Serving Delaware, Maryland & Greater Philadelphia Client support(302) 373-1590[email protected]
Albano Tech
Free consultation

Cybersecurity

SPF, DKIM, and DMARC explained for business owners

Three DNS records decide whether your email is trusted, and whether someone else can send email pretending to be you.

By Zach Albano · Published · 2 min read

If your business emails land in spam, or a client receives a fake invoice that appears to come from your domain, the cause is often missing or misconfigured email authentication. Three records work together to prevent this.

SPF: who is allowed to send

A Sender Policy Framework (SPF) record lists the services allowed to send email for your domain, such as Microsoft 365 or your invoicing system. Receiving servers check whether a message came from one of them. A domain should have exactly one SPF record, so new services need to be added to the existing record rather than given their own.

DKIM: proof the message wasn't altered

DomainKeys Identified Mail (DKIM) adds a digital signature to each outgoing message. Receiving servers use a public key published in your DNS to confirm the message really came from your domain and wasn't changed in transit. In Microsoft 365, DKIM has to be switched on for each custom domain after the DNS records are added.

DMARC: what to do when checks fail

Domain-based Message Authentication, Reporting, and Conformance (DMARC) tells receiving servers how to handle messages that fail SPF and DKIM, and sends you reports about who is sending email using your domain. Its policy has three levels:

  • p=none: monitor only. Nothing is blocked, but you receive reports.
  • p=quarantine: failing messages go to spam.
  • p=reject: failing messages are refused.
How a receiving mail server checks an email An email arrives. The receiving server checks SPF and DKIM, then applies the sender's DMARC policy, which results in delivery to the inbox, quarantine in spam, or rejection. Emailarrives SPF checkallowed sender? DKIM checkvalid signature? DMARCapplies policy Pass: inbox Fail: quarantine Fail: reject
DMARC uses the results of SPF and DKIM to decide what happens to a message. Which failure outcome applies depends on your policy.

A safe rollout

Start with SPF and DKIM, then publish DMARC at p=none and review the reports for a few weeks. Once every legitimate service sending as your domain is passing, move to p=quarantine, and later p=reject. Skipping straight to enforcement can block your own invoices, newsletters, or scanned documents.

Major mailbox providers, including Gmail, Yahoo, and Outlook.com, now expect bulk senders to have these records in place, so getting them right helps deliverability as well as security.

Zach Albano

Founder of Albano Tech, providing managed IT, Microsoft 365, and cybersecurity services to businesses in Delaware, Maryland, and the Philadelphia region. More about Zach.

Need help with this?

Albano Tech provides Cybersecurity & Security Assessments for businesses in Delaware, Maryland, and the Philadelphia region.

Request a free consultationAbout this service

Related articles