DNS-over-HTTPS (DoH) & Email Security (SPF, DMARC)
The Domain Name System (DNS) is the fundamental directory of the internet. Every second, millions of servers query A, MX, and TXT records. In recent years, DNS has evolved from plaintext UDP/53 packets to encrypted DNS-over-HTTPS (DoH), while email security now demands a strict three-tier defense: SPF, DMARC, and DKIM.
The Evolution of DNS: From UDP/53 to DoH
Historically, DNS queries were sent unencrypted over UDP port 53. Any intermediary router could intercept, log, or spoof DNS responses.
With DoH (RFC 8484), published in October 2018 by Paul Hoffman (ICANN) and Patrick McManus (Mozilla), DNS queries are encapsulated inside standard HTTPS requests over TLS. This offers two major benefits:
- Privacy & Tamper Resistance: Responses are signed by trusted DoH resolvers (Cloudflare 1.1.1.1, Google 8.8.8.8).
- Browser Native Queries: Client-side web tools can inspect DNS records without relying on backend proxy servers.
Email Authentication Triad: SPF, DMARC, and DKIM
Major email providers (Google Workspace, Microsoft 365) enforce strict authentication requirements:
1. SPF (Sender Policy Framework)
Meng Weng Wong combined two earlier anti-spoofing proposals — Hadmut Danisch's "Reverse MX" and Gordon Fecyk's "Designated Mailer Protocol," both inspired by a 2002 paper from BIND author Paul Vixie — into SPF in mid-2003, announcing it on a mailing list that June. It became RFC 4408 in 2006 and was refined into the current RFC 7208 in 2014. A TXT record lists authorized sending IP addresses and email providers:
v=spf1 a mx include:_spf.google.com include:sendgrid.net ~all
2. DMARC (Domain-based Message Authentication)
DMARC started as an internal PayPal initiative around 2010 — the company was a favorite phishing target and pushed a coalition of Google, Microsoft, Yahoo, and others to standardize a shared policy layer on top of SPF and DKIM. The spec went public in 2011 and became RFC 7489 in March 2015, authored by Murray Kucherawy and Elizabeth Zwicky. A TXT record at _dmarc.yourdomain.com dictates how receiver servers handle unauthenticated emails:
v=DMARC1; p=quarantine; sp=reject; rua=mailto:[email protected]; pct=100
3. DKIM (DomainKeys Identified Mail)
DKIM merged two competing 2004 proposals: Yahoo's DomainKeys, built by Mark Delany, and Cisco's Identified Internet Mail, built by Jim Fenton and Michael Thomas. The combined standard shipped as RFC 4871 in May 2007 — Yahoo granting a royalty-free patent license the same year removed the last obstacle to adoption — and was consolidated into the current RFC 6376 in 2011. A TXT record contains a public cryptographic key at selector._domainkey.yourdomain.com:
v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...
Features of Our DNS & SPF/DMARC Inspector
Our DNS Lookup & SPF/DMARC Inspector brings live testing and rule generation into a single interface:
- Live DoH Dig: Query A, AAAA, MX, TXT, NS, CNAME, and CAA records via Cloudflare and Google DoH APIs.
- Interactive SPF Builder: One-click provider chips for Google Workspace, M365, SendGrid, and Mailgun.
- DMARC & DKIM Constructor: Customize alignment (
aspf,adkim), filtering percentages (pct), and reporting mailboxes (rua/ruf). - BIND Zone Exporter: Export formatted DNS zone files for authoritative BIND server deployments.
Quick start: open the tool → query your domain with Live DoH Query → switch to SPF Builder and toggle your mail providers → switch to DMARC Builder and start with p=none to monitor before enforcing → publish both TXT records → re-run the lookup to confirm they resolve.
Related Tools
Frequently asked questions
What is DNS-over-HTTPS (DoH) and why is it better?
DoH (RFC 8484) encrypts DNS lookups over HTTPS (port 443/TLS). Unlike traditional unencrypted UDP/53 queries, DoH prevents MITM eavesdropping, DNS spoofing, and provider tampering, while enabling web applications to execute DNS queries directly in the browser.
What is the difference between SPF, DMARC, and DKIM?
SPF defines which IP addresses and services are authorized to send email for your domain. DKIM adds a cryptographic signature to outgoing email headers. DMARC tells receiving mail servers what policy to enforce (none, quarantine, reject) when SPF or DKIM checks fail.
What is the difference between ~all and -all in SPF?
~all (SoftFail) advises receiving mail servers to accept the email but mark it as suspicious. -all (HardFail) strictly instructs receiving servers to reject non-compliant messages.
Author
Alex RelFullstack Engineer
In commercial development since 2011 — over 15 years. Author of two SaaS products, TeleGo.io and LingvoHabit.com. The articles here come out of real client and product work.
