How to Fix Missing Email Security Records (SPF/DKIM/DMARC)

Missing SPF, DKIM, and DMARC records allow attackers to send spoofed emails from your domain. Configure email authentication now.

Medium severity Infrastructure Security Updated 2026-03-01 Markdown

SMTP, the Simple Mail Transfer Protocol, was designed in 1982 for a small network of trusted institutions where authentication was unnecessary. Any server could claim to send email from any address, and receiving servers accepted it. This design assumption held for a generation, then became catastrophic as email became the primary channel for authentication, financial transactions, and business communication. Email spoofing — sending email that appears to come from a domain you don't control — has been trivially possible since the protocol was created.

The three authentication standards that address this emerged over decades of incremental response to abuse: SPF (2006) specifies which servers may send for your domain via a DNS TXT record; DKIM (2007) cryptographically signs outgoing messages so receivers can verify they weren't modified in transit; DMARC (2012) ties SPF and DKIM together with a policy that tells receivers what to do when messages fail these checks. Without all three, any attacker can send an email that appears to come from noreply@yourdomain.com, support@yourdomain.com, or ceo@yourdomain.com.

The real-world impact is significant. Business Email Compromise (BEC) attacks — where attackers impersonate company executives to authorize fraudulent wire transfers — cost businesses over $2.7 billion in 2022 according to the FBI. Phishing campaigns targeting your users using your brand have direct and immediate customer trust consequences. Gmail and Yahoo announced in early 2024 that bulk senders without proper DMARC configuration would see reduced delivery rates, making these records a practical deliverability requirement as well as a security measure.

The Problem

Missing SPF, DKIM, and DMARC records mean anyone can send emails that appear to come from your domain. Attackers exploit this to send phishing emails to your users, impersonating your brand to steal credentials or distribute malware. Without these records, receiving mail servers have no way to verify that emails claiming to be from your domain are legitimate, and your own legitimate emails are more likely to land in spam.

How to Fix

1
Add an SPF record
```
SPF tells receiving servers which mail servers are authorized to send email for your domain. Add a TXT record to your DNS:
```
```
Type: TXT
Host: @
Value: v=spf1 include:_spf.google.com include:sendgrid.net include:mailgun.org ~all
```
Replace the include statements with your actual email providers: - Gmail/Google Workspace: include:_spf.google.com - SendGrid: include:sendgrid.net - Mailgun: include:mailgun.org - Amazon SES: include:amazonses.com - Postmark: include:spf.mtasv.net

Use ~all (soft fail) initially, then change to -all (hard fail) after testing.
2
Configure DKIM signing
DKIM adds a cryptographic signature to outgoing emails. Configuration depends on your email provider:

For SendGrid: Go to Settings > Sender Authentication > Authenticate Your Domain. Add the CNAME records provided.

For Mailgun: Go to Sending > Domains > DNS Records. Add the TXT records provided.

For Amazon SES: Use the DKIM settings in your SES domain identity. Add the three CNAME records provided.

Each provider generates unique DKIM keys. Add the DNS records they provide, which typically look like:
```
Type: CNAME
Host: s1._domainkey
Value: s1.domainkey.u12345.wl.sendgrid.net
```

Add a DMARC record

DMARC tells receivers what to do with emails that fail SPF/DKIM checks. Start with monitoring mode:

Type: TXT
Host: _dmarc
Value: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; pct=100

This sends reports to your email without rejecting anything. After reviewing reports for 2-4 weeks and confirming legitimate emails pass, upgrade to quarantine:

v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; pct=100

Then finally to reject:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; pct=100

Configure Laravel mail to use authenticated sending

Ensure your Laravel application sends email through an authenticated provider. In .env:

MAIL_MAILER=smtp
MAIL_HOST=smtp.sendgrid.net
MAIL_PORT=587
MAIL_USERNAME=apikey
MAIL_PASSWORD=your-sendgrid-api-key
MAIL_ENCRYPTION=tls
MAIL_FROM_ADDRESS=noreply@yourdomain.com
MAIL_FROM_NAME="Your App Name"

Never use the mail driver (PHP mail()) in production as it bypasses SPF/DKIM authentication and emails are likely to be flagged as spam.

How to Verify

Check your DNS records:

dig +short TXT yourdomain.com | grep spf
dig +short TXT _dmarc.yourdomain.com
dig +short TXT default._domainkey.yourdomain.com

Use a verification tool like mail-tester.com: send an email to the address they provide and get a score. Aim for 10/10. You can also check at mxtoolbox.com/SuperTool.aspx.

Prevention

Configure SPF, DKIM, and DMARC as part of your domain setup process before sending any email. Document which services are authorized to send email for your domain. Use StackShield to continuously monitor your email authentication records and alert on changes.

Frequently Asked Questions

Will adding these records affect my existing email delivery?

Start with SPF using ~all (soft fail) and DMARC with p=none (monitor only). This collects data without blocking any email. Once you have confirmed all legitimate email sources pass checks (usually 2-4 weeks), tighten the policies. This staged approach prevents accidentally blocking your own email.

Do I need all three (SPF, DKIM, DMARC)?

Yes. SPF alone can be bypassed, and DKIM alone does not specify a policy. DMARC ties them together by telling receivers to check both SPF and DKIM and defining what to do when they fail. Major email providers like Gmail and Yahoo require all three for reliable delivery.

What if I use multiple email services?

Add all authorized senders to your SPF record using include: directives. Each service needs its own DKIM keys configured. DMARC covers all senders. Be careful not to exceed the 10 DNS lookup limit for SPF; use SPF flattening tools if needed.

How do I read and act on DMARC reports?

DMARC aggregate reports (RUA) are sent as XML files to the address in your rua= parameter. Tools like Postmark's DMARC Digests, dmarcian, or Valimail parse these reports into readable dashboards showing which sending sources are passing and failing authentication. Review reports weekly when first implementing DMARC to identify legitimate email sources before tightening the policy from p=none to p=quarantine.

What happens to legitimate emails that fail DMARC checks?

With p=none, nothing — they are delivered but the failure is reported. With p=quarantine, they go to the spam folder. With p=reject, they are not delivered at all. This is why the staged rollout (none → quarantine → reject) is critical: jump straight to p=reject and you risk blocking your own email if any legitimate sending source isn't properly authenticated yet.

Related Security Terms

Exploit SPF, DKIM, and DMARC Phishing

Related Guides

Medium

Is your Laravel app exposed right now?

34% of Laravel apps we scan have at least one critical issue. Most teams don't find out until something breaks. Our free scan checks your live application in under 60 seconds.

18% have debug mode on

72% missing security headers

12% have exposed .env

Scan My App Free No signup required. Results in 60 seconds.