DMARC, SPF and DKIM are three DNS records that prove an email really came from your domain. SPF lists the servers allowed to send your mail, DKIM adds a digital signature, and DMARC tells receiving servers what to do with mail that fails those checks. Together they stop criminals sending email as your company, and since 2024 Google and Yahoo require them for bulk senders.
Key takeaways
- SPF says which servers may send email for your domain.
- DKIM signs each email so the receiver can check it was not altered.
- DMARC sets the policy (none, quarantine or reject) and sends you reports.
- Roll DMARC out in stages, starting with p=none, so legitimate mail is not blocked.
What are DMARC, SPF and DKIM?
DMARC, SPF and DKIM are email authentication standards published as DNS records for your domain. Receiving mail servers check them to decide whether a message claiming to be from you is genuine, spam or a spoof.
| Record | What it does | Example |
|---|---|---|
| SPF | Lists servers allowed to send your email | v=spf1 include:_spf.google.com ~all |
| DKIM | Publishes a public key used to verify signed emails | Generated by your email provider |
| DMARC | Sets the policy for failed mail and requests reports | v=DMARC1; p=none; rua=mailto:[email protected] |
Why do DMARC, SPF and DKIM matter for your business?
Without email authentication, anyone can send email that appears to come from your domain, which is the starting point for invoice fraud and phishing against your customers. Authentication also improves deliverability, so your real emails land in the inbox instead of spam.
Since February 2024, Google’s email sender guidelines require SPF or DKIM for everyone sending to Gmail, and SPF, DKIM and DMARC for bulk senders. Spoofing protection also blocks a key step in phishing attacks.
How do you set up SPF, DKIM and DMARC?
Set up SPF first, then DKIM, then DMARC in monitoring mode. Each step is a DNS change in your domain registrar or DNS host, and your email provider gives you the exact values.
- List every service that sends email for you: your mailbox provider, newsletter tool, CRM, invoicing and help desk.
- Create one SPF record that includes all of them. A domain must have only one SPF record.
- Turn on DKIM in each sending service and publish the keys it gives you.
- Publish DMARC with p=none and a reporting address.
- Read the reports for two to four weeks and fix any legitimate sender that fails.
- Move to p=quarantine, then p=reject once reports are clean.
Google Workspace users can follow the email steps in the Google Workspace security checklist.
What is the difference between DMARC p=none, quarantine and reject?
The DMARC policy tells receivers what to do with mail that fails authentication. p=none only monitors, p=quarantine sends failing mail to spam, and p=reject blocks it completely, which gives the strongest protection against spoofing.
Cyber Snowden recommends reaching p=reject within three months for most small businesses. Staying on p=none indefinitely gives you reports but no protection.
What are common SPF, DKIM and DMARC mistakes?
The most common mistakes are publishing two SPF records, exceeding SPF’s ten DNS lookup limit, forgetting third-party senders, and leaving DMARC at p=none forever. Each one either breaks legitimate mail or leaves spoofing possible.
- Two SPF records: merge them into one.
- Too many includes: remove unused services or use a flattening service.
- Forgotten senders: newsletters and CRMs need their own DKIM keys.
- No monitoring: read DMARC reports monthly.
These records are part of a wider business cybersecurity policy.
Frequently asked questions
Do I need all three: SPF, DKIM and DMARC?
Yes. SPF and DKIM provide the checks, and DMARC turns them into an enforceable policy with reporting. Without DMARC, receivers decide on their own what to do with failing mail.
Will DMARC stop all phishing?
No. DMARC stops exact-domain spoofing of your own domain. It does not stop look-alike domains or compromised mailboxes, so you still need staff training and payment verification.
How long does DMARC take to set up?
Publishing the records takes minutes. Reaching p=reject safely usually takes four to twelve weeks of monitoring reports and fixing third-party senders.
Is DMARC free?
Yes. The records are free to publish. Some companies pay for DMARC reporting tools that make the XML reports easier to read, but small domains can manage with free tools.
Next steps
DMARC, SPF and DKIM are free, take minutes to publish, and protect your customers and staff from email spoofed in your name. Publish SPF and DKIM today and DMARC at p=none, then work towards p=reject. For a wider security check, try the free Cybersecurity Readiness Assessment.
