Email security
How to Prevent Email Spoofing of Your Domain
By PixelPrivate Security Team · Published · Updated · 8 min read
Short answer: To prevent email spoofing, publish an SPF record listing your senders, enable DKIM signing with your email providers, then publish a DMARC record that starts at p=none with reporting and moves to p=quarantine and p=reject once reports show your legitimate mail passes.
Inventory every sender
List every service that sends email using your domain: mailbox provider, newsletter tool, CRM, invoicing, website forms, helpdesk. Missing one is the most common cause of legitimate mail failing after enforcement.
Publish SPF
Create one TXT record at the domain root that includes each sender and ends with -all or ~all.
v=spf1 include:_spf.google.com include:servers.mcsv.net -allEnable DKIM
In each sending service, turn on DKIM and publish the DNS record it gives you. Use 2048-bit keys where offered.
Publish DMARC in monitor mode
Add a TXT record at _dmarc with p=none and a rua mailbox. This changes no mail delivery but starts reports.
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.comRead reports, fix failures
After two to four weeks, look for legitimate senders that fail SPF and DKIM alignment and fix them.
Move to enforcement
- Change to p=quarantine (optionally with pct=25, then 50, then 100).
- After a few stable weeks, change to p=reject.
- Keep reporting on so you notice new senders.
Do not forget parked domains
Domains you do not send mail from should publish v=spf1 -all and a p=reject DMARC record so they cannot be abused.
Checklist
- ☐ Sender inventory done
- ☐ SPF published (one record)
- ☐ DKIM enabled on every sender
- ☐ DMARC p=none with rua
- ☐ Reports reviewed
- ☐ p=quarantine then p=reject
- ☐ Parked domains locked down
Methodology
Procedure based on RFC 7208, RFC 6376 and RFC 7489 and common provider documentation. Rollout timing depends on how many services send email as you.