SPF, DKIM and DMARC Explained for Business Owners

If your company sends email, someone can pretend to be you. Fake invoices, "urgent" payment requests and password-reset scams are often sent from addresses that look exactly like a real company's. Three DNS records make that much harder: SPF, DKIM and DMARC.

What each record does

• SPF lists the servers allowed to send email for your domain. Receiving servers check the sender against that list.
• DKIM adds a cryptographic signature to each message, proving it was not altered and that your domain approved it.
• DMARC tells receivers what to do when SPF or DKIM fails (nothing, quarantine, or reject) and sends you reports about who is sending as you.

You need all three. SPF and DKIM do the checking, and DMARC is the policy that makes the checks matter.

A safe rollout plan

1. Find every sender. Your mail provider, your website contact form, your invoicing system, newsletter tools and CRM may all send as your domain.
2. Publish SPF listing those senders, ending in ~all at first.
3. Turn on DKIM in each sending service and publish the keys it gives you.
4. Publish DMARC in monitor mode: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
5. Read the reports for 2-4 weeks and fix any legitimate sender that fails.
6. Move to enforcement: first p=quarantine, then p=reject once the reports are clean.

Common mistakes

• Having more than one SPF record (there must be exactly one).
• Going straight to p=reject and blocking your own invoices.
• Forgetting third-party senders such as marketing tools.
• Leaving DMARC at p=none forever, which reports but does not protect.

Check your domain now

Our free Email Security Scanner checks your SPF, DKIM, DMARC and MTA-STS records, grades them A to F and tells you what to fix. If you would rather have it done for you, get in touch.