DNS Email Authentication: SPF Records & DMARC Enforcement

Why Domain Email Security Matters#

The Simple Mail Transfer Protocol (SMTP) was designed in 1982 without built-in identity verification. By default, any mail server on the internet can send messages claiming to originate from ceo@yourcompany.com or billing@yourdomain.com.

Attackers routinely exploit this architectural flaw to launch business email compromise (BEC) attacks, executive impersonation, and credential phishing against your customers and employees.

To protect your brand reputation, modern mail receivers (including Google, Microsoft 365, and Yahoo) require domains to publish authoritative SPF, DKIM, and DMARC DNS records.

---

What SiteSecura Checks#

SiteSecura's DNS scanning module queries authoritative nameservers for three critical email security controls:

1. Sender Policy Framework (SPF)#

• What it does: A DNS TXT record that explicitly enumerates which IP addresses and third-party mail providers (e.g. Google Workspace, SendGrid) are authorized to send mail on behalf of your domain.
• Evaluation:
  • Pass: Valid record starting with v=spf1 ending with a hard fail (-all) or soft fail (~all).
  • Warning: Overly permissive record ending with neutral (?all) or pass (+all).
  • Fail (High Severity, -15 pts): Missing SPF record or multiple conflicting SPF records (RFC 7208 violation).

2. DMARC (Domain-based Message Authentication)#

• What it does: Published as a TXT record at _dmarc.yourdomain.com. Tells receiving mail servers what to do if an incoming email fails SPF or DKIM checks, and specifies where to send forensic failure reports.
• Evaluation:
  • Pass (Enforced): p=reject (unauthorized mail is discarded) or p=quarantine (unauthorized mail is sent to spam).
  • Warning (Medium Severity, -5 pts): p=none (monitoring mode only; does not protect against spoofing).
  • Fail (High Severity, -15 pts): Missing DMARC record.

3. DNSSEC (DNS Security Extensions)#

• What it does: Cryptographically signs DNS zone records to prevent DNS cache poisoning and man-in-the-middle DNS spoofing.
• Evaluation: SiteSecura verifies whether DS records exist at the parent registry.

---

Step-by-Step Configuration Guide#

1. Creating Your SPF Record#

Add a TXT record at your root domain:

• Host: @ (or blank)
• Type: TXT
• Value:

  v=spf1 include:_spf.google.com include:sendgrid.net -all
  

Warning: Never publish more than one SPF record on a single domain. Combine all authorized mail senders into a single TXT entry.

2. Creating Your DMARC Record#

Add a TXT record at the _dmarc subdomain:

• Host: _dmarc (or _dmarc.yourdomain.com)
• Type: TXT
• Initial Monitoring Mode (Phase 1):

  v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com; sp=none;
  

• Enforcing Policy (Phase 2 — Recommended):

  v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.com; aspf=r;
  

---

Verifying Your DNS Records#

Test your DNS and email authentication setup using SiteSecura's free tools:

• Use the Email Security Checker to validate SPF syntax, DMARC policy strength, and alignment.
• Use the DNS Lookup Tool to inspect real-time authoritative TXT, MX, and SOA records directly from upstream nameservers.