Candidates and campaigns: lock down your email before Election Day

What can go wrong

Email was built without a way to prove who sent a message. Three DNS records add that proof: SPF lists the servers allowed to send for your domain, DKIM signs each message so it can be verified, and DMARC tells Gmail, Outlook and Yahoo what to do with mail that claims to be from you and fails both. Without an enforced DMARC policy, a message forged to look like it came from your campaign is usually delivered to the inbox.

For a campaign, that means a fake “final push” fundraising email with someone else’s donation link, a fake endorsement or withdrawal, or a message telling volunteers an event or polling location has changed. Your supporters see your real address in the From line.

Two settings that look safe but aren’t

• p=none. This is the policy most setup guides hand out. It tells inboxes to watch failing mail and deliver it anyway. It’s useful for a week of testing, not as a final setting.
• pct=0. The pct tag sets what share of failing mail the policy applies to. A record that says p=reject with pct=0 applies the reject policy to none of it; under the DMARC standard the rest falls back to the next weaker policy, so forged mail goes to spam at best instead of being refused. It’s a common leftover from testing.
• No DKIM. Many campaign domains on shared hosting send mail with SPF only. DKIM is what lets you enforce DMARC without your own mail being caught by it.

Lock it down this week

1. Check where you standType your domain into our free email forgery check. It reads your SPF, DMARC and DKIM records and says plainly whether someone can send as you.
2. Turn on DKIMYour email provider (Google Workspace, Microsoft 365, or your web host’s mail) gives you a DKIM record to add to DNS. Add it before you enforce anything.
3. Make sure SPF lists every senderYour mail provider, your donation platform’s receipts, your newsletter tool and any texting service that sends email. Anything left out will fail once you enforce.
4. Set DMARC to quarantine, then rejectPublish p=quarantine with no pct tag (it defaults to 100). After a few days with no problems, move to p=reject. Add an rua= address so you get daily reports of who is sending as you.
5. Protect the mailboxes themselvesDMARC can’t stop someone who logs in to a real campaign mailbox. Turn on two-step sign-in for every account, and check for forwarding rules nobody set up.
6. Tell supporters how you’ll askOne line on your site and in your emails: we only take donations through our official page, and we will never ask you to pay by gift card, wire or app transfer.

This isn’t about party or race. Every domain that can send email can be impersonated, and election week is when it matters most. If you’d like it done for you, we set up and verify these records the same day, and our incident response team handles impersonation and taken-over mailboxes if it’s already happened. Not legal advice; election-law questions belong with your campaign’s counsel.

Sources

• RFC 7489: DMARC, including the pct tag (IETF)
• Google: Email sender guidelines
• Our free email forgery check