Security & Access Security
Google Workspace SPF, DKIM & DMARC Setup
Set up SPF, DKIM and DMARC for a Google Workspace domain: Google's SPF record, generating the DKIM key in the Admin console, and Google's recommended DMARC rollout.
5 min read
Email security hub
Email security, by situation
Free tools and step-by-step guides for the three moments that matter: a message you don’t trust, an account you think someone else has got into, and a domain you need to stop others from impersonating.
01
Got a suspicious email?
Don’t click its links, open its attachments or reply yet. Check who really sent it first — then decide.
Free tool
Is This Email Real? →
Compare a sender with the addresses and domains the company itself publishes.
Free tool
Email Header Analyzer →
Paste a message’s headers to trace its route and see its SPF, DKIM and DMARC results.
Check, then report
- How to Check if an Email Is Real Find out whether an email really came from who it says: read the real address, use the signals Gmail, Outlook and Yahoo show, open the full headers and check the DMARC result.
- Phishing Emails: How to Spot, Check and Report Them How to tell a phishing email from a real one in a minute: the warning signs Google, Microsoft and Apple publish, the address tricks scammers use, what real companies never ask for, and what to do next.
- How to Report Phishing Emails Where and how to report a phishing email: in Gmail and Outlook, to the company being impersonated (Apple, PayPal, Amazon, Netflix and more), and to national services in the US, UK and Australia.
02
Clicked a link, or think your account is hacked?
Act from a device you trust, starting with the account that was exposed. Your email account comes first — it can reset the passwords of almost everything else.
Start here Clicked a Phishing Link or Gave Your Password? What to Do Now Step-by-step help after a phishing email: what to do if you clicked a link, typed a password, gave a code or card details, paid a scammer, or let someone control your computer.Secure your account, by provider
03
Protect a domain you own
SPF, DKIM and DMARC tell receiving mail servers which email from your domain is genuine — so they can reject the rest. Check what you have, build what’s missing, then read the reports.
Step 1
SPF, DKIM & DMARC Checker →
Check all three records for a domain in one go.
Step 2
SPF Record Generator →
Build a valid SPF record for the services that send your mail.
Step 3
DMARC Record Generator →
Create the DMARC policy to publish in DNS.
Step 4
DMARC Report Analyzer →
Read the DMARC reports you receive: who sends as your domain, and what fails.
Checking one record? SPF checker DKIM checker DMARC checker
Setup guides
Microsoft 365 Security
Microsoft 365 SPF, DKIM & DMARC Setup
Set up SPF, DKIM and DMARC for a custom domain in Microsoft 365: the exact SPF record for each Microsoft cloud, the two DKIM CNAMEs, and a safe DMARC rollout.
6 min read
Every security guide
Browse everything in the Security category.