How to Protect Your Domain from Spoofing and Improve Email Deliverability

Email is the backbone of business communication, but without the right authentication controls your domain can be spoofed, your legitimate messages can land in spam, and your sending reputation can suffer. This guide explains how to secure your domain with SPF, DKIM and DMARC, and how to roll those protections out in stages so you never accidentally block your own mail.

Last reviewed: 27 July 2026. SPF, DKIM and DMARC are stable, published internet standards (RFC 7208, RFC 6376 and RFC 7489). This guide is written for Noiz hosting and is kept current against those standards and the published sender guidance of the major mailbox providers. It complements, and does not replace, the reference documents linked below.

Official Documentation Reference

• RFC 7208: Sender Policy Framework (SPF)
• RFC 6376: DomainKeys Identified Mail (DKIM)
• RFC 7489: Domain-based Message Authentication, Reporting and Conformance (DMARC)
• Google: Email sender guidelines
• Microsoft: Email authentication in Microsoft 365
• DMARC.org: Overview

Prerequisites

• You can edit the DNS (TXT) records for your domain. On Noiz hosting this means the domain uses the Noiz nameservers (ns1.noiz.co.za and ns2.noiz.co.za) so records are managed in your control panel, or you have access to wherever the domain's DNS is hosted.
• You know which servers and services actually send mail as your domain: your Noiz mailbox, plus any third-party senders such as a marketing platform, CRM, help desk or billing system.
• A little patience for DNS to propagate. Changes usually take effect within minutes, but allow up to the record's TTL before testing.

Why Basic Authentication Isn't Enough

Attackers can spoof the visible From: address that your recipients see even when they are not sending from your servers. SPF on its own only checks the envelope sender (the Return-Path), which end users never see, so a message can pass SPF and still show a forged From: address. To properly protect your brand you need all three controls working together: SPF to authorise your sending sources, DKIM to sign your mail, and DMARC to tie authentication to the visible From: address and tell receivers what to do when it fails.

Step 1: Publish a Strict SPF Record

SPF defines which mail servers are allowed to send for your domain. Limit it to your actual outbound IP addresses or mail providers, and end it with -all so everything else is rejected. Publish it as a single TXT record on the domain apex.

yourdomain.com. 300 IN TXT "v=spf1 ip4:203.0.113.25 include:mailprovider.example -all"

Replace 203.0.113.25 with your real sending IP and mailprovider.example with any provider you send through. Add one ip4:, ip6: or include: for each legitimate source.

Verification: Run dig +short TXT yourdomain.com and confirm exactly one line begins with v=spf1. Send a test message and check the headers for spf=pass.

Step 2: Enable DKIM Signing

DKIM signs each outgoing message with a private key held on the sending server and publishes the matching public key in DNS under a named selector. Receivers use the published key to confirm the message was genuinely sent by you and was not altered in transit.

default._domainkey.yourdomain.com. 300 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."

On Noiz Plesk hosting you can switch DKIM on per domain under Mail Settings for that domain (the option to sign outgoing mail with DKIM). When the domain uses the Noiz nameservers, the panel generates the key pair and publishes the public key for the default selector automatically, so there is nothing to paste by hand. If your DNS is hosted elsewhere, copy the generated public-key record into that provider. Use a 2048-bit key where you have the choice.

Verification: Query your selector with dig TXT default._domainkey.yourdomain.com and send a test email. The headers should show dkim=pass header.d=yourdomain.com.

Step 3: Enforce Alignment With DMARC

DMARC requires that SPF or DKIM passes and that the domain it authenticated matches the visible From: address (this is called alignment). It also lets you collect reports and tell receivers what to do with mail that fails. Roll it out in three stages so you can watch the reports before you enforce anything.

Monitoring Mode

_dmarc.yourdomain.com. 300 IN TXT "v=DMARC1; p=none; adkim=s; aspf=s; fo=1; rua=mailto:[email protected]"

This generates aggregate reports without affecting delivery. Stay here until the reports show all of your legitimate mail authenticating correctly, which usually takes one to two weeks.

Quarantine Mode

_dmarc.yourdomain.com. 300 IN TXT "v=DMARC1; p=quarantine; sp=quarantine; adkim=s; aspf=s; fo=1; rua=mailto:[email protected]"

Messages that fail alignment are typically delivered to the spam or junk folder rather than rejected. This is a safe middle step before full enforcement.

Reject Mode

_dmarc.yourdomain.com. 300 IN TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; fo=1; rua=mailto:[email protected]"

Messages that fail alignment are rejected outright. This is the strongest protection against spoofing and is the policy the major mailbox providers now expect from bulk senders.

A Note on Strict Versus Relaxed Alignment

The records above use adkim=s and aspf=s, which demand an exact domain match. Strict alignment is the tightest option, but it can trip up legitimate mail that authenticates on a subdomain or a slightly different envelope domain. The DMARC default is relaxed alignment (the same registered domain is enough), and relaxed is often the safer starting point unless you have a specific reason for strict. If test mail fails DMARC while SPF and DKIM individually pass, loosen to adkim=r and aspf=r and re-test.

Subdomain Considerations

If you send mail from subdomains such as mail.yourdomain.com or alerts.yourdomain.com, either publish a DMARC record for each subdomain or use the sp= tag in the parent record to set their policy. If you do not send from any subdomains, keep sp=reject so attackers cannot abuse them to impersonate your brand.

Adding These Records on Noiz Hosting

When your domain uses the Noiz nameservers, all three records are TXT records you add through your control panel's DNS management for the domain (on Plesk this is Websites & Domains > DNS Settings). SPF and DMARC are single TXT records you create by hand; DKIM is best switched on through the mail settings so the panel manages the key for you. If the domain's DNS is hosted with a third party, add the same records there instead. If you are not sure where your DNS is answered from, the Noiz support team can confirm it for you.

Operational Best Practices

• Reverse DNS (PTR): The IP address of your mail server should resolve to a hostname you control, and that hostname should resolve back to the same IP.
• HELO/EHLO identity: Your mail server should present its own hostname consistently in the SMTP banner.
• Consistent From addresses: Use clear role addresses such as noreply@ or support@ rather than system accounts like root@.
• One SPF record: A domain may publish only one SPF record. Multiple SPF TXT records cause validation to fail, so merge every source into a single record.
• Stay under the SPF lookup limit: SPF allows a maximum of ten DNS lookups. Too many include: mechanisms cause a permanent error (permerror) and break authentication, so keep the record lean.
• Third-party senders: Authorise every SaaS platform that sends as you (marketing, CRM, billing) with the correct SPF include and, where offered, DKIM signing for your domain.

Testing and Monitoring

1. Send test emails to Gmail, Outlook and other major providers.
2. Open the Authentication-Results header on each and confirm spf=pass, dkim=pass and dmarc=pass.
3. Review the DMARC aggregate reports delivered to your rua address to see which servers are sending on your behalf and whether they authenticate. A DMARC report analyser makes these XML reports far easier to read.

About failure reports: the older per-message failure reports (the ruf tag) are barely supported by the major mailbox providers today for privacy reasons, so aggregate reports are what you should rely on for monitoring.

Common Pitfalls

• Malformed DNS records: Watch for stray quotes, semicolons or line breaks in TXT records.
• Overly permissive SPF: Avoid +all, and treat ~all (softfail) as a stepping stone only. Use -all to actually enforce.
• Unaligned third-party mail: Newsletters or services that are not DKIM-signed with your domain will fail DMARC unless you configure them properly.
• Multiple SPF TXT records: Only one is valid. Consolidate every sending source into a single record.
• Enforcing too early: Moving straight to p=reject before the aggregate reports are clean is the quickest way to block your own legitimate mail.

Email authentication rewards patience: monitor first, tighten in stages, and read the reports before you enforce. If you host with Noiz and would like a hand publishing or verifying your SPF, DKIM and DMARC records, contact the Noiz support team and they will help you get to a clean p=reject policy safely.