Six DNS records decide whether your mail can be forged

Spoofing your domain takes one line in a mail client unless DNS says otherwise. SPF lists who may send, DMARC tells receivers what to do with mail that fails, DKIM signs every message, MX proves the domain receives at all, DNSSEC signs the answers so they cannot be swapped in transit, and CAA restricts which certificate authorities may issue for the name.

The most common finding, by a wide margin, is DMARC with p=none. That policy only monitors; it lets forged mail through and merely reports it. The second is SPF ending in ~all, a soft fail that most receivers treat as a shrug. The fix is p=quarantine or p=reject once the reports show every legitimate sender is covered, and -all on SPF.

The check looks for fourteen common DKIM selector names, so a custom selector shows as missing even when signing works. Read the DKIM line as a prompt to verify, not as a verdict.