Anyone can type your domain name into the From line of an email. Without checks in place, a message claiming to come from [email protected] can land in a customer’s inbox looking real. SPF, DKIM and DMARC are three DNS records that let receiving mail servers tell your genuine email from forgeries.
This guide explains what each one does, how they fit together, and the order to set them up without blocking your own mail.
What email spoofing looks like
A forged invoice that appears to come from your accounts address. A message to your staff that appears to come from the owner and asks for a payment or a batch of gift cards. The attacker does not need access to your mailbox for either one. This is the groundwork for business email compromise.
SPF: who is allowed to send
SPF (Sender Policy Framework) is a DNS TXT record that lists the servers allowed to send mail for your domain. A receiving server looks up the record and checks whether the sending server is on the list. For a domain that sends only through Microsoft 365 it looks like this:
v=spf1 include:spf.protection.outlook.com -allThe ending matters. -all tells receivers to reject mail from servers that are not listed. ~all is the softer version that marks them as suspicious.
- A domain gets one SPF record. Two records make SPF fail.
- Every service that sends mail as your domain must be in the record: Microsoft 365 or Google Workspace, your invoicing tool, your newsletter service and any website form that sends from your domain.
- SPF allows a limited number of DNS lookups, and each
include:uses some. Microsoft’s guidance is to stay under 10.
DKIM: proof the message is genuine
DKIM (DomainKeys Identified Mail) adds a digital signature to each outgoing message. The signing key stays private to the mail system and the matching public key is published in DNS. The receiving server uses it to check the message came from a system authorized to sign for your domain and was not altered on the way.
In Microsoft 365 you add two CNAME records at your DNS host (selector1._domainkey and selector2._domainkey), then switch on Sign messages for this domain with DKIM signatures in the Microsoft Defender portal. Google Workspace has its own steps, and every third-party sender needs its own DKIM setup.
DMARC: what to do when a check fails
DMARC publishes your policy and asks receivers to send you reports. It is a TXT record at _dmarc.yourcompany.com. A message passes DMARC when it passes SPF or DKIM and the domain used in that check matches the domain in the visible From address. The Canadian Centre for Cyber Security calls that match alignment.
There are three policies:
p=none: monitor only. Delivery is unaffected and you receive reports.p=quarantine: failing mail goes to spam.p=reject: failing mail is refused.
A starting record, following the form the Cyber Centre recommends:
v=DMARC1; p=none; sp=none; rua=mailto:[email protected]Reports arrive as XML files that are hard to read by eye. Most people use a DMARC reporting service to summarize them.
The safe order to set them up
- List everything that sends email as your domain. Ask each department, and check invoicing, CRM, newsletters, website forms, scanners and alert systems.
- Publish SPF covering all of them.
- Turn on DKIM for each sender that supports it.
- Publish DMARC with
p=noneand a mailbox for reports. - Read the reports for a few weeks and fix any legitimate sender that fails.
- Move to
p=quarantine, thenp=reject, once your legitimate mail passes consistently.
The Cyber Centre’s guidance follows the same path: start at none, fix SPF and DKIM misconfigurations, then move to enforcement. Its readiness toolkit recommends SPF and DKIM on all corporate email with DMARC set to reject.
Common mistakes
- Publishing a second SPF record instead of editing the first.
- Forgetting a sender. The invoicing tool is the usual one.
- Jumping straight to
p=rejectand blocking your own invoices. - Never enabling DKIM for the custom domain in Microsoft 365.
- Sending DMARC reports to a mailbox nobody reads.
Why it matters beyond spoofing
Google’s sender guidelines require SPF or DKIM from anyone sending to Gmail accounts. Anyone sending more than 5,000 messages a day to Gmail must set up SPF, DKIM and DMARC, and the DMARC policy can be none. Authenticated mail is also less likely to be treated as suspicious by receiving servers.
How to check what you have today
Open Command Prompt and run these, replacing the domain with yours:
nslookup -type=TXT yourcompany.com
nslookup -type=TXT _dmarc.yourcompany.com
nslookup -type=CNAME selector1._domainkey.yourcompany.comThe first shows your SPF record, the second your DMARC record and the third whether the Microsoft 365 DKIM record exists.
Frequently asked questions
Do small businesses need DMARC?
Yes. Anyone can forge your domain in the From line, and DMARC is the record that lets receivers act on it. A p=none record is a safe, no-risk first step.
What should my first DMARC record be?
A monitoring record: v=DMARC1; p=none; rua=mailto:[email protected], with the mailbox replaced by one you actually read.
Will DMARC block my legitimate email?
At p=none it does not affect delivery. Quarantine and reject can block legitimate mail from any sender you forgot to set up, which is why you review reports first.
Is SPF alone enough?
No. SPF breaks when mail is forwarded and does not protect the visible From address. Use SPF, DKIM and DMARC together.
Not sure what your domain publishes today? Scandifix reviews email authentication for Microsoft 365 and Google Workspace and sets it up in stages so your mail keeps flowing. See cybersecurity services and our email security best practices, call +1 (587) 400-9991 or contact us.