Mohamed Sharaf
Menu
Infrastructure

SPF, DKIM, DMARC: finish the job

Many domains publish DMARC but stop at p=none, which protects nothing. Here’s how to get to reject without losing real mail.

· 1 min read

Since Gmail and Yahoo started requiring authentication from bulk senders, most companies added SPF, DKIM and a DMARC record. Many stopped at p=none. That setting only reports. Anyone can still send email that looks like it comes from your domain.

Getting to p=reject is mostly patience:

  1. Add a reporting address to your DMARC record and use a free or cheap tool to read the reports.
  2. For two to four weeks, find every legitimate sender: your mail platform, CRM, invoicing system, website forms, newsletter tool.
  3. Set up SPF or DKIM for each one until they all pass.
  4. Move to p=quarantine, watch for a couple of weeks, then p=reject.

Also protect domains you own but don’t send from, with a DMARC reject record and an empty SPF. Scammers love unused domains.

ShareWhatsAppLinkedInXTelegramFacebook