Stop people impersonating your church by email
Anyone can type your pastor's name and your church's address into an email. Whether it gets delivered depends on a few lines of text in your domain's settings. Most churches haven't added them.
What this is
Two records tell receiving mail systems what to do with mail that claims to be from your church. SPF lists the services allowed to send for you. DMARC says what to do when a message fails that check: nothing (none), put it in spam (quarantine), or refuse it (reject). Only the last two actually stop forgeries.
What we found
- can be impersonated, of domains that receive mail
- 89%
- enforce DMARC
- 8%
- have no SPF record
- 45%
Of 46 churches using Google Workspace, 45 could still be impersonated. Of 33 using Microsoft 365, 27 could. Both providers offer the protection. It just hasn't been switched on. Of 60 churches that had started with a DMARC record, only 19 had asked for the reports that show when it is safe to go further. "Can be impersonated" means nothing published tells receivers to reject forgeries; it doesn't mean every forged message arrives. Method.
We found it on our own domain too.
On 21 October 2026, while building this guide, we ran the same check on Wroot Labs' own domain and found it had no DMARC record, plus an out-of-date SPF record that still listed an email provider we'd stopped using. Anyone could have sent mail as us. We fixed it the same day: a corrected SPF record, a DMARC record in watch-only mode, and Google's signing key. The next step, after a few weeks of reports, is to move to quarantine and then reject. If it was easy to miss for a team that builds software, it is easy to miss for a church.
Do this week
- Check your address and note the result.
- Find out who manages your domain's DNS settings. It is usually wherever the domain was bought (GoDaddy, Cloudflare, Namecheap, Squarespace Domains), or a volunteer who set it up. Get their login, or ask them to make the change.
- List every service that sends email as your church: your mail provider, your newsletter tool (Mailchimp, Constant Contact), your giving or church software, and your website's contact form. Miss one and its mail may start failing at stage 3, so do this before you tighten anything.
- Add or correct your SPF record to include those services. Provider steps: Google Workspace, Microsoft 365.
- Add a DMARC record that only watches: v=DMARC1; p=none; rua=mailto:you@yourchurch.org (a record named _dmarc). The rua address receives daily summary reports. Provider steps: Google Workspace, Microsoft 365.
Do this month
- Let the reports come in for two to four weeks. They are dense XML, so a free report reader is easier; ask your provider or search for "DMARC report analyzer."
- When the reports show only your known senders passing, change p=none to p=quarantine.
- After a few more clean weeks, change it to p=reject. That is the setting that stops forged mail.
Don't skip to reject. If a legitimate sender isn't on your SPF list, its mail will be refused, and that usually shows up as "the newsletter stopped arriving."
Also worth knowing
- DKIM is a third way of signing mail. Google Workspace and Microsoft 365 both walk you through it; turn it on when you set up DMARC.
- Domains that never send mail (an old one you keep for the name) can have a strict policy straight away. There's nothing legitimate to break.
- This protects your exact address. It does nothing about a lookalike such as firstumc-church.org. See scams.