---
title: "How to Protect Your Domain from Spoofing and Improve Email Deliverability"
description: "Protect your domain from spoofing and improve deliverability by publishing SPF, DKIM and DMARC records, then moving DMARC safely from monitoring to reject."
url: "https://docs.noiz.ie/email/how-to-protect-your-domain-from-spoofing-and-improve-email-deliverability/"
section: "Email"
categories:
  - "Email > Email Security"
last_reviewed: "27 July 2026"
---

# How to Protect Your Domain from Spoofing and Improve Email Deliverability

Email is the backbone of business communication, but without the right authentication controls your domain can be spoofed, your legitimate messages can land in spam, and your sending reputation can suffer. This guide explains how to secure your domain with SPF, DKIM and DMARC, and how to roll those protections out in stages so you never accidentally block your own mail.

**Last reviewed:** 27 July 2026. SPF, DKIM and DMARC are stable, published internet standards (RFC 7208, RFC 6376 and RFC 9989, which replaced the original DMARC specification, RFC 7489, in 2026). This guide is written for Noiz hosting and is kept current against those standards and the published sender guidance of the major mailbox providers. It complements, and does not replace, the reference documents linked below.

### Official Documentation Reference

- [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208)
- [RFC 6376: DomainKeys Identified Mail (DKIM)](https://www.rfc-editor.org/rfc/rfc6376)
- [RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)](https://www.rfc-editor.org/rfc/rfc9989)
- [Google: Email sender guidelines](https://support.google.com/mail/answer/81126)
- [Microsoft: Email authentication in Microsoft 365](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-about)
- [DMARC.org: Overview](https://dmarc.org/overview/)

## Prerequisites

- You can edit the DNS (TXT) records for your domain. On Noiz hosting this means the domain uses the Noiz nameservers (`ns1.noiz.co.za` and `ns2.noiz.co.za`) so records are managed in your control panel, or you have access to wherever the domain's DNS is hosted.
- You know which servers and services actually send mail as your domain: your Noiz mailbox, plus any third-party senders such as a marketing platform, CRM, help desk or billing system.
- A little patience for DNS to propagate. Changes usually take effect within minutes, but allow up to the record's TTL before testing.

## Why Basic Authentication Isn't Enough

Attackers can spoof the visible `From:` address that your recipients see even when they are not sending from your servers. SPF on its own only checks the envelope sender (the Return-Path), which end users never see, so a message can pass SPF and still show a forged `From:` address. To properly protect your brand you need all three controls working together: SPF to authorise your sending sources, DKIM to sign your mail, and DMARC to tie authentication to the visible `From:` address and tell receivers what to do when it fails.

## Step 1: Publish a Strict SPF Record

SPF defines which mail servers are allowed to send for your domain. Limit it to your actual outbound IP addresses or mail providers, and end it with `-all` so everything else is rejected. Publish it as a single TXT record on the domain apex.

```
yourdomain.com. 300 IN TXT "v=spf1 ip4:203.0.113.25 include:mailprovider.example -all"
```

Replace `203.0.113.25` with your real sending IP and `mailprovider.example` with any provider you send through. Add one `ip4:`, `ip6:` or `include:` for each legitimate source.

**Verification:** Run `dig +short TXT yourdomain.com` and confirm exactly one line begins with `v=spf1`. Send a test message and check the headers for `spf=pass`.

## Step 2: Enable DKIM Signing

DKIM signs each outgoing message with a private key held on the sending server and publishes the matching public key in DNS under a named selector. Receivers use the published key to confirm the message was genuinely sent by you and was not altered in transit.

```
default._domainkey.yourdomain.com. 300 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqh..."
```

On Noiz Plesk hosting you can switch DKIM on per domain under **Mail Settings** for that domain (the option to sign outgoing mail with DKIM). When the domain uses the Noiz nameservers, the panel generates the key pair and publishes the public key for the `default` selector automatically, so there is nothing to paste by hand. If your DNS is hosted elsewhere, copy the generated public-key record into that provider. Use a 2048-bit key where you have the choice.

On Noiz DirectAdmin hosting (Ireland), DKIM can be enabled per domain from the email accounts section of DirectAdmin, using its **Enable DKIM** option when DKIM is available for your domain. DirectAdmin adds the key to the domain's local DNS zone; if the domain's DNS is hosted elsewhere, copy the `_domainkey` TXT record from the domain's DNS zone into that provider, or outgoing mail will be signed but fail verification. See the [DirectAdmin DKIM guide](https://docs.directadmin.com/other-hosting-services/exim/index.html#dkim-installation-guide).

**Verification:** Query your selector with `dig TXT default._domainkey.yourdomain.com` and send a test email. The headers should show `dkim=pass header.d=yourdomain.com`.

## Step 3: Enforce Alignment With DMARC

DMARC requires that SPF or DKIM passes *and* that the domain it authenticated matches the visible `From:` address (this is called alignment). It also lets you collect reports and tell receivers what to do with mail that fails. Roll it out in three stages so you can watch the reports before you enforce anything.

### Monitoring Mode

```
_dmarc.yourdomain.com. 300 IN TXT "v=DMARC1; p=none; adkim=r; aspf=r; fo=1; rua=mailto:dmarc-reports@yourdomain.com"
```

This generates aggregate reports without affecting delivery. Stay here until the reports show all of your legitimate mail authenticating correctly, which usually takes one to two weeks.

### Quarantine Mode

```
_dmarc.yourdomain.com. 300 IN TXT "v=DMARC1; p=quarantine; sp=quarantine; adkim=r; aspf=r; fo=1; rua=mailto:dmarc-reports@yourdomain.com"
```

Messages that fail alignment are typically delivered to the spam or junk folder rather than rejected. This is a safe middle step before full enforcement.

### Reject Mode

```
_dmarc.yourdomain.com. 300 IN TXT "v=DMARC1; p=reject; sp=reject; adkim=r; aspf=r; fo=1; rua=mailto:dmarc-reports@yourdomain.com"
```

Messages that fail alignment are rejected outright. This is the strongest protection against spoofing and the goal to work towards. It is not what the major mailbox providers demand of bulk senders: [Google's sender guidelines](https://support.google.com/mail/answer/81126) require a published DMARC record, which can be `p=none`, together with SPF, DKIM and alignment of the visible `From:` domain.

### A Note on Strict Versus Relaxed Alignment

The records above use `adkim=r` and `aspf=r`, relaxed alignment, which is also the DMARC default: the same organisational domain is enough, so mail that authenticates on a subdomain still aligns. Strict alignment (`adkim=s` and `aspf=s`) demands an exact domain match. It is the tightest option, but it can trip up legitimate mail that authenticates on a subdomain or a slightly different envelope domain, so only switch to it once the aggregate reports show every legitimate source passing with an exact match.

## Subdomain Considerations

If you send mail from subdomains such as `mail.yourdomain.com` or `alerts.yourdomain.com`, either publish a DMARC record for each subdomain or use the `sp=` tag in the parent record to set their policy. If you do not send from any subdomains, keep `sp=reject` so attackers cannot abuse them to impersonate your brand.

## Adding These Records on Noiz Hosting

When your domain uses the Noiz nameservers, all three records are TXT records you add through your control panel's DNS management for the domain (on Plesk this is **Websites & Domains** > **DNS Settings**). SPF and DMARC are single TXT records you create by hand; DKIM is best switched on through the mail settings so the panel manages the key for you. If the domain's DNS is hosted with a third party, add the same records there instead. If you are not sure where your DNS is answered from, the Noiz support team can confirm it for you.

## Operational Best Practices

- **Reverse DNS (PTR):** The IP address of your mail server should resolve to a hostname you control, and that hostname should resolve back to the same IP.
- **HELO/EHLO identity:** Your mail server should present its own hostname consistently in the SMTP banner.
- **Consistent From addresses:** Use clear role addresses such as `noreply@` or `support@` rather than system accounts like `root@`.
- **One SPF record:** A domain may publish only one SPF record. Multiple SPF TXT records cause validation to fail, so merge every source into a single record.
- **Stay under the SPF lookup limit:** SPF allows a maximum of ten DNS lookups. Too many `include:` mechanisms cause a permanent error (permerror) and break authentication, so keep the record lean.
- **Third-party senders:** Authorise every SaaS platform that sends as you (marketing, CRM, billing) with the correct SPF include and, where offered, DKIM signing for your domain.

## Testing and Monitoring

1. Send test emails to Gmail, Outlook and other major providers.
2. Open the *Authentication-Results* header on each and confirm `spf=pass`, `dkim=pass` and `dmarc=pass`.
3. Review the DMARC aggregate reports delivered to your `rua` address to see which servers are sending on your behalf and whether they authenticate. A DMARC report analyser makes these XML reports far easier to read.

**About failure reports:** the older per-message failure reports (the `ruf` tag) are barely supported by the major mailbox providers today for privacy reasons, so aggregate reports are what you should rely on for monitoring.

## Common Pitfalls

- **Malformed DNS records:** Watch for stray quotes, semicolons or line breaks in TXT records.
- **Overly permissive SPF:** Avoid `+all`, and treat `~all` (softfail) as a stepping stone only. Use `-all` to actually enforce.
- **Unaligned third-party mail:** Newsletters or services that are not DKIM-signed with your domain will fail DMARC unless you configure them properly.
- **Multiple SPF TXT records:** Only one is valid. Consolidate every sending source into a single record.
- **Enforcing too early:** Moving straight to `p=reject` before the aggregate reports are clean is the quickest way to block your own legitimate mail.

Email authentication rewards patience: monitor first, tighten in stages, and read the reports before you enforce. If you host with Noiz and would like a hand publishing or verifying your SPF, DKIM and DMARC records, contact the Noiz support team and they will help you get to a clean `p=reject` policy safely.

---
Source: https://docs.noiz.ie/email/how-to-protect-your-domain-from-spoofing-and-improve-email-deliverability/