A Toronto-area accounting firm starts getting confused calls in the middle of tax season. Clients have received an email "from the firm," sent from its real address, asking them to upload their documents to a new portal. The portal is a phishing site. Nobody broke into the firm's email. The fraudster just typed the firm's address into the "From" field.
Email allows this because it was designed in the early 1980s for a small network of people who trusted each other. Nothing in the original protocol checks that the sender you see is the real one.
Three free standards, published in your DNS, close that gap: SPF, DKIM and DMARC. No software to buy, and Gmail, Yahoo and Outlook now require them from many senders. Here's how each one works, with real record examples you can adapt.
TL;DR
- SPF lists the servers allowed to send for your domain, DKIM signs each message, and DMARC tells receivers what to do when checks fail, then sends you reports.
- Until DMARC is set to "reject," anyone can still send email that looks like it comes from your domain.
- Roll it out in stages: inventory your senders, fix SPF and DKIM, start DMARC in monitoring mode (p=none), then move to quarantine and reject.
Why anyone can send email "from" your company
Every email actually carries two sender addresses. The envelope address is used by servers to route the message and handle bounces. The "From" header is the one you see in Outlook or Gmail. They can differ, and originally neither one was verified.
SPF, DKIM and DMARC are TXT records you add to your domain's DNS zone, the same place that points to your website and mail server. Receiving servers look them up to decide whether a message is legitimate.
SPF: the list of approved senders
SPF (Sender Policy Framework) publishes which servers are allowed to send email for your domain. Here's an example for a business on Microsoft 365 that also sends invoices from a server at 203.0.113.25:
example.com. 3600 IN TXT "v=spf1 include:spf.protection.outlook.com ip4:203.0.113.25 -all"
On Google Workspace, the include would be include:_spf.google.com instead. The final -all means "reject anything else"; ~all (soft fail) is more lenient.
Three common mistakes:
- Only one SPF record per domain. Two records starting with
v=spf1make SPF invalid. - A maximum of ten DNS lookups. Each
includeuses at least one. Add a payroll provider, a newsletter platform and a CRM, and you can blow past the limit. - SPF checks the envelope address, not the visible From. On its own, it doesn't stop someone spoofing the address your clients see. That's DMARC's job.
DKIM: a signature that travels with the message
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email. Your sending service signs the message with a private key, and the public key is published in your DNS under a "selector." The receiver checks the signature: if the message was altered or didn't come from you, it won't match.
mail._domainkey.example.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx7q…"
(The real public key is much longer and is generated by your provider.) Google Workspace uses the selector google by default. Microsoft 365 has you publish two CNAME records, selector1 and selector2, pointing to keys Microsoft manages.
The step people forget: DKIM must be enabled for every service that sends on your behalf, not just your main mailbox. Use 2048-bit keys where your provider allows it.
DMARC: the rulebook and the reports
DMARC ties everything back to the address your recipient actually sees. A message passes DMARC if SPF or DKIM passes and the verified domain matches the domain in the From header. That match is called alignment.
DMARC also says what to do with failures, and where to send daily reports about all email using your domain. You start in monitoring mode:
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
Then, once every legitimate sender is authenticated, you tighten it:
; Stage 2: failing messages go to spam
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]"
; Stage 3: failing messages are refused
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"
| Tag | Purpose | Example |
|---|---|---|
v | Version, always first | v=DMARC1 |
p | Policy: none, quarantine or reject | p=reject |
rua | Where aggregate reports are sent | rua=mailto:[email protected] |
sp | Subdomain policy (defaults to p) | sp=reject |
adkim / aspf | Relaxed (r, the default) or strict (s) alignment | adkim=s |
Reports arrive as XML files that are unreadable to humans. A DMARC reporting tool, several of which have free tiers for small volumes, turns them into a clear dashboard.
You don't have to check all of this by hand. Our free flash audit automatically checks your SPF, DKIM and DMARC records and flags the most common errors.
Gmail, Yahoo and Outlook have raised the bar
These standards have existed for years. The big mailbox providers are now enforcing them:
- Google: since February 1, 2024, everyone sending to Gmail must use SPF or DKIM. Senders of more than 5,000 messages a day to Gmail accounts need SPF, DKIM and DMARC (p=none is accepted), an aligned From domain, one-click unsubscribe and a spam complaint rate below 0.3%. Since November 2025, Gmail has been ramping up enforcement, and non-compliant messages can face temporary and permanent rejections.
- Yahoo: similar requirements have applied since February 2024, including DMARC (at least p=none) for bulk senders.
- Microsoft: since May 5, 2025, domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses must pass SPF and DKIM and publish an aligned DMARC record (at least p=none). Non-compliant messages are rejected with error "550 5.7.515."
Your business may not send 5,000 emails a day. Your newsletter platform or invoicing software might. And the direction is clear: unauthenticated domains will increasingly be treated as suspicious.
A six-step rollout plan
- Inventory every service that sends email as you: mailboxes, newsletter, CRM, invoicing, payroll, website forms, multifunction printers.
- Fix SPF: one record, under ten DNS lookups, ending in
-allor~all. - Enable DKIM for each of those services, using your company domain.
- Publish DMARC at p=none with a
ruaaddress, and review the reports for a few weeks. - Move to p=quarantine, then p=reject, once all legitimate mail passes DMARC.
- Lock down unused domains: a domain you registered to protect your brand but never use for email should refuse all mail.
For that last step, two lines are enough:
example.net. 3600 IN TXT "v=spf1 -all"
_dmarc.example.net. 3600 IN TXT "v=DMARC1; p=reject"
Exact settings depend on your platform. We cover them in our Microsoft 365 security audit and Google Workspace security audit guides.
The bottom line
SPF, DKIM and DMARC cost nothing and protect both your deliverability and your reputation. Without them, your domain is a ready-made tool for CEO fraud and business email compromise, and for fake invoices sent to your own clients.
Getting to p=reject is mostly a matter of method: find every service that sends on your behalf and authenticate it properly. If you'd rather hand it off, our remediation and hardening services handle the rollout all the way to the final policy.
Frequently asked questions
Does DMARC stop lookalike domains?+
No. DMARC only protects your exact domain. A fraudster who registers a lookalike, with one letter swapped or .com instead of .ca, can publish perfectly valid SPF, DKIM and DMARC records for it. Defending against lookalikes takes domain monitoring, external sender banners and solid payment verification procedures.
Do SPF, DKIM and DMARC block malware in email?+
No. They verify who sent a message, not what's inside it. A fully authenticated email can still come from a compromised account and carry a malicious attachment. Your email platform's spam and malware filtering remains essential.
What is BIMI, and does a small business need it?+
BIMI lets supporting mailbox providers display your company logo next to your emails. It requires an enforced DMARC policy (quarantine or reject) and, for Gmail, a paid mark certificate. It's a nice branding bonus once DMARC is in place, not a security priority.