--- title: "Lock your mail domains: SPF, DKIM and DMARC · Wi24rd" description: "Stop fake emails in your name with SPF, DKIM and DMARC – and lock domains that never send mail. Free with Cloudflare, about 15 minutes per domain. Step by step with screenshots." url: "https://wi24rd.com/en/security-tips/email-domains/" lang: "en" alternates: da: "https://wi24rd.com/sikkerhedstips/email-domains/" en: "https://wi24rd.com/en/security-tips/email-domains/" --- Security tip 6 · Mail domains # Lock your mail domains. Anyone can send an email that looks like it comes from you – unless three small DNS records say otherwise. And domains that never send mail can be locked completely. Free with Cloudflare, about 15 minutes per domain. Last checked 1 November 2026 [Go to the steps](https://wi24rd.com/en/security-tips/email-domains/#trin)[Domains without mail](https://wi24rd.com/en/security-tips/email-domains/#laas) Time ~15 min per domain Price Free reports included Three records SPF · DKIM · DMARC Needs Access to your DNS Why ## Anyone can write the sender of an email. Fake invoices, "the CEO needs a gift card" and phishing in your name work because the sender address on an email is as easy to forge as the sender on a postcard. The only thing that stops it is three records in your DNS, which the receiving mail server looks up and trusts. The big mail providers now use SPF, DKIM and DMARC to sort mail. Without them, your own emails land in spam more often – and the fake ones get through more often. _How it works: SPF says which servers may send for the domain. DKIM puts a seal on every email. DMARC tells the receiver what to do when something does not match, and sends you a report._ 1. **SPF**who may send 2. **DKIM**a seal on every email 3. **DMARC**what happens if it does not match 4. **Report**to you, every day **We checked our own 12 domains** - Two domains received mail but had neither SPF nor DMARC. - On one, DKIM was broken because the records sat behind Cloudflare’s proxy (the orange cloud), so receivers could not find the key. - wi24rd.com had no MX record, so mail to security@ bounced. - Five domains never sent mail – but were not locked. All of it is fixed with the steps below. Domains that send mail ## Five steps per domain. 1. ### Find out who sends in your name Your mail provider, but perhaps also a newsletter, a web shop, an invoicing or booking system. Each of them must be in SPF and should sign with DKIM. 2. ### Create SPF In Cloudflare: **DNS → Settings → Email Security → Configure**, and choose **SPF**. Enter your provider’s domain under _Domains_ – e.g. `_custspf.one.com` (one.com), `_spf.protonmail.ch` (Proton), `spf.protection.outlook.com` (Microsoft 365) or `_spf.google.com` (Google). There may only be **one** SPF record per domain. [!\[Cloudflare’s SPF wizard with _custspf.one.com added\](https://wi24rd.com/assets/img/skaerm/mail-spf.webp)](https://wi24rd.com/assets/img/skaerm/mail-spf.webp) _The SPF wizard: the provider under Domains, and the finished record at the bottom. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 3. ### Turn on DKIM at the provider DKIM is turned on in the mail provider’s control panel, which then gives you one or more records to put in DNS. Pitfall: if they are CNAME records, they must be **DNS only** (grey cloud). With the orange cloud, receivers cannot find the key. 4. ### Turn on DMARC and the reports Go to **Email → DMARC Management** and press **Enable DMARC Management**. Cloudflare adds a DMARC record with `p=none` and starts collecting reports from the big mail providers – free. [!\[Preview of the DMARC record with p=none and a report address\](https://wi24rd.com/assets/img/skaerm/mail-dmarc-guide.webp)](https://wi24rd.com/assets/img/skaerm/mail-dmarc-guide.webp) _Cloudflare proposes the record itself. The report address is blurred. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ [!\[Overview of DMARC, SPF, DKIM and BIMI for wi24rd.com\](https://wi24rd.com/assets/img/skaerm/mail-dmarc-oversigt.webp)](https://wi24rd.com/assets/img/skaerm/mail-dmarc-oversigt.webp) _The overview shows the status of all four on one line. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 5. ### Tighten after a few weeks The reports show who sends in your name and whether they pass. When everything legitimate passes, change the DMARC record to `p=quarantine` (to spam) and later `p=reject` (refuse). Only then does DMARC protect – `p=none` only watches. ``` dig TXT yourdomain.com +short dig TXT _dmarc.yourdomain.com +short ``` On Windows: `nslookup -type=TXT _dmarc.yourdomain.com`. Domains without mail ## Lock them completely – two clicks. Old campaign domains, misspellings and domains you bought to protect the name are favourite senders for fraudsters, precisely because nobody watches them. 1. ### Open Email Security **DNS → Settings → Email Security → Configure**. At the bottom it says _Your domain is not used to send email_. Press **Create records**. [!\[The option Your domain is not used to send email with the Create records button\](https://wi24rd.com/assets/img/skaerm/mail-laas-valg.webp)](https://wi24rd.com/assets/img/skaerm/mail-laas-valg.webp) _Cloudflare has a button for exactly this. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ 2. ### Approve the three records Cloudflare proposes `v=spf1 -all` (nobody may send), an empty DKIM key for all selectors and `DMARC p=reject`. Press **Submit** and confirm. [!\[The three restrictive records: SPF -all, empty DKIM and DMARC reject\](https://wi24rd.com/assets/img/skaerm/mail-laas-poster.webp)](https://wi24rd.com/assets/img/skaerm/mail-laas-poster.webp) _Three records – then receivers refuse anything pretending to come from the domain. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ Receive mail without a mail server ## contact@ – forwarded for free. If a domain must receive mail without you paying for a mailbox, use **Email → Email Routing**: create a rule such as `contact@` → your own mail and press **Add missing records**. Cloudflare adds MX, SPF and DKIM itself. With Cloudflare’s Email Service, a contact form on the site can also send from the address. [!\[The routing rule contact@asewave.org forwarded to a blurred address\](https://wi24rd.com/assets/img/skaerm/mail-routing-regel.webp)](https://wi24rd.com/assets/img/skaerm/mail-routing-regel.webp) _One rule per address. The destination address is blurred. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ [!\[The DNS records Email Routing is missing: three MX, one DKIM and one SPF\](https://wi24rd.com/assets/img/skaerm/mail-routing-dns.webp)](https://wi24rd.com/assets/img/skaerm/mail-routing-dns.webp) _Add missing records adds all five at once. Screenshot from wi24rd.com’s Cloudflare account, November 2026._ Honest about the limits ## What it does not do. - **It does not stop look-alike domains** such as `wi24rd-invoice.com`. Only attention helps there – and looking at the sender’s domain. - **`p=none` does not protect.** It only gives reports. Tighten once the reports are clean. - **Forwarded mail can fail SPF** – which is why DKIM matters: the seal travels with the email. **Without Cloudflare** SPF, DKIM and DMARC are ordinary DNS records and can be set at any DNS provider. The reports can be read with free services – or in your mail provider’s own tools. **About this tip** Wi24rd went through its own 12 domains with this method on 1 November 2026. The screenshots are from that review, and the menus were checked the same day. The man behind Wi24rd has used Cloudflare himself since he saw them at Black Hat in London in 2015. Wi24rd has no financial interest in Cloudflare – no money, discounts or services. [All security tips](https://wi24rd.com/en/security-tips/) [See the figures live](https://wi24rd.com/en/right-now/) [Back to Security tips](https://wi24rd.com/en/security-tips/)[To the top](https://wi24rd.com/en/security-tips/email-domains/#top) ## Missing a tip? Write what you would like explained. The next security tip could be yours. [Write to Wi24rd](https://wi24rd.com/en/contact/)[The site’s own defences](https://wi24rd.com/en/security/)