Managed IT services
Email spoofing protection for your custom domain
SPF, DKIM and DMARC are set up and monitored, so mail sent as your company is checked by the receiving server before delivery.
First steps
Grade your public DNS records before changing anything
Our free checker grades your domain's public records from A to F and shows missing entries. No mailbox is read during testing, and results only show public records.
- 1
SPF lists senders
Sender Policy Framework lists servers allowed to send mail for your domain. An SPF record is limited to 10 DNS lookups, and past that limit the check returns a permanent error.
- 2
DKIM signs messages
DomainKeys Identified Mail adds a cryptographic signature to each message. Each service sending mail needs its own DKIM or SPF entry.
- 3
DMARC tells receivers
Domain-based Message Authentication, Reporting, and Conformance tells receivers what action to take when messages fail both checks, and designates a report address.
Businesses moving money and data by email
Companies on our coast from Charleston to Savannah move money by email. Custom domains need protection because attackers impersonate owners or colleagues to redirect payments.
Select your industry
Examples of fraudulent messages
Rollout stages from DMARC policy p=none to p=reject
We set up SPF, DKIM and DMARC records and monitor your rollout. Each sending service gets an entry. Start with subdomains and save your parent domain for last.
DMARC record text
Percentage of failing mail
Action taken by receivers
Record text is an example with a placeholder domain.
Screenshots: Cloudflare and Microsoft Learn documentation, shown with sample data.
Managing DNS records across common platforms
DMARC records live with your domain registrar or DNS hosting service. Platforms handle DKIM signing differently.
Ongoing monitoring
DMARC reports show sender activity
Aggregate report data can be vast and difficult to parse. Microsoft Learn suggests using automation or an outside reporting service to deal with each issue reports reveal.
- 1
Daily report contents
Aggregate reports are typically sent once per day. Details include IP addresses of servers sending mail, pass or fail results, and actions taken.
- 2
Forgotten services revealed
Reports often turn up services nobody remembered. Microsoft Learn advises designating specific people to monitor results, catch unintentional failures and see how many fraudulent messages are sent as your domain.
- 3
Dashboard viewing
CloudCentric reads your daily reports from receiving mail servers and shows them on a dashboard, which reveals spoofing attempts and forgotten services sending on your behalf.
- 4
Record monitoring
CloudCentric monitors your published records so a broken or changed entry is noticed. Regular reviews catch unintentional failures.
Gmail sender requirements from February 1, 2024
Google enforces strict authentication for messages delivered to Gmail accounts. Policies depend on daily volume.
All senders
Senders must set up SPF or DKIM, have valid forward and reverse DNS, use a TLS connection, and keep spam rates in Postmaster Tools below 0.3%.
High volume senders
Senders of more than 5,000 messages a day to Gmail must set up SPF, DKIM and DMARC. Your DMARC policy can be none.
Domain alignment
Senders of more than 5,000 messages a day to Gmail must align their From address domain with their SPF or DKIM domain.
Unsubscribe links
Senders of more than 5,000 messages a day to Gmail must offer one-click unsubscribe on marketing and subscribed messages.
Frequently asked questions
- What is email spoofing and what do these records do?
Spoofing happens when anyone sends email that appears to come from your company address. SPF, DKIM and DMARC tell receiving mail servers which senders are allowed to send email as your domain.
- Does DMARC stop look-alike domains?
DMARC concerns mail claiming to be from your own domain. Look-alike domains are different domains entirely. Microsoft Defender anti-phishing impersonation protection and safety tips cover look-alike senders, detailed on our email security pages.
- What happens to our own invoices and newsletters when we move to p=reject?
Reports are read first so legitimate mail passes. Each sending service gets its own entry. Bulk email services use a subdomain so problems do not affect your main domain.
- What does p=none do?
A p=none policy gives no suggested action for messages that fail DMARC. Receivers deliver mail normally. We use none for testing and tuning while reviewing daily reports.
- Who reads the reports and what do they look like?
Receivers typically send aggregate reports once per day as an XML attachment, likely GZIP compressed. CloudCentric reads your daily reports from receiving mail servers and shows results on a dashboard.
- How does a business start and where do you cover?
CloudCentric serves businesses from Charleston to Savannah. Prices and rollout times depend on your setup. Call (844) 422-7000 to discuss your environment.
- Does the free checker change anything?
Our free checker only reads your domain's public DNS records. No mail flow is tested, no mailbox is read, and no changes are made. A result simply shows what your public records say.
Set up SPF, DKIM and DMARC for your custom domain
Call (844) 422-7000 to set up and monitor SPF, DKIM and DMARC records for your business.