Question 1

What is SPF and why does it matter?

Accepted Answer

SPF (Sender Policy Framework) is a DNS record that lists which mail servers are authorised to send email on behalf of your domain. Without SPF, anyone can spoof your domain in the "From" address of an email. An SPF record significantly reduces the chance of your domain being used in phishing attacks.

Question 2

What is DKIM?

Accepted Answer

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The recipient's mail server can verify this signature against a public key published in your DNS. If the signature is valid, the email has not been tampered with and genuinely came from your domain.

Question 3

What is DMARC?

Accepted Answer

DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on top of SPF and DKIM. It tells receiving mail servers what to do when an email fails SPF or DKIM checks: either nothing (none), quarantine it, or reject it outright. DMARC also enables reporting so you can monitor who is sending mail on behalf of your domain.

Question 4

What does the DMARC policy mean?

Accepted Answer

"none" means no action is taken on failing emails (useful only for monitoring). "quarantine" sends suspicious emails to the spam folder. "reject" is the strongest policy and instructs receiving servers to refuse delivery of emails that fail authentication. For strong protection, you should eventually move to p=reject.

Question 5

What is the "too many DNS lookups" SPF warning?

Accepted Answer

The SPF specification allows a maximum of 10 DNS lookups during evaluation. Each "include:", "a:", "mx:" mechanism can trigger additional lookups. Exceeding 10 lookups causes a "permerror", which may cause your emails to fail SPF checks entirely, even for legitimate senders.

Question 6

How does the email security score work?

Accepted Answer

The score is calculated out of 100 based on three factors: whether a valid SPF record exists, whether DKIM keys are published and valid, and whether a DMARC policy is in place (with stricter policies scoring higher). A score of 100 requires valid SPF, at least one valid DKIM selector, and a DMARC policy of quarantine or reject.