Three DNS records that determine whether someone else can send email that looks like it came from your domain.
Email has no built-in way to prove who actually sent a message — the "From" address is just text, and anyone can put anything there. SPF, DKIM, and DMARC are three separate DNS records that, together, let receiving mail servers check whether a message claiming to be from your domain actually came from a server you authorised.
A DNS TXT record listing which mail servers are allowed to send email for your domain. A receiving server checks the sending server's IP against this list — if it's not there, the message fails SPF. Without an SPF record, there's no list at all, so nothing stops an attacker's server from claiming to send on your behalf.
Cryptographically signs outgoing email with a private key; the matching public key is published in DNS. A receiving server verifies the signature — if it checks out, the message genuinely came from a server holding your private key and wasn't altered in transit. Detecting whether DKIM is configured is harder than SPF/DMARC, since it depends on a selector name chosen by whoever set it up.
Tells receiving servers what to do when a message fails SPF and/or DKIM — reject it, quarantine it (spam folder), or do nothing but report it. Without a DMARC record, most mail providers default to doing nothing meaningful with a failed message, which is exactly the gap that lets a spoofed email land in someone's inbox looking legitimate.
Missing DMARC specifically is one of the most common findings on domains that have never had their email setup reviewed — it's not something most website builders or hosting providers configure by default. The practical risk: someone impersonates your domain to email your own customers, suppliers, or staff asking for a payment or credentials, and there's nothing technically stopping it from looking legitimate in the recipient's inbox.
Want to know where your own domain stands? CBWatch checks this — and eight other categories — in about ten seconds, free, no signup.
Run a free scan →Want CBWatch to catch this automatically going forward? See what monitoring includes →