# Protect email from your domain (SPF, DKIM and DMARC)

> Anyone can send an email that claims to come from your domain. Three DNS records let receiving mail servers tell the real mail from the fake: SPF (which…

Source: https://infranest.io/docs/email-protection
Last updated: 2026-10-26

---

Set up SPF, DKIM and DMARC so mail servers can tell real email from your domain apart from fake messages — this is for anyone who owns a domain, whether or not they're technical.

## Overview

- Anyone can send an email that pretends to be from your domain. Three DNS records let receiving mail servers check which mail is genuine:
- **SPF** says which servers are allowed to send mail for you.
- **DKIM** adds a signature to every message you send.
- **DMARC** tells receivers what to do with mail that fails those checks.
- InfraNest writes these records for you using what it already knows about your domain, so you never have to write them by hand.

## Set it up for one domain

1. Open the domain from **Domains**, or its zone from **DNS**.
2. In **Protection** (on the domain page) or the email card (on the zone page), choose **Add** next to SPF or DMARC.
3. Check the preview. Each record shows what it is now, what it will become, and why.
4. Choose **Write**. InfraNest writes the records through your DNS host and then checks public DNS. A record usually goes live within a few minutes.

### What InfraNest writes

- **SPF** — names the mail provider that handles your email. InfraNest recognises it from your MX records (Google Workspace, Microsoft 365, Zoho, Proton, Fastmail and many more). If it cannot tell, you pick your provider from a list.
  - If you already have an SPF record, InfraNest adds your provider to it and leaves everything else exactly as it is. It never creates a second SPF record, since two records make receivers ignore SPF altogether.
  - Receivers allow at most 10 DNS lookups for SPF. InfraNest counts them before it changes anything, and refuses a change that would go over the limit, showing you the count.
- **DMARC** — starts at monitor-only mode. That only watches: it changes nothing about how your mail is delivered. If you already have a DMARC record, InfraNest leaves it alone.
- **DKIM** — is switched on at your mail provider, not in DNS by hand. The preview links straight to the right page (for example Google Admin or the Microsoft Defender portal). Once your provider publishes the key, InfraNest finds it by itself; there is nothing to confirm.
  - Microsoft 365 needs two DKIM records in your DNS (DKIM (selector1) and DKIM (selector2)), and only Microsoft Defender shows where they point. If another of your domains already has them, InfraNest uses that, once public DNS confirms Microsoft has a key ready for this domain. Otherwise the preview asks you for one value: open the DKIM settings in Defender, choose the domain and paste the value shown for selector1. InfraNest writes both records from it. When they are live, switch DKIM on for the domain in Defender — Microsoft only signs your mail after that step.
- **Autodiscover** (Microsoft 365) — helps Outlook and phones find the mailbox when someone signs in with an address at your domain. InfraNest adds it only when your domain has no Autodiscover record yet, so a mail server of your own keeps answering.

> [!NOTE]
> Moving DMARC from monitor-only to a stricter policy is your decision, made on the DNS page. Do it once you are sure every service that sends mail for you passes SPF or DKIM, or real mail can be rejected.

## Lock down domains that send no mail

Parked domains and domains you only keep for a website can be spoofed too. If a domain receives no mail and nothing sends mail for it, InfraNest offers to lock it down with three records:

1. A **Null MX** record, which says the domain accepts no mail.
2. An **SPF** record set to hard fail, which says no server may send for it.
3. A **DMARC** record set to refuse spoofed mail.

InfraNest only offers this when there is no sign of sending. If the domain's SPF record names a sender, or it has a DKIM key, it is left alone — something may send mail for it without an MX record, and locking it down would block that mail.

## Fix email protection across several domains

1. Go to the **Domains** overview.
2. Find the **Email protection** and **Sends no mail** lines, which count how many domains already have each set up.
3. Choose **Fix** or **Lock down** to see, per domain, what InfraNest will write, which DNS hosts need the records added by hand, and which domains are skipped and why.
4. Choose **Confirm** to write the changes. InfraNest only writes the domains it can write to; each one is checked and recorded on its own.

<!-- screenshot: email-protection -->

<!-- docs-screenshots:start:email-protection -->

![Protect email from your domain (SPF, DKIM and DMARC)](/media/979ed772-f9d6-4edb-b5cc-d3906e059988)

<!-- docs-screenshots:end:email-protection -->

## When InfraNest cannot write to your DNS host

1. If your domain's DNS is at a provider InfraNest is not connected to, open the preview to see copy-ready records.
2. Add them at your DNS host.
3. Choose **Check public DNS**. InfraNest confirms each record as soon as it is live.

## Undo a change

Every change is recorded in the zone's **History**, grouped as one change, so you can undo it in one step.