Anyone can put your company's name in the From line of an email. Whether that email reaches your clients' inboxes depends on three records in your domain's DNS: SPF, DKIM and DMARC. Together they tell the world which servers are allowed to send as you and what to do with mail that fails the test.
SPF: the guest list
SPF (Sender Policy Framework) is a single TXT record that lists the services allowed to send email for your domain, such as Microsoft 365, your newsletter tool and your invoicing system. A receiving server checks whether the message came from somewhere on the list.
Common problems: more than one SPF record (which breaks it), a list that exceeds ten DNS lookups, or an ending of "+all", which allows anyone.
DKIM: the signature
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message. The public half of the key sits in your DNS, so a receiving server can confirm the message really came from you and wasn't altered on the way. In Microsoft 365, DKIM has to be switched on for each custom domain.
DMARC: the instructions
DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when a message fails SPF and DKIM: nothing (p=none), send it to spam (p=quarantine) or reject it (p=reject). It also sends you reports of who is sending as your domain.
A DMARC record at p=none is a useful first step, but it protects nobody. The goal is quarantine or reject once you're sure all your legitimate senders pass.
What good looks like
- Exactly one SPF record, ending in -all or ~all
- DKIM enabled for every service that sends as you
- A DMARC record at p=quarantine or p=reject, with reporting turned on
Check yours now
Our free Email Security Check looks up your live SPF and DMARC records, checks common DKIM selectors and gives you a grade from A to F with the fix for each gap. No email address required.