Stop criminals from sending email as your business: SPF, DKIM and DMARC in plain words

Why this matters to a small business

Standard email does not, on its own, prove who the sender is. A criminal can send a fake invoice or a request to change payment details that appears to come from your address. Your customers and vendors see your name and trust it.

Three records fix most of this problem. They live in your domain's DNS (Domain Name System), the public settings that tell the internet where your website and email are. You add them once at your domain provider, and they work in the background from then on.

What each record does

DMARC.org describes DMARC as building on SPF and DKIM rather than replacing them. A message passes DMARC when SPF or DKIM passes and that domain aligns with the From address. You set the DMARC policy with one of three values: none (watch and report only), quarantine (treat failures as suspicious, usually sending them to spam) or reject (refuse failures outright).

• SPF (Sender Policy Framework): a published list of the services allowed to send email for your domain, such as Microsoft 365, your newsletter tool and your billing system. Think of it as a guest list at the door.
• DKIM (DomainKeys Identified Mail): a digital signature added to each message by your email service. The receiving server checks the signature against a public key in your DNS. If the message was forged or changed on the way, the signature fails. Think of it as a wax seal.
• DMARC (Domain-based Message Authentication, Reporting and Conformance): your instructions for what receiving servers should do when a message fails those checks, and an address where they send you reports. DMARC also checks alignment, which means the domain that passed SPF or DKIM must match the domain in the visible From line.

The 2024 Google and Yahoo sender rules

Starting in February 2024, Google and Yahoo began enforcing new rules for email sent to their users. Google's rules took effect on 02/01/2024 for personal Gmail accounts. Even if your business sends far fewer messages, these rules show where the whole industry is heading.

A safe step-by-step rollout

Microsoft and DMARC.org both recommend moving slowly. Turning on a strict policy too early can block your own invoices or newsletters. Follow these steps in order.

• Step 1: List every service that sends email as you. Include your main mailbox provider, website contact forms, newsletter tools, accounting and billing software, and scheduling systems.
• Step 2: Publish one SPF record that includes each of those services. For a domain that only uses Microsoft 365, Microsoft's example is v=spf1 include:spf.protection.outlook.com -all.
• Step 3: Turn on DKIM in each sending service. In Microsoft 365, this means adding two CNAME records that Microsoft provides and then switching DKIM on.
• Step 4: Publish DMARC with p=none and a reporting address, for example a record named _dmarc with the value v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.com. Nothing gets blocked at this stage; you only collect reports.
• Step 5: Read the reports. Microsoft suggests reviewing them weekly at first. Look for real services that fail and fix them.
• Step 6: Move to p=quarantine. You can phase it in with the pct setting, which applies the policy to a share of failing mail. Microsoft lists steps of 10, 25, 50, 75 and 100 percent.
• Step 7: Move to p=reject once the reports show that all of your real mail passes. At this point, receiving servers that follow DMARC refuse forged messages that fail.

How to check your domain

You can look up your own records in a minute. Online lookup tools, such as the MXToolbox DMARC lookup, read the public DMARC record for any domain and point out errors. Type in your web address and see what comes back.

If the tool finds no DMARC record, your domain has no published policy at all. If it shows p=none, you are collecting reports but not yet blocking forgeries. If it shows quarantine or reject, check that your reports show your real mail passing.

Common mistakes

• Two SPF records. Microsoft warns that more than one SPF record on the same domain causes a permanent error. Combine everything into one record.
• Too many lookups. SPF fails if checking it takes more than 10 DNS lookups. Each include entry counts at least once, and some count more.
• Using ~all instead of -all. Microsoft recommends -all (hard fail) when DKIM and DMARC are also in place, so that DMARC can act on forged mail that has no DKIM signature.
• Forgetting a sender. A newsletter or billing tool left out of SPF and DKIM starts failing as soon as you enforce DMARC.
• Jumping straight to reject. Skipping the p=none stage is the fastest way to block your own invoices.
• Ignoring unused domains. A domain you own but do not use for email can still be forged. Microsoft suggests an SPF record of v=spf1 -all and a DMARC policy of reject for those domains.

How Webflect can help

Webflect sets up and monitors SPF, DKIM and DMARC as part of its IT support for small offices. If you would like a second set of eyes first, the check on the home page is a low-effort place to start.