SPF, DKIM, and DMARC are three DNS records that tell receiving mail servers whether an email claiming to be from your domain is genuine. Without them, anyone can send an email that appears to come from your business address. This is how invoice fraud, supplier impersonation, and phishing attacks targeting your clients often start. Setting these records is free, does not require server access, and is one of the highest-value security steps a small business can take.
How SPF, DKIM, and DMARC work together
SPF (Sender Policy Framework) is a DNS TXT record that lists every mail server permitted to send email on behalf of your domain. When a receiving server gets an email claiming to be from you, it checks your SPF record. If the sending server is not listed, the receiving server knows the email did not come from an authorised source. SPF alone does not block delivery, but it provides evidence for spam filters and DMARC policies.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email sent through your legitimate mail platform. The signature is verified against a public key published in your DNS. A valid DKIM signature proves that the email was not modified in transit and that it was sent by a service in control of your domain's private key. Most major email platforms — Google Workspace, Microsoft 365, and third-party senders like Mailchimp — can be configured to sign outgoing mail with DKIM.
DMARC (Domain-based Message Authentication, Reporting and Conformance) sits on top of SPF and DKIM and tells receiving servers what to do with mail that fails authentication. A DMARC policy set to p=none does nothing to delivery but sends you reports about who is sending mail as your domain. A policy of p=quarantine or p=reject actively blocks or filters unauthenticated mail. Reports arrive as XML, but free tools can parse them into readable summaries.
Why a monitoring policy is often the first step
Jumping straight to a p=reject DMARC policy without first understanding what is sending mail as your domain is a common mistake. If your business uses third-party services that send email on your behalf — a booking system, an invoice platform, a marketing tool — and those services are not added to your SPF record or configured with DKIM, a strict DMARC policy will cause legitimate emails to fail.
Starting with p=none and a reporting address gives you two to four weeks of data showing every source that sends mail as your domain. Review the reports, add any legitimate services to SPF, ensure DKIM is configured for each, and then progressively tighten the DMARC policy to p=quarantine then p=reject.
How to list every service sending as your domain
This is the step most businesses miss. Your business email platform (Google Workspace, Microsoft 365) is obvious. But there may be others: your website's contact form plugin, a CRM system, an invoicing tool, a newsletter platform, or an e-commerce notification system. Each of these that sends email using your domain as the From address needs to be included in your SPF record and configured with DKIM.
- Check your current SPF record using MXToolbox or a similar DNS lookup tool.
- List every third-party tool that sends email on your behalf and verify each is included in SPF.
- Enable DKIM in your email platform's settings and add the DNS key it provides.
- Set DMARC to
p=nonewith aruareporting address to start collecting data. - After reviewing reports, tighten the policy to
p=quarantinethenp=rejectover 4–8 weeks.
Email authentication protects your brand from simple spoofing and fake invoice scams.
Run the free website security scanner