Guide · Security
Email domain security: SPF, DKIM and DMARC
Anyone can send an email that claims to be from your company's domain — unless the domain is protected. Criminals use this for phishing: fake invoices to your clients, fake payment instructions to your accountant, fake messages from the director. Three DNS records — SPF, DKIM and DMARC — let receiving mail servers check whether a message really comes from you. They also improve delivery of your legitimate email, and major email providers now expect them from senders.
[ 01 ]
In short
In short
- 01
SPF lists the servers allowed to send email for your domain.
- 02
DKIM adds a cryptographic signature proving the message was not altered and came from an authorised sender.
- 03
DMARC tells receivers what to do with messages that fail SPF/DKIM alignment, and sends you reports.
- 04
Include every service that sends mail for you: mailbox provider, website forms, CRM, email marketing, invoicing tools.
- 05
Roll out DMARC gradually: monitor first, then quarantine, then reject.
[ 02 ]
Guide
SPF
An SPF record is a TXT record in your domain's DNS that lists authorised sending sources: your email provider, your website's mail service, your CRM. Receiving servers check whether the sending server is on the list.
Watch for the limit of DNS lookups in an SPF record; many services each add includes, and exceeding the limit breaks SPF. Only one SPF record should exist per domain.
DKIM
DKIM uses a pair of keys: the sending service signs outgoing messages with a private key, and publishes the public key in your DNS. Receivers verify the signature. Each sending service provides its own DKIM record to add.
DMARC
DMARC ties SPF and DKIM to the domain visible in the "From" address (alignment) and sets a policy:
p=none— monitor only; receivers report but do not block.p=quarantine— failing messages go to spam.p=reject— failing messages are rejected.
DMARC also sends aggregate reports to an address you specify, showing which sources send mail using your domain.
Rolling out DMARC safely
- Publish SPF and DKIM for all legitimate sending services.
- Publish DMARC with
p=noneand a reporting address. - Review reports for a few weeks; find services you forgot and fix them.
- Move to
p=quarantine, then top=rejectonce legitimate mail passes consistently.
Report analysis is easier with a DMARC reporting service that turns XML reports into readable summaries.
Services people forget
- The website's contact form notifications and order emails.
- CRM and helpdesk systems.
- Email marketing platforms.
- Accounting and invoicing software.
- Recruitment platforms sending on your behalf.
Beyond DNS records
- Two-factor authentication on mailboxes. See access management for teams.
- Training staff to verify payment requests by a second channel, especially changes of bank details.
- Monitoring for look-alike domains registered by others.
[ 03 ]
FAQ
Frequently asked questions
Will DMARC stop all phishing?
It stops messages that use your exact domain without authorisation. It does not stop look-alike domains or compromised mailboxes, which need other controls.
Can SPF, DKIM and DMARC break our email?
If a legitimate sending service is missing from SPF or DKIM when DMARC moves to quarantine or reject, its messages will fail. That is why monitoring comes first.
Do we need this for a small company?
Yes. Small companies are frequent targets of invoice fraud, and major email providers increasingly expect authenticated mail from all senders.