Email was designed in a time when everyone trusted everyone. By default, anyone can send an email that says it is from your company. SPF, DKIM and DMARC are how you tell the rest of the internet which emails are really yours.
Why it matters for every business
The most expensive emails are often not viruses but simple lies: a "new bank account" from a supplier, an urgent payment request from the "CEO", an invoice that looks exactly like yours. When your domain is not protected, these are easy to fake.
It also affects your own emails. Large mailbox providers such as Google, Yahoo and Microsoft now expect proper authentication, and bulk senders must have SPF, DKIM and DMARC in place. Without them, your real invoices and quotes are more likely to land in spam.
SPF: the guest list
SPF (Sender Policy Framework) is one TXT record that lists the services allowed to send email for your domain — for example Microsoft 365, your website, and your accounting software. A receiving server checks whether the email came from one of them.
Two things to know: you may have only one SPF record per domain, and it may cause at most 10 DNS lookups. Every include: counts, so adding many services can quietly break it. The record should end with ~all or -all; never +all, which allows anyone.
DKIM: the wax seal
DKIM (DomainKeys Identified Mail) adds a digital signature to each email. The public key is published in your DNS under a name called a selector (for example selector1._domainkey for Microsoft 365, or google._domainkey for Google Workspace). If anyone changes the email on the way, the signature no longer matches.
Each sending service has its own DKIM key, so every service you use to send email should have DKIM switched on — not only your main mailbox.
DMARC: the house rules
DMARC ties the two together. It tells receiving servers what to do with an email that claims to be from you but fails the checks, and where to send reports about it. It has three levels:
| p=nonemonitor only | p=quarantinesend to spam | p=rejectblock | |
|---|---|---|---|
| What happens to fakes | Nothing — they are delivered, but you receive reports. | They go to the spam / junk folder. | They are refused and never delivered. |
| When to use | The first few weeks, to see who sends as you. | Once all real senders pass. | The goal — full protection. |
Many companies set p=none once and never move on. That is better than nothing for reports, but it does not stop a single fake email.
The most common mistakes
Two SPF records
Adding a second SPF record for a new service instead of merging it into the first. Both then fail.
Too many lookups
More than 10 includes in SPF. The record looks fine but fails the check.
DKIM only on the main mailbox
Invoices from your accounting system or newsletters from your marketing tool are sent without a signature.
Stuck at p=none
DMARC is "set up" but not protecting anything.
Nobody watching
A DNS change, a new provider or an edited record silently breaks protection months later.
A safe path to DMARC reject
List every sender
Write down every service that sends email as your domain: mailboxes, website forms, ERP or accounting, CRM, newsletters.
Fix SPF
One record, all senders included, under 10 lookups, ending in ~all or -all.
Switch on DKIM everywhere
In each sending service, enable DKIM and publish its key.
Start DMARC at p=none with reports
Read the reports for two to four weeks and fix any real sender that fails.
Move to quarantine, then reject
Raise the policy step by step. Keep watching for a while after each step.
Check your domain now
You can check your own domain in seconds with our free domain health check — no login. It looks at SPF, DMARC and common DKIM selectors, plus your website, SSL certificate, domain expiry and spam blacklists.
To keep it right over time, TBS Infrastructure checks your records every day, grades them with plain-language fixes, and alerts you when your name servers or mail servers change.
Not sure your domain is protected?
Run the free check, or ask us to review your SPF, DKIM and DMARC with you.
This article is general guidance based on our own experience as of 27 Oct 2026. It is not legal or compliance advice; requirements differ by industry and country.