoing mail. DMARC ties them together with a policy (none/quarantine/reject) telling receivers what to do with spoofed mail. Together they prevent phishing using your brand.

What DMARC policy should I use?

Start with p=none to collect reports, move to p=quarantine once legitimate mail passes, then p=reject for full protection. Most domains with no DMARC are fully spoofable.

Free tool · No signup

Free email security checker

Verify your domain's SPF, DKIM, DMARC, BIMI and MX records in seconds. Find out if attackers can spoof email as your brand — and get an instant A–F grade with specific fixes.

Email is one attack surface — check your website too. Run a full scan →