AuditHQ
← All articles
Article · Websites · 6 min read · Updated 2026-09-22

SPF and DMARC on Your Website Domain: Why Security Scans Flag Them in 2026

Missing SPF or DMARC is not a header bug — it is open season for anyone to send mail that looks like it came from you.

Why this shows up next to CSP and HSTS

Customers trust the From: line more than they trust your TLS grade. If your apex domain has no SPF and no DMARC, a stranger can send invoices that look like yours.

AuditHQ’s deep website security scan checks public DNS for SPF and DMARC on the audited host. Missing records become findings you can fix without a pentest.

Minimum viable records

SPF: a TXT record that lists every service allowed to send as your domain (Google Workspace, transactional ESP, etc.) and ends with a hard fail (~all) once you trust the list.

DMARC: a TXT at _dmarc that starts in p=none so you can watch reports, then moves to quarantine or reject when the data looks clean.

DKIM still matters for deliverability; the scan flags DMARC/SPF first because they are the spoofing controls shoppers feel.

Fix without breaking mail

Inventory every sender before you tighten ~all. Soft-fail (?all) is a temporary bridge, not a destination.

After DNS propagates, re-run the AuditHQ security scan. SPF/DMARC findings should clear when the public TXT records resolve.

Run this on your site

AuditHQ schedules website measurements, a deep security scan and Production readiness checklist on your own URL, waterfalls, screenshots, competitor scores, and ranked fixes.

SPF record websiteDMARC setup 2026email spoofing domainwebsite email authenticationSPF DMARC security scanprotect domain from spoofingAuditHQ SPF DMARCDNS email security checklist