FmindSecurity guide
Email spoofing protection (DMARC)
Without a DMARC policy, criminals can more easily send emails that look like they come from your business, and mailbox providers have no instruction to block them. If several DMARC records exist, none is applied.
Who can help
Your email administrator and DNS manager
Inspect before changing
Use these steps for a website or email domain you manage. Complete the capitalized placeholders with your own values. If a step refers to saved evidence, run the free check and verify your domain to open the private report. Use the exact hostname or DNS query name shown there.
- Read the policy for the From domain confirmed by its owner. Review SPF/DKIM alignment and existing reports before tightening the policy. Never replace a working quarantine or reject policy with a weaker example.
dig +time=3 +tries=1 TXT _dmarc.YOUR_FROM_DOMAINWhat to do
First set up SPF and DKIM for every service that sends email for you. Then publish a single DMARC record (_dmarc.your-domain) with p=none and a monitored reporting address: it monitors without blocking. After a few weeks of clean reports, move step by step to p=quarantine, then p=reject; going strict too early can block your own emails.
How to verify the change
Once the DNS change has taken effect, run this check again: this item shows Good once the policy is p=quarantine or p=reject. Then check in the DMARC reports that your legitimate emails pass.
Step-by-step email setup
What this check can establish
We read the _dmarc record of your email domain and its requested policy (p=). We don’t check parent domains or reports, access mailboxes or send test emails.