Email records

A p=none DMARC record reports the spoofing. It doesn't stop it.

SPF and DMARC are the two DNS records that stop strangers sending mail as your domain — and the ones people get wrong most. Tick who actually sends mail for you and get the exact records, paste-ready, or lock down a domain that sends no mail at all.

Real sender registry
Null-MX lockdown option
Graded by the live /email rules
Free, no account

Your domain optional — fills the record names and the DKIM/report hints Other senders optional — SPF include: hosts for providers not listed above, space or comma separated DMARC policy Send reports to optional but recommended — a mailbox you watch for the daily aggregate (rua) reports

Options

This domain sends no mail (parked / brand-only) locks it down: v=spf1 -all, a null MX (RFC 7505), and p=reject — nobody can send as it, and senders reject spoofed mail immediately Soft-fail SPF (~all) instead of hard-fail (-all) for a cautious rollout: receivers accept-but-mark unlisted senders rather than rejecting. Move to -all once you've confirmed every sender is listed Apply the DMARC policy to subdomains too (sp=) sets sp= to the same policy; without it subdomains inherit p, which is usually fine — set it to lock a domain whose subdomains shouldn't send

Programmatic: /api/email-builder?send=google,ses&policy=reject&rua=… returns {spf, dmarc, ready, findings} — build the records in a script or CI. Already publish SPF/DMARC? Grade them instead.