Email was designed in an era of trust, and by default nothing stops a criminal from sending a message that appears to come from your company. Invoice fraud, fake payment requests, and phishing aimed at your own customers all rely on this. Three DNS records — SPF, DKIM, and DMARC — close that gap. Large mailbox providers including Google, Yahoo, and Microsoft now require them from organisations that send email at volume, and they help everyone else’s mail get delivered too.

SPF: who is allowed to send for you

SPF (Sender Policy Framework) is a list, published in your DNS, of the servers allowed to send email for your domain — for example Microsoft 365 plus the service that sends your invoices. Receiving servers check it and treat mail from anywhere else with suspicion.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to each message. The receiving server checks it against a public key in your DNS, proving the message really came from an authorised system and was not altered on the way.

DMARC: the policy that ties it together

DMARC tells receiving servers what to do when a message fails those checks — deliver it anyway (p=none), send it to spam (p=quarantine), or reject it outright (p=reject). It also sends you reports showing who is sending email in your name, which is how you find forgotten services before tightening the policy.

The safe way to roll it out

  1. List every system that sends email as your domain: your mailbox provider, website forms, CRM, invoicing, marketing tools.
  2. Publish SPF and enable DKIM for each of them.
  3. Start DMARC at p=none and read the reports for a few weeks.
  4. Fix anything legitimate that fails, then move to quarantine and finally reject.

Common mistakes

  • More than one SPF record on a domain — it invalidates both.
  • Forgetting third-party senders, so real invoices land in spam once DMARC is enforced.
  • Jumping straight to reject without reading the reports first.
  • Ignoring domains you own but never send from — protect them with a strict “send nothing” policy, or criminals will use them instead.

We manage SPF, DKIM, and DMARC across more than 100 domains, with most at the strictest reject setting. If you are not sure whether your domain is protected, ask us for a free email security check.

Related service: IT Solutions — Managed IT, backups, disaster recovery, and security.

Get a free IT assessment All resources