SMB Cybersecurity BriefingDaily cybersecurity intelligence for small and mid-sized businesses

SPF, DKIM and DMARC: Making Your Domain Hard to Spoof

Published · Last reviewed

SPF lists the servers allowed to send mail for your domain, DKIM signs each message so it can be checked, and DMARC tells receivers what to do when both fail. Publish them in that order, start DMARC at p=none to collect reports, then move to quarantine and finally reject once every legitimate sender passes.

What each record does

The records below use the fictional domain example.com and are shown only for the shape. Your provider’s documentation gives the exact values for your mail system.

example.com.          TXT  "v=spf1 include:spf.mailhost.example -all"
sel1._domainkey       TXT  "v=DKIM1; k=rsa; p=(public key from your provider)"
_dmarc.example.com.   TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

The staged plan

Action
List every service that sends mail as your domain: your mail platform, the accounting package that emails invoices, the marketing tool, the help desk, the website contact form, scanners and printers. Ask each department; this list is the whole job.
Why it helps
Most DMARC problems are forgotten senders. Starting from a complete list avoids blocking your own invoices when the policy tightens.
Verification
Compare the list with the sources that appear in DMARC reports after two weeks. Any source in the reports that is not on your list needs an owner.
Fallback if delayed
If you cannot complete the list, stay at p=none and collect reports longer; do not tighten the policy on a guess.
Action
Publish one SPF record at the domain, with one include: for each legitimate sender, ending in -all (or ~all while testing). Use the DNS host’s control panel. Profile A Microsoft 365 publishes its own include value in the domain setup page of the admin center; Profile B/C delta: Google Workspace gives its own include value in the Admin console under Gmail authentication.
Why it helps
A single SPF record is required. Two separate SPF records make the check fail. SPF also has a limit of ten DNS lookups, so a long chain of includes can break it silently.
Verification
Look up the TXT record with nslookup -type=TXT example.com (Windows or macOS) and confirm there is exactly one line starting v=spf1. Send a test message to a personal mailbox and read the full headers for spf=pass.
Fallback if delayed
If you cannot edit DNS today, ask your registrar or MSP to do it and give them the exact record text.
Action
Turn on DKIM signing for each sender, in that sender’s admin console, and publish the key records it gives you in DNS. Ask for 2048-bit keys where the product supports them.
Why it helps
DKIM survives forwarding, which SPF does not, so it is the more dependable of the two for DMARC.
Verification
Read the headers of a test message for dkim=pass with header.d=example.com.
Fallback if delayed
If one sender cannot sign with your domain, route it through a subdomain with its own DMARC policy.
Action
Publish DMARC at p=none with a reporting address (rua=) that a person or a free report reader monitors. Wait at least two to four weeks.
Why it helps
p=none changes no mail delivery. It only sends you aggregate reports showing who is sending as your domain and whether they pass.
Verification
Reports begin arriving as XML attachments from large receivers within a few days. If none arrive after a week, check the record spelling at _dmarc.example.com.
Fallback if delayed
If nobody can read XML, use a free DMARC report viewer. Choose one from a source you trust and do not share more than the aggregate reports.
Action
Move to p=quarantine, then p=reject, one step at a time, each after the reports show every legitimate source passing. RFC 7489 allows a pct= tag to apply the policy to a share of mail while you gain confidence.
Why it helps
p=reject tells receivers to refuse mail that fails, which is what stops others spoofing your exact domain. Moving in steps lets you catch a missed sender while the harm is small.
Verification
Re-read the reports a week after each change. Failures from sources you recognise must be fixed before the next step.
Fallback if delayed
If a critical sender cannot pass, leave the organisational domain at quarantine and move that sender to a subdomain.

Common failure mode

Tightening to reject before the sender list is complete, so invoices, password-reset messages or the sales newsletter vanish. The second most common mistake is publishing DMARC at p=none and leaving it there for years: it looks like protection, but it asks receivers to do nothing about spoofed mail.

Also note what these records cannot do. They protect your exact domain. They do not stop a look-alike domain, and they do not stop mail sent from a real compromised account. See business email compromise for the controls that cover those cases. To produce a correct DMARC string, use the DMARC record builder.

How it works

When a message arrives, the receiver extracts two domains: the visible From domain, which the reader sees, and the domains that passed SPF (the envelope sender) and DKIM (the signing domain). DMARC requires one of those passing domains to match the From domain. That alignment is the point: SPF and DKIM alone can pass for an attacker’s own domain while the From line shows yours.

The policy then applies: none means deliver and report, quarantine means treat as suspicious (usually the spam folder), and reject means refuse. Receivers send aggregate reports to the address in rua=, summarising by sending source how many messages passed and failed. Those reports are the evidence you use to decide when to move to the next step. Receivers are not obliged to follow your policy, but the large mailbox providers generally do.

Worked example

Suppose, as a hypothetical, a 25-person firm publishes DMARC at p=none on example.com. After three weeks the reports show four sources: the main mail platform, the accounting software, the web form on the contact page and a sender nobody recognises. The firm finds that the accounting software was not signing with the firm’s domain; it enables signing. The web form is moved to send through the mail platform. The unknown source is investigated; it turns out to be a former marketing contractor’s tool, and access is removed.

A fortnight later the reports are clean, and the firm moves to p=quarantine, then to p=reject a month on. The sources and timings are invented for illustration only; your own reports will differ.

Frequently asked questions

Do I need SPF, DKIM and DMARC if I only use a free mailbox?

If you send business mail from your own domain you do. Mail sent from a free provider's own domain is covered by that provider, but your own domain needs its own records.

What does p=none do?

Nothing to the mail itself. It asks receivers to deliver as normal but to send you reports, so you can see who is sending as your domain before you enforce anything.

Why do legitimate emails fail DMARC?

Usually because a service sends on your behalf without being listed in SPF or without signing with your domain's DKIM key. Forwarding can also break SPF.

Will p=reject stop all phishing?

No. It stops exact-domain spoofing. Look-alike domains and messages from compromised real accounts are not covered, so keep the verification and reporting habits.

How often should I review the reports?

Weekly while you tighten the policy, then monthly, and whenever you add a new service that sends mail.