SPF and DMARC are DNS TXT records that tell mailbox providers which servers are allowed to send email as your domain, and what to do with messages that fail that check. Without them, nothing stops anyone from sending an email that appears to come from your domain — no server compromise required, just a mail server willing to set an arbitrary "From" address, which is how most business-email-compromise and phishing-as-your-brand attacks work.
What each record actually does
An SPF (Sender Policy Framework) record lists the mail servers authorized to send on your domain's behalf — receiving mail servers check the sending server's IP against this list. A DMARC record builds on SPF (and DKIM) by telling receiving servers what to do when a message fails those checks — quarantine it, reject it outright, or just monitor and report. Without DMARC, even a domain with SPF configured often has no enforcement: messages that fail SPF may still land in an inbox.
Why AI-built products often skip this entirely
DNS-level email authentication has nothing to do with how the app itself is built or deployed — it's set once on the domain's DNS, separate from code, and it's easy to launch a product without ever touching it. Unless someone deliberately configures transactional email (via a provider like Resend, SendGrid, or Postmark) and follows that provider's setup guide for domain authentication, SPF and DMARC are simply never created.
How to add them
Add a TXT record at your domain root starting with v=spf1, listing every service that sends mail as you (your transactional email provider, Google Workspace, etc.), ending in ~all or -all. Separately add a TXT record at _dmarc.yourdomain.com starting with v=DMARC1, e.g. v=DMARC1; p=quarantine; rua=mailto:you@yourdomain.com — start at p=quarantine or even p=none to monitor before moving to the stricter p=reject.
Frequently asked
Can someone spoof my email even if I've never sent a marketing email from my domain?
Yes — SPF and DMARC protect the domain itself, not a specific mailbox. If your domain has no SPF/DMARC records at all, it can be spoofed regardless of whether you've ever sent real email from it.
What's the difference between p=none, p=quarantine, and p=reject in DMARC?
p=none only monitors and reports failures without affecting delivery, p=quarantine sends failing messages to spam, and p=reject blocks them outright. Most domains start at none or quarantine to avoid breaking legitimate mail before moving to reject once they've confirmed nothing legitimate is failing the check.