SPF, DKIM and DMARC are three DNS records that define who may send email for your domain and let receiving servers check that a message really came from you. SPF lists authorised sending servers, DKIM signs each message cryptographically, and DMARC ties both results to the visible From address and says what to do with mail that fails.
Together they make spoofing much harder and make your own mail less likely to land in spam.
Why these three records are now mandatory
Email was designed in the 1980s for a world of trust, with no requirement for senders to prove who they were. Anyone can put any address in the From line. SPF, DKIM and DMARC are layers added later to close that gap. How staff can spot a spoofed sender is covered in how to spot phishing emails.
For years they were treated as nice-to-have. Today they are a precondition for deliverability. Under Google's email sender guidelines, since 1 February 2024 senders of more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC and keep spam rates below 0.30%. Microsoft followed from 5 May 2025, requiring SPF, DKIM and a DMARC policy of at least p=none from domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses.
A small or mid-sized company sending a few hundred emails a day may sit well below those thresholds. But large providers treat unauthenticated mail with more suspicion, which means your quote can end up in a customer's spam folder. If that is already happening, we have a separate guide to diagnosing emails that go to spam step by step.
The cost of leaving them out
An unauthenticated domain is a ready-made identity for fraudsters. An attacker can email your customers in your name announcing "our new bank details", and it is your reputation that takes the damage. We cover the freight-payment version of this scenario in logistics email fraud; for firms that bid for contracts, fake bids or correspondence sent in your name rely on the same gap (tender email security).
Phishing/spoofing was the most-reported crime type to the FBI IC3 in 2025, with 191,561 complaints. (FBI IC3 2025 Internet Crime Report)
Having the records is not enough on its own either. EasyDMARC's 2026 DMARC Adoption Report, which scanned 1.8 million domains, found that 52.1% have a DMARC record but only about 23% enforce a quarantine or reject policy. The same report found that only around 9% of domains combine an enforcement policy with reporting. In other words, many organisations have set up DMARC and left it in monitoring mode, so spoofed mail is still delivered.
SPF, DKIM and DMARC explained side by side
| SPF | DKIM | DMARC | |
|---|---|---|---|
| What it checks | Is the sending server authorised for this domain? | Was the message altered in transit, and which domain signed it? | Did SPF or DKIM pass, and does the result align with the visible From address? |
| Where it lives | A TXT record on the domain | A TXT record at selector._domainkey.yourdomain (public key) | A TXT record at _dmarc.yourdomain |
| Weakness | Can break on forwarded mail; does not check the visible address | Does not say what to do on failure | Does not stop spoofing from look-alike domains |
| Example | v=spf1 include:... -all | The server signs every message with a private key | v=DMARC1; p=reject; rua=mailto:... |
SPF (Sender Policy Framework)
An SPF record lists the servers and services allowed to send email for your domain: your mail server, newsletter tool, CRM and the accounting software that sends invoices. The receiving server checks whether the server delivering the message is on that list. Two points matter: SPF checks the envelope sender (Return-Path), not the visible From address, and evaluating a record may involve at most 10 DNS lookups (RFC 7208). Each service you add with include: brings you closer to that limit.
DKIM (DomainKeys Identified Mail)
With DKIM, the sending server signs every message with a private key and the receiver verifies the signature with the public key published in DNS. A valid signature shows the message was not altered on the way and identifies the signing domain. DKIM survives forwarding better than SPF, which is why every service that sends mail for you should sign with your own domain.
DMARC (Domain-based Message Authentication, Reporting and Conformance)
DMARC does two things. First, it checks alignment: SPF or DKIM passing is not enough — the authenticated domain must match the domain in the visible From address. Second, it sets a policy: p=none (monitor only), p=quarantine (send to spam) or p=reject (refuse). On top of that, aggregate reports sent to your rua address show you who is sending email in your domain's name.
A step-by-step roadmap
- Inventory your senders. List everything that sends email with your domain: mail server, website forms, newsletter tool, ERP, invoicing system, helpdesk software. In Türkiye this usually includes the e-invoicing (e-Fatura) integrator that emails invoice notifications to customers, the sender most often forgotten; we explain that flow in e-invoice integration in Türkiye.
- Consolidate SPF into one record. More than one SPF record is invalid. Merge every authorised sender into a single record, check the 10-lookup limit and, once the inventory is complete, end with
-all. - Enable DKIM for every sender. Use a separate selector per service and decide on key length and a key rotation schedule.
- Start DMARC at
p=none. Send reports (rua) to a mailbox or a report analysis tool. Forgotten senders surface in the first few weeks. - Read the reports and fix. Add legitimate sources that fail authentication to SPF and DKIM. To interpret the XML reports line by line, see how to read DMARC reports.
- Tighten the policy step by step. Once all legitimate traffic authenticates, move to
p=quarantineand then top=reject. Remember thesp=tag for subdomains. - Lock down unused domains. On domains that never send email,
v=spf1 -allandp=rejectstop them being used for spoofing. - Make monitoring permanent. When a new SaaS tool goes live, updating SPF and DKIM should be part of your change process. Make this check part of the regular review in your SME cyber security checklist.
What DMARC cannot stop
p=reject protects your own domain. But if an attacker registers a look-alike such as yourcornpany.com and configures its SPF, DKIM and DMARC correctly, that email passes every check. That is why inbound mail also needs look-alike domain and display-name impersonation checks. We cover how this plays out in payment fraud in our guide to bank detail change email fraud, and in more depth in our article on look-alike domain attacks.
If you are setting up email on your domain from scratch, we show the order in which to add these records in how to set up email with your own domain. To force encrypted connections between servers with MTA-STS, see business email encryption.
How we approach it at Digital Bridge
Publishing the records looks like a few lines of work; the hard part is reaching p=reject without breaking a single legitimate email. Under our cyber security consultancy we run the process like this:
- Current-state audit: We review the SPF, DKIM, DMARC and PTR records for your domains and report gaps and technical risks such as the 10-lookup limit.
- Sender inventory: With your teams we identify every system that sends email — ERP, CRM, e-invoicing, newsletters. Where integrated systems need changes, our system integrations team steps in.
- Phased enforcement: We read the DMARC reports and follow a timeline that moves your policy from
nonetoreject. - Infrastructure decisions: If you are planning to move your mail platform, our cloud migration and infrastructure consultancy plans the DNS cut-over without interruption.
We do not sell packaged solutions; after a needs analysis we set out scope, phases and cost in a written proposal.
SPF, DKIM and DMARC in SmartMail
SmartMail, the business email product in our Smart360 family, deals with both sides of the problem:
- Outbound, your own domain: Domains and DNS settings are managed from the Smart360 admin panel, alongside users and departments.
- Inbound, your counterparties: SmartMail assesses every incoming email against 12 signals. Its own SPF/DKIM/DMARC and PTR checks come first, but the assessment does not stop there. Look-alike domains and international characters, display-name and brand impersonation, Reply-To and link mismatches, risky attachments, content assessment and comparison with known fraud techniques are all taken into account. So an email that passes DMARC but comes from a look-alike domain is still flagged.
- A written rationale: The result is not just a score but a report explaining why. Your organisation sets the quarantine threshold (the default trust threshold is 70), and before you change it the system shows how many messages would be affected.
- Independent of AI: Authentication and domain checks run in software and keep working even if the AI usage allowance runs out.
Next step
Look up your domain's _dmarc record today. If there is none, or it has been sitting at p=none for months, start from step 1 of the roadmap above. If you are reviewing your email provider as a whole, our guide on how to choose a business email service lays out the decision criteria. To review your domain together and set out a timeline to p=reject, get in touch. The other email security topics are gathered in our Business Email & Documents guide.