Skip to content
whois.is
All posts
Security

SPF and DMARC in plain words

Two DNS records decide whether someone else can send email as your domain. Most throwaway domains publish neither.

whois.is team6 min read
A phone screen with the Mail app showing unread messages

SPF lists the servers allowed to send mail for a domain. DMARC tells receiving servers what to do with mail that fails that check, and where to report it.

Why it matters when checking others

An established business almost always publishes both. A domain with no SPF and no DMARC is not necessarily fake, but it is one more signal to weigh.

Why it matters for your own domain

Without DMARC set to quarantine or reject, anyone can send mail that appears to come from you. Start with p=none, read the reports, then tighten it.

More from the blog