Email was designed decades before spam and phishing existed, and it has no built-in way to verify a sender is who they claim to be. Without the right DNS records, an attacker can send an email that appears to come from billing@yourdomain.com — perfectly matching your real domain — and most inboxes will accept it as genuine. This is called email spoofing, and it's used constantly in phishing attacks against customers, partners, and employees.
| Record | Plain English |
|---|---|
| SPF (Sender Policy Framework) | A list of servers allowed to send email on your domain's behalf. Receiving mail servers check this list and reject mail from anywhere not on it. |
| DMARC (Domain-based Message Authentication) | Tells receiving servers exactly what to do when a message fails SPF or DKIM — quarantine it, reject it outright, or (weakest) do nothing but report it. |
| DKIM (DomainKeys Identified Mail) | The third pillar of email authentication alongside SPF and DMARC — a cryptographic signature proving a message genuinely came from your domain and wasn't altered in transit. |
| DMARC reporting | Whether your DMARC record includes an address to actually receive reports about spoofing attempts — without it, you have a policy but no visibility into who's abusing your domain. |
| CAA (Certification Authority Authorization) | Restricts which certificate authorities are allowed to issue SSL certificates for your domain, preventing an attacker from getting a fraudulent certificate issued elsewhere. |
| MTA-STS | Forces incoming mail servers to use an encrypted, verified connection when delivering mail to you, preventing an attacker from downgrading the connection to intercept it. |
| TLS-RPT | A companion to MTA-STS — an address that receives reports whenever a mail server fails to establish a secure connection to you. |
| BIMI | Shows your logo next to authenticated emails in supporting mail clients. Informational only — requires DMARC p=reject first, so it's a nice-to-have layered on top of the core email-auth checks above, not scored alongside them. |
Even domains that mostly sit idle for email are still valid spoofing targets — attackers don't need your domain to send real mail, only to forge messages that appear to come from it. A missing SPF/DKIM/DMARC trio is one of the most common gaps found on smaller business domains precisely because "we don't send much email" creates a false sense that it doesn't matter.
SPF, DMARC, CAA, MTA-STS, and TLS-RPT are all simple DNS TXT records added through your domain registrar or DNS provider's dashboard — no server changes needed. DKIM is set up through your email provider (Google Workspace, Microsoft 365, etc.), which generates the key pair and gives you the exact TXT record to publish.
PEKRYON scans your website across 26 modules. We take the time needed for accurate results — no server access needed.
Scan My Website Free → Learn More