Most domain spoofing is preventable with three DNS records. Together, SPF, DKIM and DMARC let receivers verify that mail claiming to be from your domain actually is.
What each does
- SPF (Sender Policy Framework) - a DNS record listing which servers may send mail for your domain. Receivers check the sending IP against it.
- DKIM (DomainKeys Identified Mail) - the sender cryptographically signs the message; receivers verify the signature with your public key in DNS. Proves the mail wasn't altered and came from you.
- DMARC - ties SPF/DKIM to the visible
Fromdomain (alignment) and tells receivers what to do on failure:p=none(monitor),p=quarantine, orp=reject.
Why all three
SPF and DKIM alone check the envelope - an attacker can still spoof the display From. DMARC enforces that the From a human sees is aligned with what passed authentication. p=reject is what actually blocks spoofing of your own domain.
Deploy safely
Roll out in order: publish SPF + DKIM, then DMARC at p=none with rua= reporting. Read the aggregate reports to find your legitimate senders, fix alignment, then ratchet up to quarantine and finally reject. Do it gradually so you don't drop real mail.
As an analyst: when you triage a suspicious email, the Authentication-Results header (spf/dkim/dmarc = pass/fail) is your fastest objective signal.