SPF and DMARC: stop fake email from your domain

By Shinobi Tech, the team behind AppLeakWatch. Updated .

SPF lists who may send email for your domain, and DMARC tells receiving servers what to do with mail that fails the checks. Without them, it's easier for someone to send email that looks like it came from you.

Why this happens

Launch checklists rarely mention email, so these DNS records are easy to miss, even when your app sends no email at all.

How to check

  1. Look up your records:
    dig +short TXT yourdomain.com
dig +short TXT _dmarc.yourdomain.com
  2. You want one record starting with v=spf1 and one starting with v=DMARC1.
  3. A DMARC policy of p=none only watches. p=quarantine or p=reject acts on failures.

How to fix it

  1. Add an SPF record for your real email provider. This Google Workspace example is one TXT record:
    v=spf1 include:_spf.google.com ~all
  2. Start DMARC in watch mode at _dmarc.yourdomain.com:
    v=DMARC1; p=none; rua=mailto:you@yourdomain.com
  3. Read the reports, confirm your real email passes, then move to p=quarantine and later p=reject.

Prompt for your AI tool

List every service that sends email for my domain, then write the SPF and DMARC DNS records I need. Start DMARC at p=none, and explain when it's safe to move to p=quarantine and p=reject.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

My app doesn't send email. Do I still need this?

Yes. Strangers can still try to send mail as your domain. A domain that sends no mail can publish a strict SPF and DMARC policy.

Can this break my real email?

It can if a sender is missing from SPF, so start DMARC with p=none and read the reports first.

Related guides