Anyone can send an email that claims to be from your domain. SPF, DKIM, and DMARC help receiving servers decide whether to trust it.

SPF (Sender Policy Framework)

A DNS record listing which servers are allowed to send email for your domain. If a message comes from a server not on the list, it fails the check.

For example: “Only Microsoft 365 and our newsletter service may send mail as our company.”

DKIM (DomainKeys Identified Mail)

Adds a digital signature to outgoing messages. The receiving server checks the signature against a public key in your DNS to confirm the message wasn’t altered and truly came from your domain.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

Tells receivers what to do when SPF or DKIM checks fail, and sends you reports. It has three policies:

– none: monitor only, take no action

– quarantine: treat failures as suspicious (often sent to junk)

– reject: block failing messages

Why it matters

– Prevents criminals from spoofing your domain to fool customers and staff

– Protects your reputation

– Improves deliverability. Major mailbox providers, including Google and Yahoo, now require authentication for bulk senders.

How to set up safely

1. List every service that sends email for you: Microsoft 365, CRM, marketing tools, invoicing systems

2. Publish SPF and enable DKIM for each

3. Start DMARC at “none” and read the reports

4. Fix legitimate senders that fail

5. Move gradually to quarantine, then reject

Common mistakes

– Multiple SPF records (you may only have one)

– Forgetting a sender, which causes real emails to be blocked

– Jumping straight to “reject”

– Never reading DMARC reports

DBR Soft can configure and monitor these records for your domain. Contact us for more information.