Three DNS records decide whether a stranger can send email that appears to come from your domain. They are usually explained as one blob of acronyms, so here is what each does — in the order they were invented, which is also the order to fix them.
The email authentication check costs one credit and needs no proof of ownership: every record it reads is public DNS.
SPF — who may send
A list of the servers allowed to send mail for your domain. A receiver compares the connecting server against that list.
Two things go wrong. The record ends in ~all (soft fail, meaning "treat as suspicious") when it should end in -all (hard fail) — and a soft fail is widely ignored. And SPF permits at most ten DNS lookups; every include: for a mail vendor spends some, and once you exceed ten the record is invalid and the whole check fails open. The report shows how many of the ten you have used, because that number creeps up quietly each time a department adds a tool.
DKIM — a signature on the message
A cryptographic signature added by your mail server, verified against a public key in your DNS. Where SPF says this server was allowed to send, DKIM says this message was not altered in transit and really came from you. It survives forwarding, which SPF often does not.
DMARC — what to do when they fail
The one that turns the other two into protection. DMARC tells receivers what to do with mail that fails SPF and DKIM, and where to send reports.
This is where most domains stop too early. p=none collects reports and blocks nothing — it is the monitoring stage, not protection. The path is none → read the reports → quarantine → reject. A domain sitting on p=none two years later is publishing a record that stops precisely zero spoofed emails.
The three that come after
MTA-STS requires that mail to your domain be delivered over TLS, closing a downgrade attack that SMTP otherwise allows. TLS-RPT asks other servers to report failures so you find out. BIMI puts a verified logo beside your messages in supporting clients, and requires DMARC at enforcement first — which makes it a decent internal argument for finishing the job.
What you get
Every record, its raw DNS answer, and what is wrong with it — plus a generator that writes the exact record to paste into your DNS provider, giving you the name as well as the value. The name is the half people get wrong.
Publishing the records is not the same as proving they work. That is what the live spoofing test is for.
Run it free: every new account gets starter credits, and this check costs one. Start at app.clickscan.ai.