Email Security Checker

Email was never designed with sender verification in mind, so nothing in the core protocol stops someone from typing your domain into the "From" field of a message. SPF, DKIM and DMARC were added afterwards, and each one is optional and independently configured. A domain with none of them set up sends a signal to mail servers that anyone is free to fill in, which is exactly what phishing campaigns rely on when they impersonate a company's billing or support address.

This is the part plain pass/fail checks miss. An SPF record with a +all qualifier technically exists, but it authorizes any server on the internet, so it protects nothing. A DMARC record set to p=none exists too, but it only emails you a report after the fact; it never stops a spoofed message from reaching an inbox. Both look fine on a checklist and both leave the domain exposed.

All three records are added as TXT entries through your DNS provider, not through your mail server or application code. Your email provider's documentation (Google Workspace, Microsoft 365, or whichever service sends your mail) will give you the exact SPF include and DKIM selector to publish. DMARC is the one you configure yourself: start at p=none to collect reports without blocking anything, confirm your legitimate mail is passing, then move to p=quarantine or p=reject.