Email Security Check: What StackShield Tests (SPF, DKIM, DMARC)

What this check looks for

StackShield inspects the DNS records that authenticate your domain's email: SPF, which declares who may send on your behalf; DKIM, which signs your messages; and DMARC, which tells receivers what to do with mail that fails those checks. It reads whether each is present and whether DMARC is set to actually enforce rather than merely observe.

Why it matters

Without these records, anyone can send email that appears to come from your domain. That is the mechanism behind most phishing that impersonates a company: the attacker sends from your address because nothing stops them. SPF and DKIM let receivers verify that a message genuinely came from you, and DMARC turns that verification into a policy, quarantine or reject the forgeries.

There is a deliverability side too. Domains without proper authentication increasingly land in spam regardless of content, because receivers treat unauthenticated mail as suspect. Your legitimate password resets suffer for the same missing records that let attackers impersonate you.

What a failed check means

A failed check means one or more of SPF, DKIM or DMARC is missing or weak, the most common being a DMARC record left at p=none, which observes forgeries without stopping them. Until DMARC enforces, your domain can still be spoofed.

The fix is a correct SPF record, DKIM signing on your mail, and a DMARC policy moved to quarantine or reject once you have confirmed legitimate mail passes.

See the step-by-step remediation: how to fix this.