Email & DNS Security
Without SPF and DMARC, anyone can send phishing emails that appear to come from your domain. Without registrar locks, your domain can be hijacked. Both are invisible until the damage is done.
Ludwig Makhyan · Founder, WebsiteCoach ·
Jump to section
Executive Overview
Your domain is a brand asset. Without proper DNS security records, attackers can send phishing emails that look exactly like they came from your company — targeting your customers, partners, or employees. Without registrar locks (EPP codes), an attacker who gains access to your registrar account can transfer your domain away entirely.
Business Impact
Email spoofing attacks using unprotected domains are a leading cause of business email compromise (BEC) fraud, which the FBI reported cost businesses $2.7 billion in 2022. A successful domain hijacking can take your site offline for days and destroy search engine rankings built over years. DMARC enforcement (p=reject) blocks this class of attack at the mail server level.
Source: DNS records retrieved via Cloudflare DNS over HTTPS API.
DNS Records Explained
- SPF record — exists, valid, and strict
- SPF authorizes mail-sending infrastructure. Review permitted senders, lookup limits, and the policy used for other sources.
- DMARC — policy level (none / quarantine / reject)
- DMARC applies policy to messages that fail aligned authentication. Review legitimate senders and reports before increasing enforcement.
- DMARC rua= aggregate-report address
- The rua address requests aggregate DMARC reports. Confirm it is valid and that someone reviews the reports.
- DKIM — 18 common selectors probed
- DKIM uses selector-specific public keys to verify signatures. A limited selector probe cannot prove that an untested selector is absent.
- MX records — inbound mail configured
- MX records identify inbound mail servers. Check that the records match your intended mail provider.
- CAA — certificate authority restrictions
- CAA records constrain certificate issuance by participating authorities. Confirm they allow your actual certificate provider.
- TLS-RPT — TLS failure reporting
- TLS reporting helps reveal mail transport failures. Verify the reporting destination and investigate recurring errors.
- MTA-STS — enforce TLS for inbound mail
- MTA-STS lets supporting senders enforce a published mail TLS policy. Check the policy endpoint and MX coverage.
- BIMI — brand logo in email clients
- BIMI can provide a verified brand logo in supporting mail clients. Display depends on provider requirements beyond a DNS record.
- Server geolocation & hosting provider
- Hosting and geolocation are contextual estimates for an IP. They do not establish data residency for every service.
- Composite deliverability score (0–100)
- The composite score summarizes this tool's checks. Review individual findings; it does not guarantee delivery to inboxes.
Role-Specific Action Plan
- →Approve DMARC p=reject policy after monitoring phase (typically 30–60 days on p=none)
- →Confirm domain registrar account has 2FA enabled and EPP locks active
- →Include email authentication compliance in cyber insurance assessments
- →Add SPF TXT record: v=spf1 include:your-mail-provider.com -all
- →Add DMARC TXT record to _dmarc.yourdomain.com with rua= report address
- →Enable all three EPP lock codes at the domain registrar
- →Configure DKIM in your email sending service and publish the DNS key
- →Set up DMARC aggregate report parsing (Valimail, Postmark DMARC, MXToolbox)
- →Escalate DMARC from p=none → p=quarantine → p=reject as reports confirm alignment
- →Monitor for new sending sources appearing in DMARC reports — may indicate shadow IT or email services
Frequently asked questions
What is Email & DNS Security?
Without SPF and DMARC, anyone can send phishing emails that appear to come from your domain. Without registrar locks, your domain can be hijacked. Both are invisible until the damage is done.
Why does Email & DNS Security matter?
Email spoofing attacks using unprotected domains are a leading cause of business email compromise (BEC) fraud, which the FBI reported cost businesses $2.7 billion in 2022. A successful domain hijacking can take your site offline for days and destroy search engine rankings built over years. DMARC enforcement (p=reject) blocks this class of attack at the mail server level.
Official references
Related topics