SPF, DKIM and DMARC Explained (Without the Jargon)

Here’s a belief we hear a lot: “Email authentication is a spam thing — it’s about keeping junk out of my inbox.” It sounds reasonable, so it’s worth correcting, because it points people in the wrong direction. SPF, DKIM and DMARC aren’t mainly about the mail arriving at you. They’re about the mail leaving as you — proving that a message claiming to come from your domain genuinely did, and stopping criminals from sending convincing fakes in your name.

That distinction matters. Without these records, anyone can send an email that appears to be from your finance manager, your director, or your accounts address — and increasingly, mailbox providers like Google and Microsoft will quietly bin or “junk” your legitimate email too, because they can no longer tell your real messages from the impersonations. So this is both a security control and a deliverability one. Get it right and you protect your brand and make sure your invoices actually land.

What the three records actually do

They’re best understood as three layers that build on each other.

SPF (Sender Policy Framework) is a public list of who’s allowed to send email for your domain. You publish a DNS record naming the servers and services permitted to send as you — your email platform, your CRM, your invoicing tool. A receiving server checks the list. If the message came from somewhere not on it, that’s a red flag.

DKIM (DomainKeys Identified Mail) adds a tamper-proof signature. Your email platform signs each outgoing message with a private cryptographic key, and the matching public key sits in your DNS. The receiver checks the signature to confirm the message really came from your domain and wasn’t altered in transit.

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the first two together and adds the crucial part: a policy. It tells receivers what to do when a message fails both checks — do nothing, send it to junk, or reject it outright. It also sends you reports showing who’s sending email in your name, which is how you spot both misconfigured services and outright abuse.

On their own, SPF and DKIM just gather evidence. DMARC is what turns that evidence into a decision and gives you visibility. All three together are what modern providers increasingly expect before they’ll trust your mail.

The practical steps, in the right order

The mistake that causes pain is jumping to a strict DMARC policy before you’ve done the groundwork. Then your own newsletters or invoices vanish, and everyone panics. Do it in this order instead.

1. List everything that sends email as you. Not just your main mailbox. Your accounting software, booking system, marketing platform, e-signature tool, website contact form — anything that sends “from” your domain. Miss one and it’ll fail authentication later.
2. Publish a correct SPF record. One record, covering every legitimate sender from step one. A common trap is having two SPF records, or exceeding the lookup limit — both break it silently.
3. Turn on DKIM in your email platform. In Microsoft 365 and Google Workspace this is a setting you enable and a DNS record you publish — it isn’t always on by default, despite what people assume.
4. Add DMARC in monitor mode first. Start with a policy of p=none. This changes nothing about delivery — it just starts the reports flowing so you can see who’s sending as you.
5. Read the reports, then tighten. Once the data shows only your legitimate services passing, move the policy to quarantine (fails go to junk), then eventually reject (fails are blocked). Now impersonation attempts get stopped at the door.

Rushing straight to step five is what breaks legitimate email. Working through them in sequence is what makes the whole thing safe.

Why this is worth your attention now

Business email compromise — where someone impersonates a colleague or supplier to redirect a payment — is one of the most common and costly attacks aimed at small businesses. Strong email authentication doesn’t fix everything, but it removes one of the easiest tricks in the book: sending a message that looks like it genuinely came from your own domain. It’s a foundational piece of any sensible cyber security setup, and it sits naturally alongside getting your business email set up properly in the first place.

There’s a deliverability payoff too. Google and Microsoft have both tightened their rules for bulk senders, and properly authenticated domains get the benefit of the doubt while unauthenticated ones increasingly don’t. If your important email has been landing in customers’ junk folders, missing authentication is one of the first things worth checking.

A soft word to finish

None of this is glamorous, and it’s the kind of task that sits on a to-do list for months because nothing’s obviously broken — until an invoice goes missing or a fake email fools someone. It’s usually a small, one-off job to set up correctly, and then it quietly does its work in the background.

If you’d rather not wrestle with DNS records and DMARC reports yourself, we’re happy to review your setup, tell you honestly what’s already in place, and put the missing pieces right. Get in touch and we’ll take a look at your domain.