SPF, DMARC, DNSSEC, CAA: The Four DNS Records Deciding Whether Anyone Can Impersonate Your Domain
Most DNS records point things at other things, a domain at an IP, a subdomain at a service. A handful of records do something different: they're policy statements that tell the outside world what's supposed to be true about your domain, and whether to trust something claiming otherwise. Four of them matter enough that Decloak checks all of them, every scan, showing what was verified even when everything comes back clean.
SPF: who's allowed to send email as you
Sender Policy Framework lists which mail servers are authorized to send email on behalf of your domain. A receiving mail server checks the sending server's IP against your domain's SPF record, and if it isn't listed, that's a strong signal the email is spoofed.
v=spf1 include:_spf.google.com include:sendgrid.net ~all
This says: mail from Google's servers and SendGrid is legitimate, ~all softly flags anything else as suspicious rather than hard-failing it (-all would reject outright). Without an SPF record at all, there's no baseline to check against, anyone can send email claiming to be you@yourcompany.com and a receiving server has no domain-level signal telling it not to trust that.
DMARC: what should happen when SPF or DKIM fails
DMARC builds on SPF and DKIM (a separate cryptographic signing standard) by telling receiving servers what to actually do when a message fails those checks, and by giving you visibility into who's sending mail as your domain at all.
v=DMARC1; p=reject; rua=mailto:reports@yourcompany.com
p=reject tells receiving servers to reject anything failing authentication outright. p=quarantine sends it to spam instead. p=none does nothing but still generates reports, useful for observing what's happening before committing to an enforcement policy. The rua address is where you receive aggregate reports showing every server sending mail claiming to be your domain, which is often the first time an organization discovers a legacy system, a marketing tool, or an old integration is still sending mail nobody remembered existed, or the first time they discover someone else entirely is spoofing them.
DNSSEC: proving DNS answers haven't been tampered with
DNS was never built with authentication in mind, a resolver asks a question and trusts whatever answer comes back. DNSSEC adds cryptographic signatures to DNS records, so a resolver can verify that the answer it received actually came from the legitimate authority for that domain and wasn't altered in transit, the defense against DNS cache poisoning and certain man-in-the-middle attacks against domain resolution itself.
It's the record on this list most commonly skipped, largely because it's the most operationally fiddly to set up and maintain (key rotation, in particular, has a real history of causing outages when done carelessly). That operational friction is a real cost, but it's worth weighing against what DNSSEC actually protects against: without it, there's no cryptographic guarantee that the IP address your visitors' browsers resolve for your domain is the one you actually published.
CAA: who's allowed to issue a certificate for your domain
Certification Authority Authorization records specify which certificate authorities are permitted to issue SSL/TLS certificates for your domain at all.
example.com. CAA 0 issue "letsencrypt.org"
Without a CAA record, any publicly trusted certificate authority can issue a valid certificate for your domain, if one of them is compromised, socially engineered, or simply makes a mistake in their validation process, a fraudulent but technically valid certificate for your domain becomes possible. A CAA record narrows that to only the CAs you've actually authorized, closing off an entire class of certificate-based impersonation that has nothing to do with anything you control directly.
How Decloak checks all four
DNS record analysis runs on every Starter+ scan, checking SPF, DMARC, DNSSEC, CAA, and your mail and nameserver records as a full checklist, every check shown, even the ones that come back clean, so you can see exactly what was verified rather than only hearing about problems. A domain with no SPF record, a DMARC policy stuck at p=none indefinitely, or no CAA record at all each show up as a distinct, explained finding rather than a single vague "DNS issues found."
Why this is worth checking even if email spoofing feels like someone else's problem
A domain with weak or missing SPF/DMARC doesn't just risk your own inbox, it makes your domain a more effective tool for phishing campaigns targeting your customers, partners, and employees, since mail claiming to be from you is harder to distinguish from mail that actually is. And a missing CAA record is a risk that exists whether or not you've ever thought about certificate authorities at all, it's not something you opt into by doing something wrong, it's a gap that exists by default until you close it.
DNS record analysis, covering SPF, DMARC, DNSSEC, CAA, and more, runs automatically on Decloak Starter and above. See plans →