Lion Cipher Lab

Set up SPF, DKIM, and DMARC for your domain

• Cyber / Security Engineer
• Intermediate
• ~70 min (plus waiting for DNS and the first DMARC report)
• Free · no account required

Why it matters

Ordinary internet email was designed in a more trusting era, and it never checks that the From address is real. Nothing in plain email stops an attacker from typing your domain into the From line and sending a message that, to a recipient, looks exactly like it came from you or your company. That single weakness is the engine behind most phishing, invoice fraud, and business email compromise — the attacker borrows the trust in your name. SPF, DKIM, and DMARC are the public, standardised, free fix, and they live entirely in your domain's DNS. SPF publishes the list of servers allowed to send…

What you'll learn

• explaining why plain internet email is trivially spoofable, and what a DNS TXT record is
• reading and writing an SPF record that lists the servers allowed to send for your domain
• turning on DKIM at your mail provider and understanding the selector and the public key in DNS
• publishing a DMARC record starting safely at p=none with an rua reporting address
• verifying all three records with dig or nslookup and a free public checker (MXToolbox / dmarcian / dmarc.org)
• reading a DMARC aggregate report to see who is really sending mail as your domain
• rolling a DMARC policy up from none to quarantine to reject without blocking your own legitimate mail

Steps in this lab

1. The words first: DNS, TXT record, and spoofing
2. The three controls at a glance, and how they combine
3. The one rule, and the free analysis-only path
4. Inventory who sends mail as your domain (do this before SPF)
5. Publish your SPF record
6. Turn on DKIM (the selector and the key)
7. Publish DMARC — start safe at p=none with reporting
8. Verify all three with dig or nslookup
9. Confirm with a free public checker
10. Read your first DMARC aggregate report
11. Raise the policy: none, then quarantine, then reject
12. Why this is the control worth doing first

Open the full interactive lab →