Do I need all three records?

Yes, for strong protection. SPF and DKIM prove mail is legitimate. DMARC tells receivers what to do when those checks fail.

Which record should I set up first?

SPF and DKIM first, through your mail provider. Then add DMARC starting with p=none for monitoring before moving to quarantine or reject.

Can I check these without DNS access?

You can see whether they exist and whether they look correct from the outside. Fixing them requires DNS changes in your registrar or provider.

Does email auth affect my website security score?

Yes. Email authentication is one category in a RedScore scan. Weak email auth lowers your overall grade.

DMARC, SPF, and DKIM explained for founders

What are DMARC, SPF, and DKIM?

They are three DNS records that work together to stop email spoofing on your domain. Without them, anyone can send mail that looks like it came from your company.

SPF (Sender Policy Framework) is a DNS TXT record that lists which mail servers are allowed to send email for your domain. When a receiver gets mail claiming to be from you, it checks whether the sending server is on your SPF list.

DKIM (DomainKeys Identified Mail) adds a digital signature to outgoing mail. The receiver looks up your public key in DNS and verifies the signature. If it matches, the mail was not tampered with in transit.

DMARC (Domain-based Message Authentication, Reporting, and Conformance) tells receivers what to do when SPF or DKIM fail. It also sends you reports about mail sent using your domain.

Why should founders care?

Buyers and partners check email auth before they trust your domain. A spoofed invoice or password reset from your domain name can damage trust faster than a weak TLS config.

Most founders set up Google Workspace or a transactional mail provider and assume email auth is handled. Often it is not fully enforced. DMARC sits at p=none forever, or SPF includes every provider under the sun.

Run a quick outside-in check before you send your first customer email or pitch deck.

How do I check my email auth records?

Go to /lookup and enter the domain in your From address. RedScore reads your public SPF, DKIM, and DMARC records and flags gaps.

For detail on each check, see the SPF checker, DKIM checker, and DMARC checker pages.

What does a good setup look like?

SPF lists only your real mail providers. No +all. No stale entries from old services.
DKIM is enabled with your mail provider and the public key is published in DNS.
DMARC starts at p=none while you monitor reports, then moves to p=quarantine or p=reject.

Most mail providers (Google Workspace, Microsoft 365, SendGrid, Postmark) have setup guides for all three. Follow theirs, then verify with a scan.

What should I do if my records are missing or weak?

Enable SPF and DKIM through your mail provider first.
Add a DMARC record at p=none to start collecting reports.
Review reports for a week or two to catch legitimate mail that fails.
Move DMARC to p=quarantine, then p=reject.
Rescan from /lookup to confirm the grade improved.

This is a one-time setup for most startups. The scan takes 60 seconds. Fixing DNS takes longer, but you only do it once.