SPF, DKIM and DMARC are three DNS records that let receiving servers check whether an email really came from your domain. SPF lists authorised sending servers, DKIM signs each message cryptographically, and DMARC ties both results to the visible From address and says what to do with mail that fails. Together they make spoofing harder and reduce spam-folder placement.
Key takeaways
- SPF defines which servers may send email for you, DKIM proves a message was not altered, and DMARC decides what happens to mail that fails.
- Google since 1 February 2024 and Microsoft since 5 May 2025 require SPF, DKIM and DMARC from domains sending over 5,000 emails a day.
- EasyDMARC's 2026 report found 52.1% of domains have a DMARC record, but only about 23% enforce quarantine or reject.
- The safe path is to start DMARC at
p=none, fix legitimate senders using the reports, then move step by step top=reject. - DMARC protects only your own domain; spoofed mail from look-alike domains needs separate checks on inbound email.
Why are SPF, DKIM and DMARC now mandatory?
Email was designed in the 1980s for a world of trust, with no requirement for senders to prove who they were. As a result, anyone can put any address in an email's From line. SPF, DKIM and DMARC are authentication layers added later to close that gap. How staff can spot a spoofed sender is covered in how to spot phishing emails.
For years these records were treated as nice-to-have; as of 2026 they are a precondition for deliverability. Under Google's email sender guidelines, since 1 February 2024 senders of more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC and keep spam rates below 0.30%. Microsoft followed from 5 May 2025, requiring SPF, DKIM and a DMARC policy of at least p=none from domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses.
A small or mid-sized company sending a few hundred emails a day may sit well below those thresholds. But large mailbox providers treat unauthenticated mail with more suspicion, which means your quote can end up in a customer's spam folder. If your emails are already going to spam, we have a separate guide to diagnosing emails that go to spam step by step.
What happens if you do not set up SPF, DKIM and DMARC?
An unauthenticated domain is a ready-made identity for fraudsters. An attacker can email your customers in your name announcing "our new bank details", and it is your reputation that takes the damage. We cover the freight-payment version of this scenario in logistics email fraud; for firms that bid for contracts, fake bids or correspondence sent in your name rely on the same gap (tender email security).
Phishing/spoofing was the most-reported crime type to the FBI Internet Crime Complaint Center (IC3) in 2025, with 191,561 complaints. (FBI IC3 2025 Internet Crime Report)
Having the DNS records is not enough on its own either. EasyDMARC's 2026 DMARC Adoption Report, which scanned 1.8 million domains, found that 52.1% have a DMARC record but only about 23% enforce a quarantine or reject policy. The same report found that only around 9% of domains combine an enforcement policy with reporting. In other words, many organisations have set up DMARC and left it in monitoring mode, so mail spoofing their domains is still delivered.
What is the difference between SPF, DKIM and DMARC? A side-by-side comparison
| SPF | DKIM | DMARC | |
|---|---|---|---|
| What it checks | Is the sending server authorised for this domain? | Was the message altered in transit, and which domain signed it? | Did SPF or DKIM pass, and does the result align with the visible From address? |
| Where it lives | A TXT record on the domain | A TXT record at selector._domainkey.yourdomain (public key) | A TXT record at _dmarc.yourdomain |
| Weakness | Can break on forwarded mail; does not check the visible address | Does not say what to do on failure | Does not stop spoofing from look-alike domains |
| Example | v=spf1 include:... -all | The server signs every message with a private key | v=DMARC1; p=reject; rua=mailto:... |
What is SPF (Sender Policy Framework)?
An SPF record lists the servers and services allowed to send email for your domain: your mail server, newsletter tool, CRM and the accounting software that sends invoices. The receiving server checks whether the server delivering the message is on that list. Two points matter with SPF: it checks the envelope sender (Return-Path), not the visible From address, and evaluating a record may involve at most 10 DNS lookups (RFC 7208). Each service you add with include: brings you closer to that limit.
What is DKIM (DomainKeys Identified Mail)?
With DKIM, the sending server signs every message with a private key and the receiving server verifies the signature with the public key published in DNS. A valid DKIM signature shows the message was not altered on the way and identifies the signing domain. DKIM survives forwarding better than SPF, which is why every service that sends mail for you should sign with your own domain.
What is DMARC (Domain-based Message Authentication, Reporting and Conformance)?
DMARC does two things. First, it checks alignment: SPF or DKIM passing is not enough — the authenticated domain must match the domain in the visible From address. Second, it sets a policy: p=none (monitor only), p=quarantine (send to spam) or p=reject (refuse). In addition, aggregate DMARC reports sent to your rua address show you who is sending email in your domain's name.
How do you set up SPF, DKIM and DMARC? An 8-step roadmap
- Inventory your senders. List everything that sends email with your domain: mail server, website forms, newsletter tool, ERP, invoicing system, helpdesk software. In Türkiye this usually includes the e-invoicing (e-Fatura) integrator that emails invoice notifications to customers, the sender most often forgotten; we explain that flow in e-invoice integration in Türkiye.
- Consolidate SPF into one record. More than one SPF record is invalid. Merge every authorised sender into a single record, check the 10-lookup limit and, once the inventory is complete, end with
-all. - Enable DKIM for every sender. Use a separate selector per service and decide on key length and a key rotation schedule.
- Start DMARC at
p=none. Send reports (rua) to a mailbox or a report analysis tool. Forgotten senders surface in the first few weeks. - Read the reports and fix. Add legitimate sources that fail authentication to SPF and DKIM. To interpret the XML reports line by line, see how to read DMARC reports.
- Tighten the policy step by step. Once all legitimate traffic authenticates, move to
p=quarantineand then top=reject. Remember thesp=tag for subdomains. - Lock down unused domains. On domains that never send email,
v=spf1 -allandp=rejectstop them being used for spoofing. - Make monitoring permanent. When a new SaaS tool goes live, updating SPF and DKIM should be part of your change process. Make this check part of the regular review in your SME cyber security checklist.
What can DMARC not stop?
A DMARC policy of p=reject protects your own domain. But if an attacker registers a look-alike such as yourcornpany.com and configures its SPF, DKIM and DMARC correctly, that email passes every check. That is why inbound mail also needs look-alike domain and display-name impersonation checks. We cover how this plays out in payment fraud in our guide to bank detail change email fraud, and in more depth in our article on look-alike domain attacks.
If you are setting up email on your domain from scratch, we show the order in which to add the SPF, DKIM and DMARC records in how to set up email with your own domain. To force encrypted connections between servers with MTA-STS, see business email encryption.
How Digital Bridge runs an SPF, DKIM and DMARC rollout
Publishing SPF, DKIM and DMARC records looks like a few lines of work; the hard part is reaching p=reject without breaking a single legitimate email. Under its cyber security consultancy, Digital Bridge runs the process like this:
- Current-state audit: We review the SPF, DKIM, DMARC and PTR records for your domains and report gaps and technical risks such as the 10-lookup limit.
- Sender inventory: With your teams we identify every system that sends email — ERP, CRM, e-invoicing, newsletters. Where integrated systems need changes, our system integrations team steps in.
- Phased enforcement: We read the DMARC reports and follow a timeline that moves your policy from
nonetoreject. - Infrastructure decisions: If you are planning to move your mail platform, our cloud migration and infrastructure consultancy plans the DNS cut-over without interruption.
We do not sell packaged solutions; after a needs analysis we set out scope, phases and cost in a written proposal.
How are SPF, DKIM and DMARC handled in SmartMail?
SmartMail business email, the email service in Digital Bridge's Smart360 family, deals with both sides of SPF, DKIM and DMARC:
- Outbound, your own domain: The Smart360 team prepares and verifies the MX, SPF, DKIM, DMARC, MTA-STS and TLS-RPT records and activates the domain; you follow the status from the panel. DMARC reports arrive at SmartMail's collection address, are converted into a readable format and archived month by month.
- Inbound, your counterparties: SmartMail recalculates the SPF, DKIM, DMARC and PTR results of every incoming email itself, rather than trusting results written by another server along the way. Look-alike domains and international-character impersonation, display-name and brand impersonation, Reply-To and link mismatches, and signs of a payment detail change are also assessed. So an email that passes DMARC but comes from a look-alike domain is still flagged.
- Quarantine with a rationale: Each email shows its findings with a readable explanation. The company administrator sets the quarantine threshold, and emails a new threshold would affect are listed before it is saved.
- Checks independent of AI: SPF, DKIM, DMARC and look-alike domain checks are code-based, so protection continues even when the monthly AI allowance runs out.
To buy SmartMail, use the SmartMail.com.tr purchase page.
Next step: check your domain's DMARC record
Look up your domain's _dmarc record today. If there is no DMARC record, or it has been sitting at p=none for months, start from the first step of this guide's 8-step roadmap: the sender inventory. If you are reviewing your email provider as a whole, our guide on how to choose a business email service lays out the decision criteria. To review your domain together and set out a timeline to p=reject, get in touch. The other email security topics are gathered in our Business Email & Documents guide.