Can your domain be spoofed? How to check your DMARC, SPF and DKIM

Anyone can type your domain into the From line of an email. Whether that forgery lands in an inbox depends mostly on a few public DNS records you control. This guide shows how to read those records yourself, which combinations leave your domain open, and what to fix first.

Can someone spoof my email domain?

Your domain can be spoofed if it doesn't publish a DMARC policy of p=quarantine or p=reject. DMARC (Domain-based Message Authentication, Reporting and Conformance, defined in RFC 9989) is the record that tells receivers what to do with mail that claims your domain in the From address but fails authentication. Without an enforcing policy, each receiver decides on its own, and many forged messages get through.

Three records work together:

• SPF (Sender Policy Framework, RFC 7208) lists the servers allowed to send mail for the envelope sender, the hidden bounce address.
• DKIM (DomainKeys Identified Mail) adds a cryptographic signature that names a signing domain.
• DMARC requires that SPF or DKIM passes for a domain that aligns with the visible From address, and publishes your policy for failures.

Microsoft summarizes the rule: a message "passes DMARC if one or both of the described SPF or DKIM checks pass", and "fails DMARC if both of the described SPF and DKIM checks fail" (Microsoft Learn). For more background, see what email spoofing is.

How do I check my domain's spoofing protection?

You check it by looking up three public DNS records and reading a handful of tags.

1. Run the DMARC Checker on your domain, or look it up yourself:

   nslookup -type=TXT _dmarc.example.com
   

   In PowerShell, Microsoft's example is Resolve-DnsName -Name "_dmarc.contoso.com" -Type TXT.
2. Note the p= value, plus sp=, np= and t= if present.
3. Run the SPF Checker. Confirm there's exactly one SPF record, it doesn't end in +all, and it stays within the 10-lookup limit.
4. Check DKIM for each service that sends as your domain with the DKIM Checker. If you don't know the selector, see how to find a DKIM selector.
5. Send yourself a test message from your normal mail system to an outside mailbox, open the headers and confirm dmarc=pass. Our guide to checking SPF, DKIM and DMARC results shows where to look.
6. Repeat for every domain you own, including ones that never send email.

The Email Health Check does steps 1 to 4 in one scan.

What do the results mean?

Your domain is protected only when DMARC is at p=quarantine or p=reject with no test flag and your real senders pass. This table covers the common results:

The t=y rule comes straight from RFC 9989: "if the policy is 'reject' and the value of the 't' tag is 'y', a policy of 'quarantine' will be applied to failing messages". RFC 9989 also removed the old pct tag, so pct= values are no longer part of the standard, though some receivers may still read them.

CISA's federal email directive, BOD 18-01, required agencies to set "a DMARC policy of 'reject' for all second-level domains and mail-sending hosts", and notes that p=none "doesn't actually delay or stop unauthenticated mail from being delivered".

Example records

These are examples for example.com:

; Spoofable: monitoring only
_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

; Protected main domain, but subdomains left open
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; sp=none; rua=mailto:dmarc@example.com"

; Protected, including subdomains and non-existent subdomains
_dmarc.example.com.  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

How do Microsoft 365 and Gmail treat a domain without an enforcing policy?

Large receivers still run their own spoofing checks, but your policy decides how firmly they act. Google says a none policy means "take no action on the message and deliver it to the intended recipient", quarantine means mark it as spam, and reject means reject it (Google Workspace Admin Help).

Microsoft 365 records the outcome in a composite authentication (compauth) result. Reason code 000 means the message failed DMARC "and the DMARC policy action is p=quarantine or p=reject". Code 001 means it failed implicit authentication because the domain "didn't have email authentication records published, or if they did, they had a weaker failure policy (SPF ~all or ?all, or a DMARC policy of p=none)" (Microsoft Learn). With no DMARC record at all, Microsoft can report dmarc=bestguesspass, its own inference.

So a spoof of a weakly protected domain may still be caught, but by guesswork. Smaller mail servers often have nothing similar. You can see the same composite results in your own headers with the Microsoft 365 header decoder.

Which gaps do quick checks miss?

A green result on your main domain isn't the whole picture. Check these too:

• Subdomains. sp=none or a weaker record on a subdomain such as mail.example.com reopens spoofing there. RFC 9989 applies sp to existing subdomains and np to non-existent ones; if both are absent, p applies. See our guide to the DMARC subdomain policy.
• Parked and unused domains. Domains that never send mail need v=spf1 -all and p=reject. Microsoft says to configure them so "no email should ever come from those domains", including your *.onmicrosoft.com domain if you don't send from it. Our parked domains guide has a checklist.
• Broken SPF. More than 10 DNS lookups causes a permanent error, so SPF never passes. In our scan of the Tranco top 1,000 domains in October 2026, 22 domains broke the limit and 38.3% didn't enforce DMARC.
• Your own tenant's back doors. In Microsoft 365, Direct Send can let outsiders deliver mail that looks internal straight to your mailboxes.

Should I send a spoofed test email?

Usually you don't need to. Public DNS shows whether receivers are asked to block forged mail, and that's what a live test would reveal. If you do want proof, keep it controlled:

1. Get written approval from whoever owns the domain.
2. Send only to a mailbox you control at an outside provider, such as a personal Gmail or Outlook.com account.
3. Send from a server that isn't in your SPF record and doesn't sign with your DKIM key.
4. Check where it landed and read the Authentication-Results header. At p=reject, Microsoft says failing mail is "Rejected during SMTP (550 5.7.1)" when its Honor DMARC setting is on.

Never send test spoofs to customers, suppliers or anyone outside the test.

How do I fix a spoofable domain?

Fix it in this order, so you don't block your own mail:

1. Publish p=none with a reporting address if you have no record yet.
2. Read the aggregate reports for a few weeks and list every service that sends as your domain. The DMARC Report Analyzer reads them in your browser.
3. Make each sender pass with alignment, ideally with DKIM signing as your domain. See authenticating third-party senders.
4. Move to p=quarantine, then p=reject. Our staged rollout guide has a timeline. Google recommends starting at none and moving to quarantine or reject over time.
5. Lock down parked domains with p=reject straight away; they have no legitimate mail to break.

The full walkthrough is in how to stop email spoofing of your domain.

What can't a domain check tell you?

A domain check only covers exact-domain spoofing. It can't tell you whether:

• Someone has registered a lookalike domain such as examp1e.com. Try the Lookalike Domain Generator to see which variations exist.
• Attackers are using display-name spoofing from free email accounts. See display name spoofing.
• One of your mailboxes is compromised, in which case the attacker's mail passes every check.
• Your inbound mail is filtered well. These records protect other people from forgeries of your domain; they don't filter what you receive.

Next steps

1. Run the free Email Health Check on every domain you own and note any that aren't at p=quarantine or p=reject.
2. Fix parked domains first, then work your sending domains toward p=reject using the reports.
3. Check sp= and any subdomain records so they don't undo your main policy.
4. For the attacks DMARC can't stop, iBlockSpam filters inbound phishing and spoofing at the MX, and its DMARC monitoring shows who sends as your domain and when you're ready for reject.

Browse our other SPF, DKIM and DMARC guides.