Every domain that sends email can, in principle, be forged — that’s just how SMTP works. Nothing in the base protocol stops a stranger from typing your address into the From: line and blasting invoices, password resets, or CEO-fraud messages to your customers. What actually decides whether that forgery lands in an inbox or gets thrown out is a small stack of DNS records you control. This check reads those records and tells you how exposed your exact domain is right now. The uncomfortable truth for most domains: having SPF and DKIM feels like protection, but without one specific piece it does almost nothing to stop a spoof.
Why SPF and DKIM alone don’t stop spoofing
This is the part that surprises people. SPF checks the hidden envelope sender (the return-path), not the From: your recipients actually see. DKIM proves a message was signed by some domain, but on its own it doesn’t require that domain to match your visible From:. So an attacker can send mail that carries your brand in the From line while SPF and DKIM pass against their own throwaway domain. The visible identity and the authenticated identity are simply not tied together — until you add the record that binds them.
DMARC is the record that ties it together — but only at enforcement
DMARC, defined in RFC 7489, is the control that says: for a message to be trusted as coming from this domain, SPF or DKIM must pass and the passing domain must align with the visible From:. That alignment requirement is what closes the spoofing hole. But DMARC only helps if its policy tells receivers to act:
p=reject— receivers throw out mail that fails alignment. This is real protection: forged mail from your exact domain gets bounced. Lowest risk.p=quarantine— failing mail goes to spam rather than the inbox. Partial protection; a determined spoof may still be seen. Medium risk.p=none— receivers take no action on failures; they just send you reports. This is monitor-only mode. It is not protection. High risk.- No DMARC at all — nothing binds your From to authentication. Anyone can forge you. Highest risk.
The single biggest misconception in email security is that publishing a DMARC record protects you. p=none is where every domain should start — it collects the reports that show you which of your legitimate senders would break — but staying there indefinitely leaves the door wide open. Protection begins at quarantine and is complete at reject.
How SPF and DKIM strength still matter
DMARC does the binding, but it needs something to bind to, so the quality of your SPF and DKIM feeds directly into your risk:
- SPF policy. A strict
-all(hard fail) tells receivers exactly which servers may send for you. A soft~allor a missing SPF record is weaker and gives DMARC less to work with. - DKIM robustness. A valid, aligned DKIM signature survives forwarding and mailing lists, where SPF often breaks. It’s the most durable way to earn a DMARC pass, so healthy DKIM keys reduce false failures and make a strict policy safe to deploy. Verify yours with the DKIM checker.
- Subdomains. A DMARC policy on your root domain covers subdomains via the
sp=tag, but attackers love unprotected subdomains (mail.yourdomain.com,news.yourdomain.com). Make sure your policy — and your default subdomain policy — is set to enforce.
Run each layer through the SPF, DKIM and DMARC checkers, or get all three at once with the email health check.
The one thing DMARC can’t fix: lookalike domains
DMARC protects your exact domain. It does nothing about cousin or lookalike domains — yourdomaln.com, yourdomain-support.com, yourdomain.co — which an attacker registers and controls entirely, complete with their own valid SPF, DKIM and DMARC. To recipients skimming a phone screen these read as you. Closing that gap is a different discipline: register the obvious variants yourself, monitor new registrations that resemble your brand, and pursue takedowns when impersonation appears. It’s worth knowing where enforcement stops so you don’t assume a passing DMARC check makes you untouchable.
Getting to reject — and the BIMI payoff
The path is deliberate but not hard:
- Publish
p=nonewith a reporting address and collect aggregate reports for a few weeks. - Read the reports to find every legitimate sender — your ESP, CRM, support desk, billing system — and get each one authenticating with aligned SPF or DKIM.
- Move to
p=quarantine, optionally with a percentage rollout, and watch for collateral damage. - Once reports are clean, move to
p=reject. Now your exact domain can’t be spoofed into inboxes.
There’s a downstream reward. Once you’re at enforcement, you become eligible for BIMI — the standard that displays your verified brand logo next to authenticated mail in Gmail, Apple Mail and others. BIMI requires DMARC at quarantine or reject, so it’s both a trust signal for recipients and a concrete incentive to finish the journey. Organizations like M3AAWG publish detailed guidance on rolling out enforcement safely.
Frequently asked questions
- I have SPF and DKIM — why is my spoofing risk still High?
- SPF checks the return-path and DKIM proves a signature exists, but only DMARC ties them to your visible
From:— and only when enforced. Withp=nonereceivers act on nothing. Move DMARC to quarantine, then reject. - Is publishing a DMARC record enough to protect my domain?
- Only at enforcement.
p=noneis monitor-only — it reports but stops nothing. Protection starts atquarantineand is complete atreject. Start at none, then move up. - Does DMARC stop lookalike-domain spoofing?
- No — DMARC protects your exact domain. Lookalike domains like
yourdomain-support.comare controlled by the attacker, so DMARC never applies. Use monitoring, defensive registrations and takedowns. - What is BIMI and do I need it?
- BIMI shows your verified logo next to authenticated mail. It requires DMARC at quarantine or reject, so it’s a payoff for reaching enforcement — optional, but a strong trust signal.