Home / Guide
Can your domain be forged? Check it in five minutes
Three DNS records decide whether anyone can send email in your name. Here is how to read them yourself, what they mean and how to fix them. If you prefer, we measure them for free.
| Records to check | 3: SPF, DKIM, DMARC |
| Time | five minutes with nslookup |
| Who changes them | whoever manages the domain, in the DNS panel |
| Safe path | none, then quarantine, then reject |
| Cost of the DIY check | zero |
Why it matters
If your domain is unprotected, a fake invoice with your address as the sender reaches your customers and no server stops it. There is a quieter effect too: Google and Yahoo since 2024, Microsoft since 2025, require authentication from bulk senders and treat unauthenticated mail with suspicion. Order confirmations land in spam and nobody tells you.
In our study of 1,263 Italian e-commerce sites, 84.2% were in this situation.
The three records
| Record | Where it lives | What it does | Sign of trouble |
|---|---|---|---|
| SPF | a TXT record on the domain starting with v=spf1 | says which servers may send in your name | missing, or ending in ~all or ?all |
| DKIM | a TXT record at selector._domainkey.yourdomain.com | signs every email so the receiver knows it was not altered | missing: your email provider tells you the selector |
| DMARC | a TXT record at _dmarc.yourdomain.com starting with v=DMARC1 | says what to do with mail that claims your domain but fails the checks | missing, or set to p=none |
How to read them yourself
All you need is a terminal. On Windows open PowerShell, on Mac or Linux the Terminal, and type, replacing your domain:
nslookup -type=TXT yourdomain.com
nslookup -type=TXT _dmarc.yourdomain.comThe first command shows the SPF, if any: look for the line starting with v=spf1 and see how it ends. The second shows DMARC: look for v=DMARC1 and the p= part. DKIM needs the selector name, which depends on your email provider: the common ones are default, google, selector1 and selector2, checked with nslookup -type=TXT selector._domainkey.yourdomain.com.
If you would rather not do it by hand, the instant check runs these for you and shows the result straight away, with no email asked.
What your result means
| What you find | What it means | Result |
|---|---|---|
| No DMARC | Anyone can write in your name and the mail gets delivered | FAIL |
DMARC with p=none | The record exists but asks to block nothing: it only observes | FAIL |
DMARC with p=quarantine | Forged mail lands in the receiver’s spam | TO MEASURE |
DMARC with p=reject and SPF with -all | Forged mail is rejected before it arrives | PASS |
How to fix it without breaking your mail
The classic mistake is jumping straight to p=reject: if a legitimate service, your ERP or your newsletter tool, is not in the SPF, its emails get rejected from that moment. The safe sequence has three steps of about a month each.
- Observe. Publish DMARC with
p=noneand arua=address to receive reports. The reports show everyone sending in your name, including services you forgot you used. - Complete. Add every legitimate service from the reports to the SPF and enable DKIM for each. When the reports show all good traffic passing, move to
p=quarantine. - Close. After another clean month,
p=rejectand SPF with-all. From there forged mail no longer arrives.
These are DNS changes, not website changes: whoever manages the domain makes them, usually in the registrar panel, and no developer is needed.
Prefer us to measure it
We run the same checks, plus DKIM across a list of selectors and MTA-STS, and send you the result in writing within 48 working hours. Free, and the measurement starts only if you ask.
This guide is not legal advice and does not replace configuration by whoever manages your email.