SPF, DKIM and DMARC explained: stop attackers sending email in your name
Email was designed in a time when everybody trusted everybody. The “From” address in a message is just text, and anyone can write your domain there. Three DNS records fix this: SPF, DKIM and DMARC. Since 2024, Google and Yahoo require them from bulk senders, and more and more receiving servers reject mail without them.
SPF: who is allowed to send
SPF (Sender Policy Framework) is a TXT record that lists the servers allowed to send email for your domain. A typical record for a company using Microsoft 365 and a newsletter tool looks like this:
v=spf1 include:spf.protection.outlook.com include:servers.mcsv.net -allThree things to watch:
- Only one SPF record per domain. Two records make both invalid.
- The 10-lookup limit. Every “include” costs DNS lookups. With too many services, SPF breaks silently.
- “-all” or “~all”. The ending says what to do with mail from other servers. Start with “~all” (soft fail) if you are not sure you listed every sender.
DKIM: a signature that proves the message was not changed
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message. The public key is published in DNS, so receivers can check that the message really came from your systems and was not altered on the way. In Microsoft 365 you enable it in the Defender portal and add two CNAME records. Google Workspace generates a TXT record for you. Every service that sends in your name, such as a CRM or invoicing tool, should sign with your domain too.
DMARC: the policy that ties it together
SPF and DKIM on their own do not stop spoofing, because they check technical addresses that the recipient never sees. DMARC links them to the visible “From” domain and tells receivers what to do when checks fail. It also sends you reports, so you finally see who is sending email as you.
v=DMARC1; p=none; rua=mailto:dmarc@yourcompany.comThe policy (p=) has three levels:
- none: only monitor and send reports.
- quarantine: failing mail goes to spam.
- reject: failing mail is refused.
How to roll out DMARC without breaking your own email
- Inventory your senders. Office mail, website contact forms, CRM, accounting software, newsletter tool, support desk. Each one must pass SPF or DKIM with your domain.
- Publish p=none with reports and collect data for two to four weeks. The reports are XML; a free report viewer makes them readable.
- Fix the gaps. Usually one or two forgotten tools, often the invoicing system.
- Move to p=quarantine, optionally with pct=25 first, then 100.
- Finish with p=reject. Now nobody can send mail that pretends to come from your domain.
Common mistakes
- Publishing p=reject on day one and losing invoices sent from a forgotten system.
- Forgetting subdomains and parked domains. A domain that never sends mail should still have “v=spf1 -all” and a DMARC reject policy, otherwise attackers use it.
- Setting up DMARC reports to a mailbox nobody reads.
Check your domain
Email security is the first item in our free IT audit. We check SPF, DKIM and DMARC from the outside, tell you whether someone can send email in your name and give you the exact records to publish.