# Can anyone send email as my domain? Check your SPF and DMARC records

By Mark Kashef, founder of Lockpick. Published 2026-10-21, updated 2026-10-21.

Anyone can put your domain in an email's from line. Check your SPF, DKIM and DMARC records and fix them so fakes land in spam or bounce.

Yes, anyone can, because the "from" line on an email is just text the sender typed. With SPF, DKIM and DMARC in your DNS, and DMARC set to quarantine or reject, a fake message from your domain ends up in spam or bounces.

## What is email spoofing and why does it matter?

Email was designed long before anyone worried about fakes, and nothing in the original design checks the "from" line. That's how someone can send your customers an invoice that looks like it came from you.

Your domain can publish three short notes in its DNS, the public address book for your domain, and mail servers read them before they trust a message.

| Record | What it does | Related check |
| --- | --- | --- |
| SPF | SPF lists the services allowed to send email for your domain, like your email provider and your newsletter tool. | [SPF record check](/checks/spf) |
| DKIM | DKIM adds a signature to every message, so a mail server can tell it really came from you and wasn't changed on the way. | [DKIM signing check](/checks/dkim) |
| DMARC | DMARC tells mail servers what to do with a message that fails those checks (SPF and DKIM), for example put it in spam or reject it, and where to send reports. | [Email spoofing check](/checks/email-spoofing) |

:::callout warning
Most domains have SPF but no DMARC, or DMARC set to "none", which only watches and never blocks.
:::

Some list too many services in SPF and break the limit on lookups, so the record stops working. If that sounds like your setup, look at the [broken SPF records check](/checks/spf-health).

A domain that never sends email is not safe by default either. Mail servers judge the domain in the "from" line, not whether it has a mailbox, so a quiet domain with no rules is an easy one to fake, and you never see the bounces.

## How do I check?

A scan reads these records the same way a mail server does, so it can tell you exactly which one is missing or weak.

The quick outside look covers the homepage and the files it loads, email sender settings (SPF and DMARC), security headers and TLS, and public DNS, certificate and subdomain records, in at most 10 requests. Reading DNS records, certificate logs and domain registration never touches your site. The full details are in [how we check](/docs/security/how-we-check).

If you'd rather look by hand, these read-only commands show the TXT records, the DMARC record and the mail server record for Atlas, our example app. Swap in your own domain.

```bash
dig +short TXT atlas.example
dig +short TXT _dmarc.atlas.example
dig +short MX atlas.example
```

If the DMARC lookup comes back empty, treat DMARC as missing and fix it first. Then compare what you see with the table above.

[Check your site](/check)

## How do I fix it?

Lockpick never changes anything on your site, your DNS or your accounts, so you add these records yourself at your DNS provider.

1. Write down every service that sends email as your domain. Think email provider, newsletter tool, and any app that sends receipts or sign-in emails for you.
2. Publish one SPF record that lists only those services. Keep the list short. If you list too many services in SPF, you break the limit on lookups and the record stops working.
3. Turn on DKIM signing inside each service that sends for you, and add the record each one gives you.
4. Publish a DMARC record with a reporting address you read. Read the reports until every real sender passes, then set the policy to quarantine or reject. Don't stop at "none".
5. Close your quiet domains too. A domain that never sends email needs three records to close it. They are a DMARC rule set to reject, an SPF record that allows no senders (v=spf1 -all), and an empty mail server record (0 .).
6. Check again once the records are live, and compare the new scan with the one before.

Each thing to fix about email comes with the record to add and a prompt for your AI. If you want your coding assistant to write the records, paste this.

:::fix-prompt any
Help me stop other people sending email as my domain. Do not change any code in this project.
Ask me for my domain and for every service that sends email for it, such as my email provider, my newsletter tool and any app that sends receipts or sign-in emails.
Write one SPF TXT record that lists only those services. Keep it within the SPF lookup limit and tell me how many lookups it uses.
Tell me where to turn on DKIM signing in each of those services.
Write a DMARC TXT record with a reporting address I control, and tell me when to move the policy to quarantine or reject.
If I tell you the domain never sends email, instead write a DMARC rule set to reject, an SPF record that allows no senders, and an empty mail server record.
Give me the exact host, type and value for each record so I can paste them into my DNS provider.
:::

For more on giving fixes to your builder, see [fix it with your AI](/guides/fix-it-with-your-ai).

## What a check cannot tell you

Every check reads what your site already shows the public, plus public records about your domain, and nothing else. Don't read a passing SPF and DMARC result as proof that nobody has ever sent fake mail as your domain. Don't read a missing DMARC record as proof that someone has, either. Treat it as a gap to close.

Check the SPF list against the services you really send through. You know that list better than any outside reader of your DNS.

A Lockpick report is not a certificate and not a full penetration test. It covers what that scan could see on that day. Anything a scan couldn't check is marked as not checked, never as passed.

## Questions people ask

### Is an SPF record enough on its own?

Don't rely on SPF alone. DMARC tells mail servers what to do with a message that fails SPF and DKIM, for example put it in spam or reject it. Add DKIM and DMARC as well, and set DMARC to quarantine or reject.

### What does a DMARC policy of none do?

DMARC set to "none" only watches and never blocks. Use the reports to confirm every real sender passes, then move the policy to quarantine or reject.

### My domain never sends email. Do I still need these records?

Yes. A domain that never sends email is not safe by default either. It takes three records to close it, a DMARC rule set to reject, an SPF record that allows no senders (v=spf1 -all), and an empty mail server record (0 .).

### Will Lockpick change my DNS records for me?

No. We never change anything on your site, your DNS or your accounts. Each thing to fix about email comes with the record to add and a prompt for your AI. You add the record at your DNS provider.

### Does looking up my SPF and DMARC records touch my site?

Reading DNS records, certificate logs and domain registration never touches your site.

## Sources

- [Anyone can send email as you. Here's why · Docs · Lockpick](https://www.lockpick.app/docs/learn/email-anyone-can-send), Lockpick docs, read on 2026-10-21
- [How we check · Docs · Lockpick](https://www.lockpick.app/docs/security/how-we-check), Lockpick docs, read on 2026-10-21
- [What we never do · Docs · Lockpick](https://www.lockpick.app/docs/security/what-we-never-do), Lockpick docs, read on 2026-10-19