How email authentication is supposed to work
Email was designed in the 1970s — long before anyone imagined it would be used for banking, commerce, or sensitive communications. The original SMTP protocol has no built-in way to verify who is actually sending a message. Anyone can put any address in the From: header.
To fix this, three DNS-based standards were added over the decades:
- SPF (Sender Policy Framework) — A TXT record in your DNS that lists which mail servers are allowed to send email from your domain.
- DKIM (DomainKeys Identified Mail) — A cryptographic signature added to outgoing emails, verified by a public key stored in your DNS.
- DMARC (Domain-based Message Authentication, Reporting & Conformance) — A policy record that tells receiving servers what to do when an email fails SPF or DKIM checks.
The critical word is "policy." SPF and DKIM verify authenticity. DMARC enforces the consequence of failing that verification. Without DMARC, there is no enforcement — and that is exactly what attackers exploit.
The missing piece: p=none means nothing
A DMARC record with p=none is the most dangerous configuration there is — because it creates a false sense of security. Many domain administrators set up DMARC with p=none to start monitoring, and then forget to ever tighten it.
p=none does not protect you. It only reports. Phishing emails sent from your domain will still be delivered to recipients even when p=none is in place.
The three DMARC policy values are:
Only p=reject actually prevents a spoofed email from reaching its destination. And many domains either have no DMARC record at all — or are stuck at p=none indefinitely.
How the attack works, step by step
Here is exactly what happens when an attacker targets a domain with no DMARC policy (or p=none):
- The attacker looks up your domain and checks for a DMARC record at
_dmarc.yourdomain.com. If it returns NXDOMAIN or ap=nonerecord, the domain is a valid target. - They set up a mail server — often on a cheap VPS — and configure it to send emails with
From: noreply@yourdomain.com. - They craft a convincing phishing email: an invoice, a password reset, a security alert, or a payment request. The From address shows your domain.
- The receiving mail server performs SPF and DKIM checks. SPF fails (the attacker's server is not in your SPF record). DKIM is absent.
- Without DMARC enforcement, the server has no instruction to reject or quarantine the email. It delivers it.
- The recipient sees the email, trusts the familiar domain name, and acts on it.
This attack costs the attacker almost nothing. A VPS, a free email library, and your unprotected domain name. The entire setup takes under an hour.
Real cases where this caused serious damage
This is not theoretical. Domain spoofing via missing DMARC has been used in documented attacks against real organizations:
- US Department of Homeland Security (2017) — A government audit found that a large number of .gov domains lacked DMARC enforcement, enabling potential spoofing of official government addresses. This led to a binding operational directive (BOD 18-01) mandating DMARC for all federal agencies.
- COVID-19 vaccine scams (2021) — Health agencies and pharmaceutical companies were impersonated in large-scale phishing campaigns targeting hospitals. Many of the spoofed domains had no DMARC record or used
p=none. - Business Email Compromise (BEC) — The FBI's IC3 report consistently lists BEC as the highest-dollar cybercrime category. A significant portion of BEC attacks use domain spoofing enabled by missing DMARC records.
How to fix it: the right DMARC record
Fixing this requires adding or tightening a DMARC DNS record. The recommended path:
- Start with p=none + reporting — This lets you see who is sending email as your domain without blocking anything. Monitor for 2–4 weeks.
- Move to p=quarantine — Failed emails go to spam. This catches most spoofing attempts while minimizing impact on legitimate mail.
- Tighten to p=reject — The only truly protective policy. Failed messages are dropped entirely at the receiving server.
A properly configured DMARC record with full coverage looks like this:
Don't forget subdomain coverage. Add sp=reject to also protect subdomains, since attackers often target mail@subdomain.yourdomain.com when the apex domain has protection.
Check your domain right now
Use our free DMARC Analyzer to inspect your domain's current policy in seconds. You will see the raw record, the policy value, and whether you are currently exposed.
If the result shows p=none or no record at all — your domain can be spoofed today. The fix is a single DNS record change.