Someone receives an email that looks like it's from your domain ("billing@yourcompany.com") asking for an urgent payment, but you never sent it. This is email spoofing: forging the sender of an email to impersonate someone else's domain. The reason it still works in 2026 is that a huge number of domains don't have the three mechanisms configured that prevent it: SPF, DKIM and DMARC.
Why email is so easy to fake by default
The email protocol (SMTP) doesn't include, by original design, any verification that an email's sender is really who they claim to be. Any server can, technically, send an email claiming to come from any address. SPF, DKIM and DMARC are layers added later to plug that gap, and they only work if a domain configures them explicitly.
SPF: who's allowed to send on your behalf
SPF (Sender Policy Framework) is a TXT-type DNS record listing which servers are authorized to send email on behalf of your domain. When a receiving server gets an email, it checks whether the sending server is on that authorized list. If it isn't, that's a signal the email might be fake.
DKIM: cryptographic signature of the content
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the email, generated with a private key only the legitimate domain controls. The receiving server can verify that signature with the public key published in the domain's DNS. If the email's content was tampered with along the way, or if it wasn't signed by whoever claims to be the sender, verification fails.
DMARC: the policy that says what to do if something fails
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the piece that ties SPF and DKIM together: it defines what a receiving server should do if an email fails SPF or DKIM checks (ignore it, mark it as spam, or reject it outright), and it lets you receive reports of spoofing attempts against your domain.
How to check a domain's protection
- Enter the domain.
- The tool verifies the three related DNS records (SPF, DKIM, DMARC).
- You get a verdict: protected, partial or unprotected.
You can do it free with the email security tool on this site.
What each verdict means
- Protected: all three mechanisms are correctly configured, including a DMARC policy that rejects or quarantines emails that fail verification.
- Partial: some mechanisms exist but are incomplete, for example SPF configured but no DMARC, or DMARC in "monitor only" mode with no real action taken on failure.
- Unprotected: some or all mechanisms are missing. Anyone can send emails impersonating this domain and most receiving servers will have no clear signal to reject them.
Why this matters even if you don't send much email
A domain without these records configured is an easy target for targeted phishing: attackers prefer to impersonate real, reputable domains (yours, if you have an established site) over freshly created ones that spam filters already distrust by default. Configuring SPF, DKIM and DMARC doesn't directly protect your own inbox: it protects third parties from receiving fake emails that look like they're from you, and it protects your domain's reputation.
Frequently asked questions
Do I need all three to be protected? Yes, SPF and DKIM without a DMARC policy that acts on failures leaves the final decision up to each receiving server, which may or may not reject the suspicious email.
Does this protect the email I receive? Indirectly: it protects your domain from being used to impersonate others, and if every domain configured it, spoofing overall would drop.
Is it complicated to set up? The records are simple TXT-type DNS entries; the difficulty is usually identifying every legitimate service sending email on your behalf (marketing, CRM, billing) so you include all of them in SPF without accidentally excluding one.
What if my domain never sends email? It's still recommended to set a restrictive DMARC (p=reject), precisely because no one should be able to send valid email on its behalf.
Check whether your domain is protected against spoofing for free with the email security tool, with SPF, DKIM and DMARC verdict at a glance.