Domain Transfer Locks and Ownership Controls
Continue through the next layer of the domain-to-browser path.
Read the guide →Plain-English security
Why can someone send email as your business?
Email lets a sender place almost any domain in the visible From address. SPF and DKIM provide authentication signals; DMARC checks alignment and publishes your preferred handling for failures. An enforcing policy materially reduces successful domain impersonation, while each receiver still makes the final delivery decision under its own local policy.
What the attack looks like
Nobody hacks anything. An attacker simply sends email with your domain on the From line — a fake invoice to your customers with new payment details, a fake “urgent” note from the owner to your bookkeeper, a fake password reset to your staff. Your website and your real inbox work perfectly the entire time, which is why the first sign is usually an angry phone call from a customer who paid an invoice you never sent.
What each record does
- SPF — a public list of the servers allowed to send mail for your domain. Necessary, but on its own it's a suggestion, not a rule.
- DKIM — a cryptographic signature your mail provider stamps on every outgoing message, provable against a key published in your DNS.
- DMARC — the alignment check and published handling preference that ties SPF or DKIM to the domain people actually see. p=none requests monitoring only; p=quarantine and p=reject signal enforcement. Participating receivers consider that preference alongside their own local anti-abuse policy.
The side benefit that often pays for the whole exercise
Mailbox providers increasingly require these records from senders. Proper authentication doesn't just stop impostors — it's frequently the reason a business's own legitimate email stops landing in spam folders.
The one way to do this wrong
Jumping straight to enforcement without monitoring first. Businesses send email from more places than they remember — the invoicing app, the website's contact form, the CRM, the newsletter tool. Tighten the policy before finding them all and you silently break your own mail. The safe path is publish, watch the reports, then enforce.
Check your own site in 30 seconds
The free WolfWarden scan reads this — plus seven other fundamentals — from public information and grades it in plain English. Nothing to install. Ordinary results may be cached briefly to prevent abuse; no lasting report is created unless you choose to share one.
Run the free scanCommon questions
Will setting up DMARC break my email?
Not if it's done in stages. The safe path is publish the record, monitor the reports to find every legitimate sender, then tighten to enforcement. The horror stories all come from skipping the monitoring step.
We already have SPF. Isn't that enough?
No. SPF authenticates one sending identity, but DMARC checks whether SPF or DKIM aligns with the domain people actually see and publishes your preferred handling for failures. Participating receivers still apply their own local policy.
Does this apply if we use Gmail or Microsoft 365?
Yes. Those providers deliver your mail, but the authentication records live in your domain's DNS and publishing them is your responsibility. Many businesses on these platforms have no DMARC record at all.
If you'd rather not manage this
The relevant service page explains what WolfWarden can handle, what the public scan cannot see, and where a managed plan or focused project fits.