# SPF, DKIM and DMARC Explained: How They Work and How to Set Them Up to Stop Spoofed Email

> SPF, DKIM and DMARC explained: how the three records work together, what Gmail and Outlook now require and an 8-step path to a safe p=reject policy.

Source: https://digitalbridge.com.tr/en/blog/spf-dkim-dmarc-explained.html
Publisher: Digital Bridge Teknoloji (https://digitalbridge.com.tr)
Topic: Business Email & Documents
Published: 2026-09-25 · Updated: 2026-10-22

SPF, DKIM and DMARC are three DNS records that let receiving servers check whether an email really came from your domain. [SPF](https://digitalbridge.com.tr/en/glossary.html#spf) lists authorised sending servers, DKIM signs each message cryptographically, and [DMARC](https://digitalbridge.com.tr/en/glossary.html#dmarc) ties both results to the visible From address and says what to do with mail that fails. Together they make spoofing harder and reduce spam-folder placement.

## Key takeaways

- SPF defines which servers may send email for you, DKIM proves a message was not altered, and DMARC decides what happens to mail that fails.
- Google since 1 February 2024 and Microsoft since 5 May 2025 require SPF, DKIM and DMARC from domains sending over 5,000 emails a day.
- EasyDMARC's 2026 report found 52.1% of domains have a DMARC record, but only about 23% enforce quarantine or reject.
- The safe path is to start DMARC at `p=none`, fix legitimate senders using the reports, then move step by step to `p=reject`.
- DMARC protects only your own domain; spoofed mail from look-alike domains needs separate checks on inbound email.

## Why are SPF, DKIM and DMARC now mandatory?

Email was designed in the 1980s for a world of trust, with no requirement for senders to prove who they were. As a result, anyone can put any address in an email's From line. SPF, DKIM and DMARC are authentication layers added later to close that gap. How staff can spot a spoofed sender is covered in [how to spot phishing emails](https://digitalbridge.com.tr/en/blog/how-to-spot-phishing-emails.html).

For years these records were treated as nice-to-have; as of 2026 they are a precondition for deliverability. Under [Google's email sender guidelines](https://support.google.com/a/answer/81126?hl=en), since 1 February 2024 senders of more than 5,000 messages a day to Gmail accounts must set up SPF, DKIM and DMARC and keep spam rates below 0.30%. [Microsoft followed from 5 May 2025](https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%e2%80%99s-new-requirements-for-high%e2%80%90volume-senders/4399730), requiring SPF, DKIM and a DMARC policy of at least `p=none` from domains sending more than 5,000 emails a day to Outlook.com, Hotmail and Live addresses.

A small or mid-sized company sending a few hundred emails a day may sit well below those thresholds. But large mailbox providers treat unauthenticated mail with more suspicion, which means your quote can end up in a customer's spam folder. If your emails are already going to spam, we have a separate guide to [diagnosing emails that go to spam](https://digitalbridge.com.tr/en/blog/emails-going-to-spam-fix.html) step by step.

## What happens if you do not set up SPF, DKIM and DMARC?

An unauthenticated domain is a ready-made identity for fraudsters. An attacker can email your customers in your name announcing "our new bank details", and it is your reputation that takes the damage. We cover the freight-payment version of this scenario in [logistics email fraud](https://digitalbridge.com.tr/en/blog/logistics-email-fraud.html); for firms that bid for contracts, fake bids or correspondence sent in your name rely on the same gap ([tender email security](https://digitalbridge.com.tr/en/blog/tender-email-security.html)).

> Phishing/spoofing was the most-reported crime type to the FBI Internet Crime Complaint Center (IC3) in 2025, with 191,561 complaints. ([FBI IC3 2025 Internet Crime Report](https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf))

Having the DNS records is not enough on its own either. [EasyDMARC's 2026 DMARC Adoption Report](https://easydmarc.com/blog/easydmarc-releases-2026-dmarc-adoption-report/), which scanned 1.8 million domains, found that 52.1% have a DMARC record but only about 23% enforce a quarantine or reject policy. The same report found that only around 9% of domains combine an enforcement policy with reporting. In other words, many organisations have set up DMARC and left it in monitoring mode, so mail spoofing their domains is still delivered.

## What is the difference between SPF, DKIM and DMARC? A side-by-side comparison

| | SPF | DKIM | DMARC |
|---|---|---|---|
| What it checks | Is the sending server authorised for this domain? | Was the message altered in transit, and which domain signed it? | Did SPF or DKIM pass, and does the result align with the visible From address? |
| Where it lives | A TXT record on the domain | A TXT record at `selector._domainkey.yourdomain` (public key) | A TXT record at `_dmarc.yourdomain` |
| Weakness | Can break on forwarded mail; does not check the visible address | Does not say what to do on failure | Does not stop spoofing from look-alike domains |
| Example | `v=spf1 include:... -all` | The server signs every message with a private key | `v=DMARC1; p=reject; rua=mailto:...` |

### What is SPF (Sender Policy Framework)?

An SPF record lists the servers and services allowed to send email for your domain: your mail server, newsletter tool, CRM and the accounting software that sends invoices. The receiving server checks whether the server delivering the message is on that list. Two points matter with SPF: it checks the envelope sender (Return-Path), not the visible From address, and evaluating a record may involve at most 10 DNS lookups ([RFC 7208](https://www.rfc-editor.org/rfc/rfc7208)). Each service you add with `include:` brings you closer to that limit.

### What is DKIM (DomainKeys Identified Mail)?

With DKIM, the sending server signs every message with a private key and the receiving server verifies the signature with the public key published in DNS. A valid DKIM signature shows the message was not altered on the way and identifies the signing domain. DKIM survives forwarding better than SPF, which is why every service that sends mail for you should sign with your own domain.

### What is DMARC (Domain-based Message Authentication, Reporting and Conformance)?

DMARC does two things. First, it checks **alignment**: SPF or DKIM passing is not enough — the authenticated domain must match the domain in the visible From address. Second, it sets a **policy**: `p=none` (monitor only), `p=quarantine` (send to spam) or `p=reject` (refuse). In addition, aggregate DMARC reports sent to your `rua` address show you who is sending email in your domain's name.

## How do you set up SPF, DKIM and DMARC? An 8-step roadmap

1. **Inventory your senders.** List everything that sends email with your domain: mail server, website forms, newsletter tool, ERP, invoicing system, helpdesk software. In Türkiye this usually includes the e-invoicing (e-Fatura) integrator that emails invoice notifications to customers, the sender most often forgotten; we explain that flow in [e-invoice integration in Türkiye](https://digitalbridge.com.tr/en/blog/e-invoice-integration-turkey.html).
2. **Consolidate SPF into one record.** More than one SPF record is invalid. Merge every authorised sender into a single record, check the 10-lookup limit and, once the inventory is complete, end with `-all`.
3. **Enable DKIM for every sender.** Use a separate selector per service and decide on key length and a key rotation schedule.
4. **Start DMARC at `p=none`.** Send reports (`rua`) to a mailbox or a report analysis tool. Forgotten senders surface in the first few weeks.
5. **Read the reports and fix.** Add legitimate sources that fail authentication to SPF and DKIM. To interpret the XML reports line by line, see [how to read DMARC reports](https://digitalbridge.com.tr/en/blog/how-to-read-dmarc-reports.html).
6. **Tighten the policy step by step.** Once all legitimate traffic authenticates, move to `p=quarantine` and then to `p=reject`. Remember the `sp=` tag for subdomains.
7. **Lock down unused domains.** On domains that never send email, `v=spf1 -all` and `p=reject` stop them being used for spoofing.
8. **Make monitoring permanent.** When a new SaaS tool goes live, updating SPF and DKIM should be part of your change process. Make this check part of the regular review in your [SME cyber security checklist](https://digitalbridge.com.tr/en/blog/sme-cyber-security-checklist.html).

### What can DMARC not stop?

A DMARC policy of `p=reject` protects your own domain. But if an attacker registers a look-alike such as `yourcornpany.com` and configures its SPF, DKIM and DMARC correctly, that email passes every check. That is why inbound mail also needs look-alike domain and display-name impersonation checks. We cover how this plays out in payment fraud in our [guide to bank detail change email fraud](https://digitalbridge.com.tr/en/blog/bank-detail-change-email-fraud.html), and in more depth in our article on [look-alike domain attacks](https://digitalbridge.com.tr/en/blog/lookalike-domain-attacks.html).

If you are setting up email on your domain from scratch, we show the order in which to add the SPF, DKIM and DMARC records in [how to set up email with your own domain](https://digitalbridge.com.tr/en/blog/set-up-email-with-your-domain.html). To force encrypted connections between servers with MTA-STS, see [business email encryption](https://digitalbridge.com.tr/en/blog/business-email-encryption.html).

## How Digital Bridge runs an SPF, DKIM and DMARC rollout

Publishing SPF, DKIM and DMARC records looks like a few lines of work; the hard part is reaching `p=reject` without breaking a single legitimate email. Under its [cyber security consultancy](https://digitalbridge.com.tr/en/consultancy/cyber-security.html), Digital Bridge runs the process like this:

- **Current-state audit:** We review the SPF, DKIM, DMARC and PTR records for your domains and report gaps and technical risks such as the 10-lookup limit.
- **Sender inventory:** With your teams we identify every system that sends email — ERP, CRM, e-invoicing, newsletters. Where integrated systems need changes, our [system integrations](https://digitalbridge.com.tr/en/technology-hardware/system-integrations.html) team steps in.
- **Phased enforcement:** We read the DMARC reports and follow a timeline that moves your policy from `none` to `reject`.
- **Infrastructure decisions:** If you are planning to move your mail platform, our [cloud migration and infrastructure consultancy](https://digitalbridge.com.tr/en/consultancy/cloud-migration-infrastructure-consultancy.html) plans the DNS cut-over without interruption.

We do not sell packaged solutions; after a needs analysis we set out scope, phases and cost in a written proposal.

## How are SPF, DKIM and DMARC handled in SmartMail?

[SmartMail business email](https://digitalbridge.com.tr/en/smart360/smartmail.html), the email service in Digital Bridge's [Smart360](https://digitalbridge.com.tr/en/smart360.html) family, deals with both sides of SPF, DKIM and DMARC:

- **Outbound, your own domain:** The Smart360 team prepares and verifies the MX, SPF, DKIM, DMARC, MTA-STS and TLS-RPT records and activates the domain; you follow the status from the panel. DMARC reports arrive at SmartMail's collection address, are converted into a readable format and archived month by month.
- **Inbound, your counterparties:** SmartMail recalculates the SPF, DKIM, DMARC and PTR results of every incoming email itself, rather than trusting results written by another server along the way. Look-alike domains and international-character impersonation, display-name and brand impersonation, Reply-To and link mismatches, and signs of a payment detail change are also assessed. So an email that passes DMARC but comes from a look-alike domain is still flagged.
- **Quarantine with a rationale:** Each email shows its findings with a readable explanation. The company administrator sets the quarantine threshold, and emails a new threshold would affect are listed before it is saved.
- **Checks independent of AI:** SPF, DKIM, DMARC and look-alike domain checks are code-based, so protection continues even when the monthly AI allowance runs out.

To buy SmartMail, use the [SmartMail.com.tr purchase page](https://smart360.com.tr/satin-al?urun=smartmail).

## Next step: check your domain's DMARC record

Look up your domain's `_dmarc` record today. If there is no DMARC record, or it has been sitting at `p=none` for months, start from the first step of this guide's 8-step roadmap: the sender inventory. If you are reviewing your email provider as a whole, our guide on [how to choose a business email service](https://digitalbridge.com.tr/en/blog/business-email-how-to-choose.html) lays out the decision criteria. To review your domain together and set out a timeline to `p=reject`, [get in touch](https://digitalbridge.com.tr/en/contact.html). The other email security topics are gathered in our [Business Email & Documents guide](https://digitalbridge.com.tr/en/blog/topic/kurumsal-eposta.html).

## Frequently Asked Questions

### Which one is enough: SPF, DKIM or DMARC?

None of them on its own. SPF verifies whether the sending server is authorised and DKIM verifies the integrity of the message; DMARC links those results to the visible From address and decides what happens to mail that fails. Your domain is properly protected against spoofing, and your mail meets large providers' requirements, only when all three are in place.

### What is the difference between SPF and DKIM?

SPF checks whether the server delivering a message is authorised to send for your domain, while DKIM uses a cryptographic signature to prove the message was not altered and to identify the signing domain. SPF can break when mail is forwarded, whereas a DKIM signature survives forwarding better. That is why both are used together, with DMARC linking their results to the visible From address.

### Will I lose email if I switch DMARC to p=reject?

If you jump straight to p=reject, a legitimate sender with missing SPF or DKIM — an invoicing or newsletter system, for example — can be rejected. That is why you start at p=none, collect reports, fix every legitimate source and only then move to quarantine and reject step by step. Following that order gives you full protection without losing legitimate mail.

### What is the SPF 10-lookup limit?

The SPF standard (RFC 7208) allows at most 10 DNS lookups while a record is evaluated. Records with many include: entries can exceed that limit, which makes SPF return an error so legitimate mail may fail authentication. The fix is to simplify the record or remove services you no longer use from it.

### Does DMARC stop look-alike domain attacks?

No. DMARC only stops your own domain being spoofed. If an attacker registers a separate domain that resembles yours and configures its SPF, DKIM and DMARC records correctly, their mail passes authentication. To counter that attack, inbound mail also needs separate look-alike domain and display-name impersonation checks.

### How do I check whether my domain has SPF, DKIM and DMARC?

Query your domain's TXT records with a DNS lookup tool, for example dig TXT yourdomain.com and dig TXT _dmarc.yourdomain.com: a record starting v=spf1 is your SPF, and one starting v=DMARC1 is your DMARC. For DKIM, open an email you have sent and check the Authentication-Results header, where you should see spf=pass, dkim=pass and dmarc=pass.

### What are DMARC reports for?

DMARC aggregate reports (rua) show which servers are sending email in your domain's name and whether that mail passes authentication. They help you find forgotten legitimate senders and spot sources trying to impersonate your domain. Reading these reports regularly is what lets you move your policy safely from p=none to p=reject.