How to Set Up DMARC, SPF, & DKIM to Prevent Phishing (Free Tools Only)

Email phishing is one of the most prevalent and costly threats currently facing businesses. Attackers simply need to spoof a legitimate domain and get the recipient of the email to share sensitive data, transfer funds, or click on a link that may include malware. But don’t panic; you can prevent your domain from being spoofed, specifically through a set up DMARC, and SPF (and DKIM), for free!

In this guide, we will cover what will happen if you do not configure those records, cover free tools you can use to check your current settings (which will include Mesa Security’s free email scanner), and how to set up DMARC, SPF, and DKIM step by step.

What Happens If You Don’t Set Up DMARC or SPF

Imagine someone sends an email to a customer pretending to be you (for example, from “ceo@yourdomain.com”). The email ends up in your customer’s inbox and looks authentic, including your logo and tone. The customer clicks on the link, enters their login information, and now their account is compromised.

Without SPF, DKIM, and DMARC:

• Attackers can spoof your domain and impersonate your brand.
• Spoofed email may bypass spam filters and hit your partners, customers, and employees.
• Your domain loses reputation and have interrupted mail delivery.
• You have no visibility or control of the domain abuse.

Lets stop that from happening.

Free Tools to Check Your DMARC, SPF, and DKIM Status

Before you start anything, check your existing configuration with these free tools:

• Mesa Security’s Free Email Scanner: Upload any email into the free email scanner, and you’ll see right away if you have DMARC, SPF, and DKIM properly configured to the domain attached to the email.
• MXToolbox (mxtoolbox.com): Great for testing SPF and DNS record lookups.
• Google Admin Toolbox Dig (toolbox.googleapps.com): Invaluable for inspecting DNS and email authentication records.
• DMARCian (dmarcian.com): Visualizes your DMARC policies and checks for alignment.
• Mail-tester (mail-tester.com): Test how your email is perceived by spam filters and if your SPF/DKIM/DMARC are passing.

Step-by-Step: How to Set Up SPF, DKIM, and DMARC

1. Set Up SPF (Sender Policy Framework)

Why it matters: SPF tells receiving mail servers which IP addresses or services (like Google Workspace or Microsoft 365) are allowed to send email on your domain’s behalf.

How to do it:

1. Log into your domain registrar (e.g., GoDaddy, Namecheap).
2. Find DNS Settings > Add a TXT record.
3. Set the Name to: @
4. Set the Value to something like:
   
   v=spf1 include:_spf.google.com ~all
   
   This tells the world that Google is allowed to send on behalf of your domain. Adjust based on your provider (Mailchimp, Outlook, etc.).
5. Test it with Mesa’s Free Scanner to make sure the SPF record is valid.

2. Set Up DKIM (DomainKeys Identified Mail)

Why it matters: DKIM uses cryptographic signatures to confirm that the content of an email hasn’t been altered in transit and that it’s from your domain.

How to do it:

• For Google Workspace:
  • Go to Admin Console > Apps > Google Workspace > Gmail > Authenticate Email.
  • Generate DKIM key and add it as a TXT record in your DNS.
• For Microsoft 365:
  • Use PowerShell or the Microsoft 365 admin center to enable DKIM.

Again, Mesa Security’s scanner will tell you if DKIM is missing or misconfigured.

3. Set Up DMARC (Domain-based Message Authentication, Reporting & Conformance)

Why it matters: DMARC tells recipients what to do if SPF and DKIM checks fail (e.g., quarantine or reject the message). It also gives you reports about who is sending email on your behalf. Therefore, when you set up DMARC, you prevent attackers from spoofing your domain and thus protecting your brand.

How to do it:

1. Add a TXT record to your DNS:
   • Name: _dmarc
   • Value:
     v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; fo=1
p=none means “monitor only.”
     Change to quarantine or reject once you’re confident legitimate mail sources are covered.
     rua is the email address where DMARC reports will go.
2. Over time, analyze the reports (use dmarcian or Postmark’s DMARC analyzer) to see what mail sources are failing.
3. Once confident, change the policy:
   • p=quarantine: send suspicious mail to spam.
   • p=reject: block it entirely.

Final Tips

Start with SPF. It’s easy and often already exists.

Next, set up DKIM to validate the contents have not changed.

Finally, set up DMARC to implement your policies and reports.

You should regularly check and monitor your setups using free tools to provide ongoing protection.

Why Small and Medium Organizations (SMBs) should care

Attackers are spoofing even small and midsize businesses using generative AI and bulk-sending tools. One impersonated email could lead to a data breach, legal matters, or a lost customer. Ensuring that you have set up DMARC, SPF, and DKIM offers credibility to your brand and reduces risk, while completely free to implement.

Need help checking if you have set up DMARC? Use the Mesa Security Free Scanner now with any email from the domain you want to check and get instant visibility in the ‘Summary’ portion of the scan results:

It’s the easiest way to get a health check on your email security setup – no registration required and no credit cards.