[{"data":1,"prerenderedAt":638},["ShallowReactive",2],{"footer-services-en":3,"footer-local-en":28,"post-\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained":45,"post-alt-\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained":616,"post-rel-\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained":618},[4,8,12,16,20,24],{"path":5,"navTitle":6,"order":7},"\u002Fen\u002Fservices\u002Fcybersecurity-audit","Cybersecurity Audit",1,{"path":9,"navTitle":10,"order":11},"\u002Fen\u002Fservices\u002Fpenetration-testing","Penetration Testing",2,{"path":13,"navTitle":14,"order":15},"\u002Fen\u002Fservices\u002Fmicrosoft-365-google-workspace-audit","Microsoft 365 \u002F Google Workspace Audit",3,{"path":17,"navTitle":18,"order":19},"\u002Fen\u002Fservices\u002Flaw-25-compliance","Law 25 Compliance",4,{"path":21,"navTitle":22,"order":23},"\u002Fen\u002Fservices\u002Fremediation-hardening","Remediation and Hardening",5,{"path":25,"navTitle":26,"order":27},"\u002Fen\u002Fservices\u002Fongoing-security-partner","Ongoing Security Partner (vCISO)",6,[29,33,37,41],{"path":30,"city":31,"translationKey":32},"\u002Fen\u002Fcybersecurity-audit\u002Fmontreal","Montréal","montreal",{"path":34,"city":35,"translationKey":36},"\u002Fen\u002Fcybersecurity-audit\u002Flaval","Laval","laval",{"path":38,"city":39,"translationKey":40},"\u002Fen\u002Fcybersecurity-audit\u002Fsouth-shore","South Shore","rive-sud",{"path":42,"city":43,"translationKey":44},"\u002Fen\u002Fcybersecurity-audit\u002Fnorth-shore","North Shore","rive-nord",{"id":46,"title":47,"body":48,"category":575,"date":576,"description":577,"extension":578,"faq":579,"keyword":589,"meta":590,"minutes":23,"navigation":258,"path":591,"rawbody":592,"seo":593,"sources":594,"stem":607,"tags":608,"translationKey":613,"updated":614,"__hash__":615},"blog_en\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained.md","SPF, DKIM and DMARC Explained for Small Businesses",{"type":49,"value":50,"toc":566},"minimark",[51,55,58,61,91,96,99,102,106,109,125,140,143,171,175,178,187,202,209,213,224,227,236,239,270,382,385,388,392,396,399,422,425,429,509,512,527,540,544,552,559,562],[52,53,54],"p",{},"A Toronto-area accounting firm starts getting confused calls in the middle of tax season. Clients have received an email \"from the firm,\" sent from its real address, asking them to upload their documents to a new portal. The portal is a phishing site. Nobody broke into the firm's email. The fraudster just typed the firm's address into the \"From\" field.",[52,56,57],{},"Email allows this because it was designed in the early 1980s for a small network of people who trusted each other. Nothing in the original protocol checks that the sender you see is the real one.",[52,59,60],{},"Three free standards, published in your DNS, close that gap: SPF, DKIM and DMARC. No software to buy, and Gmail, Yahoo and Outlook now require them from many senders. Here's how each one works, with real record examples you can adapt.",[62,63,66],"callout",{"title":64,"type":65},"TL;DR","tip",[67,68,69,85,88],"ul",{},[70,71,72,76,77,80,81,84],"li",{},[73,74,75],"strong",{},"SPF"," lists the servers allowed to send for your domain, ",[73,78,79],{},"DKIM"," signs each message, and ",[73,82,83],{},"DMARC"," tells receivers what to do when checks fail, then sends you reports.",[70,86,87],{},"Until DMARC is set to \"reject,\" anyone can still send email that looks like it comes from your domain.",[70,89,90],{},"Roll it out in stages: inventory your senders, fix SPF and DKIM, start DMARC in monitoring mode (p=none), then move to quarantine and reject.",[92,93,95],"h2",{"id":94},"why-anyone-can-send-email-from-your-company","Why anyone can send email \"from\" your company",[52,97,98],{},"Every email actually carries two sender addresses. The envelope address is used by servers to route the message and handle bounces. The \"From\" header is the one you see in Outlook or Gmail. They can differ, and originally neither one was verified.",[52,100,101],{},"SPF, DKIM and DMARC are TXT records you add to your domain's DNS zone, the same place that points to your website and mail server. Receiving servers look them up to decide whether a message is legitimate.",[92,103,105],{"id":104},"spf-the-list-of-approved-senders","SPF: the list of approved senders",[52,107,108],{},"SPF (Sender Policy Framework) publishes which servers are allowed to send email for your domain. Here's an example for a business on Microsoft 365 that also sends invoices from a server at 203.0.113.25:",[110,111,116],"pre",{"className":112,"code":113,"language":114,"meta":115,"style":115},"language-txt shiki shiki-themes github-light","example.com.  3600  IN  TXT  \"v=spf1 include:spf.protection.outlook.com ip4:203.0.113.25 -all\"\n","txt","",[117,118,119],"code",{"__ignoreMap":115},[120,121,123],"span",{"class":122,"line":7},"line",[120,124,113],{},[52,126,127,128,131,132,135,136,139],{},"On Google Workspace, the include would be ",[117,129,130],{},"include:_spf.google.com"," instead. The final ",[117,133,134],{},"-all"," means \"reject anything else\"; ",[117,137,138],{},"~all"," (soft fail) is more lenient.",[52,141,142],{},"Three common mistakes:",[67,144,145,155,165],{},[70,146,147,150,151,154],{},[73,148,149],{},"Only one SPF record per domain."," Two records starting with ",[117,152,153],{},"v=spf1"," make SPF invalid.",[70,156,157,160,161,164],{},[73,158,159],{},"A maximum of ten DNS lookups."," Each ",[117,162,163],{},"include"," uses at least one. Add a payroll provider, a newsletter platform and a CRM, and you can blow past the limit.",[70,166,167,170],{},[73,168,169],{},"SPF checks the envelope address, not the visible From."," On its own, it doesn't stop someone spoofing the address your clients see. That's DMARC's job.",[92,172,174],{"id":173},"dkim-a-signature-that-travels-with-the-message","DKIM: a signature that travels with the message",[52,176,177],{},"DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email. Your sending service signs the message with a private key, and the public key is published in your DNS under a \"selector.\" The receiver checks the signature: if the message was altered or didn't come from you, it won't match.",[110,179,181],{"className":112,"code":180,"language":114,"meta":115,"style":115},"mail._domainkey.example.com.  3600  IN  TXT  \"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx7q…\"\n",[117,182,183],{"__ignoreMap":115},[120,184,185],{"class":122,"line":7},[120,186,180],{},[52,188,189,190,193,194,197,198,201],{},"(The real public key is much longer and is generated by your provider.) Google Workspace uses the selector ",[117,191,192],{},"google"," by default. Microsoft 365 has you publish two CNAME records, ",[117,195,196],{},"selector1"," and ",[117,199,200],{},"selector2",", pointing to keys Microsoft manages.",[52,203,204,205,208],{},"The step people forget: DKIM must be enabled for ",[73,206,207],{},"every"," service that sends on your behalf, not just your main mailbox. Use 2048-bit keys where your provider allows it.",[92,210,212],{"id":211},"dmarc-the-rulebook-and-the-reports","DMARC: the rulebook and the reports",[52,214,215,216,219,220,223],{},"DMARC ties everything back to the address your recipient actually sees. A message passes DMARC if SPF ",[73,217,218],{},"or"," DKIM passes ",[73,221,222],{},"and"," the verified domain matches the domain in the From header. That match is called alignment.",[52,225,226],{},"DMARC also says what to do with failures, and where to send daily reports about all email using your domain. You start in monitoring mode:",[110,228,230],{"className":112,"code":229,"language":114,"meta":115,"style":115},"_dmarc.example.com.  3600  IN  TXT  \"v=DMARC1; p=none; rua=mailto:dmarc@example.com\"\n",[117,231,232],{"__ignoreMap":115},[120,233,234],{"class":122,"line":7},[120,235,229],{},[52,237,238],{},"Then, once every legitimate sender is authenticated, you tighten it:",[110,240,242],{"className":112,"code":241,"language":114,"meta":115,"style":115},"; Stage 2: failing messages go to spam\n_dmarc.example.com.  3600  IN  TXT  \"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com\"\n\n; Stage 3: failing messages are refused\n_dmarc.example.com.  3600  IN  TXT  \"v=DMARC1; p=reject; rua=mailto:dmarc@example.com\"\n",[117,243,244,249,254,260,265],{"__ignoreMap":115},[120,245,246],{"class":122,"line":7},[120,247,248],{},"; Stage 2: failing messages go to spam\n",[120,250,251],{"class":122,"line":11},[120,252,253],{},"_dmarc.example.com.  3600  IN  TXT  \"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com\"\n",[120,255,256],{"class":122,"line":15},[120,257,259],{"emptyLinePlaceholder":258},true,"\n",[120,261,262],{"class":122,"line":19},[120,263,264],{},"; Stage 3: failing messages are refused\n",[120,266,267],{"class":122,"line":23},[120,268,269],{},"_dmarc.example.com.  3600  IN  TXT  \"v=DMARC1; p=reject; rua=mailto:dmarc@example.com\"\n",[271,272,273,289],"table",{},[274,275,276],"thead",{},[277,278,279,283,286],"tr",{},[280,281,282],"th",{},"Tag",[280,284,285],{},"Purpose",[280,287,288],{},"Example",[290,291,292,308,322,337,355],"tbody",{},[277,293,294,300,303],{},[295,296,297],"td",{},[117,298,299],{},"v",[295,301,302],{},"Version, always first",[295,304,305],{},[117,306,307],{},"v=DMARC1",[277,309,310,314,317],{},[295,311,312],{},[117,313,52],{},[295,315,316],{},"Policy: none, quarantine or reject",[295,318,319],{},[117,320,321],{},"p=reject",[277,323,324,329,332],{},[295,325,326],{},[117,327,328],{},"rua",[295,330,331],{},"Where aggregate reports are sent",[295,333,334],{},[117,335,336],{},"rua=mailto:dmarc@example.com",[277,338,339,344,350],{},[295,340,341],{},[117,342,343],{},"sp",[295,345,346,347,349],{},"Subdomain policy (defaults to ",[117,348,52],{},")",[295,351,352],{},[117,353,354],{},"sp=reject",[277,356,357,366,377],{},[295,358,359,362,363],{},[117,360,361],{},"adkim"," \u002F ",[117,364,365],{},"aspf",[295,367,368,369,372,373,376],{},"Relaxed (",[117,370,371],{},"r",", the default) or strict (",[117,374,375],{},"s",") alignment",[295,378,379],{},[117,380,381],{},"adkim=s",[52,383,384],{},"Reports arrive as XML files that are unreadable to humans. A DMARC reporting tool, several of which have free tiers for small volumes, turns them into a clear dashboard.",[52,386,387],{},"You don't have to check all of this by hand. Our free flash audit automatically checks your SPF, DKIM and DMARC records and flags the most common errors.",[389,390],"cta",{"variant":391},"audit",[92,393,395],{"id":394},"gmail-yahoo-and-outlook-have-raised-the-bar","Gmail, Yahoo and Outlook have raised the bar",[52,397,398],{},"These standards have existed for years. The big mailbox providers are now enforcing them:",[67,400,401,410,416],{},[70,402,403,406,407,409],{},[73,404,405],{},"Google:"," since February 1, 2024, everyone sending to Gmail must use SPF or DKIM. Senders of more than 5,000 messages a day to Gmail accounts need SPF, DKIM ",[73,408,222],{}," DMARC (p=none is accepted), an aligned From domain, one-click unsubscribe and a spam complaint rate below 0.3%. Since November 2025, Gmail has been ramping up enforcement, and non-compliant messages can face temporary and permanent rejections.",[70,411,412,415],{},[73,413,414],{},"Yahoo:"," similar requirements have applied since February 2024, including DMARC (at least p=none) for bulk senders.",[70,417,418,421],{},[73,419,420],{},"Microsoft:"," since May 5, 2025, domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses must pass SPF and DKIM and publish an aligned DMARC record (at least p=none). Non-compliant messages are rejected with error \"550 5.7.515.\"",[52,423,424],{},"Your business may not send 5,000 emails a day. Your newsletter platform or invoicing software might. And the direction is clear: unauthenticated domains will increasingly be treated as suspicious.",[92,426,428],{"id":427},"a-six-step-rollout-plan","A six-step rollout plan",[67,430,433,447,463,473,486,499],{"className":431},[432],"contains-task-list",[70,434,437,442,443,446],{"className":435},[436],"task-list-item",[438,439],"input",{"disabled":258,"type":440,"aria-label":441},"checkbox","Inventory every service that sends email as you: mailboxes, newsletter, CRM, invoicing, payroll, website forms, multifunction printers."," ",[73,444,445],{},"Inventory"," every service that sends email as you: mailboxes, newsletter, CRM, invoicing, payroll, website forms, multifunction printers.",[70,448,450,442,453,456,457,459,460,462],{"className":449},[436],[438,451],{"disabled":258,"type":440,"aria-label":452},"Fix SPF: one record, under ten DNS lookups, ending in -all or ~all.",[73,454,455],{},"Fix SPF:"," one record, under ten DNS lookups, ending in ",[117,458,134],{}," or ",[117,461,138],{},".",[70,464,466,442,469,472],{"className":465},[436],[438,467],{"disabled":258,"type":440,"aria-label":468},"Enable DKIM for each of those services, using your company domain.",[73,470,471],{},"Enable DKIM"," for each of those services, using your company domain.",[70,474,476,442,479,482,483,485],{"className":475},[436],[438,477],{"disabled":258,"type":440,"aria-label":478},"Publish DMARC at p=none with a rua address, and review the reports for a few weeks.",[73,480,481],{},"Publish DMARC at p=none"," with a ",[117,484,328],{}," address, and review the reports for a few weeks.",[70,487,489,442,492,495,496,498],{"className":488},[436],[438,490],{"disabled":258,"type":440,"aria-label":491},"Move to p=quarantine, then p=reject, once all legitimate mail passes DMARC.",[73,493,494],{},"Move to p=quarantine",", then ",[73,497,321],{},", once all legitimate mail passes DMARC.",[70,500,502,442,505,508],{"className":501},[436],[438,503],{"disabled":258,"type":440,"aria-label":504},"Lock down unused domains: a domain you registered to protect your brand but never use for email should refuse all mail.",[73,506,507],{},"Lock down unused domains:"," a domain you registered to protect your brand but never use for email should refuse all mail.",[52,510,511],{},"For that last step, two lines are enough:",[110,513,515],{"className":112,"code":514,"language":114,"meta":115,"style":115},"example.net.         3600  IN  TXT  \"v=spf1 -all\"\n_dmarc.example.net.  3600  IN  TXT  \"v=DMARC1; p=reject\"\n",[117,516,517,522],{"__ignoreMap":115},[120,518,519],{"class":122,"line":7},[120,520,521],{},"example.net.         3600  IN  TXT  \"v=spf1 -all\"\n",[120,523,524],{"class":122,"line":11},[120,525,526],{},"_dmarc.example.net.  3600  IN  TXT  \"v=DMARC1; p=reject\"\n",[52,528,529,530,197,535,539],{},"Exact settings depend on your platform. We cover them in our ",[531,532,534],"a",{"href":533},"\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit","Microsoft 365 security audit",[531,536,538],{"href":537},"\u002Fen\u002Fblog\u002Fgoogle-workspace-security-audit","Google Workspace security audit"," guides.",[92,541,543],{"id":542},"the-bottom-line","The bottom line",[52,545,546,547,551],{},"SPF, DKIM and DMARC cost nothing and protect both your deliverability and your reputation. Without them, your domain is a ready-made tool for ",[531,548,550],{"href":549},"\u002Fen\u002Fblog\u002Fbusiness-email-compromise-ceo-fraud","CEO fraud and business email compromise",", and for fake invoices sent to your own clients.",[52,553,554,555,558],{},"Getting to p=reject is mostly a matter of method: find every service that sends on your behalf and authenticate it properly. If you'd rather hand it off, our ",[531,556,557],{"href":21},"remediation and hardening services"," handle the rollout all the way to the final policy.",[389,560],{"variant":561},"devis",[563,564,565],"style",{},"html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}",{"title":115,"searchDepth":11,"depth":15,"links":567},[568,569,570,571,572,573,574],{"id":94,"depth":11,"text":95},{"id":104,"depth":11,"text":105},{"id":173,"depth":11,"text":174},{"id":211,"depth":11,"text":212},{"id":394,"depth":11,"text":395},{"id":427,"depth":11,"text":428},{"id":542,"depth":11,"text":543},"threats","2026-10-24","SPF, DKIM and DMARC explained in plain English, with real DNS record examples, the Gmail, Yahoo and Outlook sender rules, and a rollout plan for your domain.","md",[580,583,586],{"q":581,"a":582},"Does DMARC stop lookalike domains?","No. DMARC only protects your exact domain. A fraudster who registers a lookalike, with one letter swapped or .com instead of .ca, can publish perfectly valid SPF, DKIM and DMARC records for it. Defending against lookalikes takes domain monitoring, external sender banners and solid payment verification procedures.",{"q":584,"a":585},"Do SPF, DKIM and DMARC block malware in email?","No. They verify who sent a message, not what's inside it. A fully authenticated email can still come from a compromised account and carry a malicious attachment. Your email platform's spam and malware filtering remains essential.",{"q":587,"a":588},"What is BIMI, and does a small business need it?","BIMI lets supporting mailbox providers display your company logo next to your emails. It requires an enforced DMARC policy (quarantine or reject) and, for Gmail, a paid mark certificate. It's a nice branding bonus once DMARC is in place, not a security priority.","SPF DKIM DMARC explained",{},"\u002Fen\u002Fblog\u002Fspf-dkim-dmarc-explained","---\ntitle: \"SPF, DKIM and DMARC Explained for Small Businesses\"\ndescription: \"SPF, DKIM and DMARC explained in plain English, with real DNS record examples, the Gmail, Yahoo and Outlook sender rules, and a rollout plan for your domain.\"\ndate: 2026-10-24\ncategory: threats\ntags: [\"dmarc\", \"email\", \"dns\", \"spoofing\"]\ntranslationKey: spf-dkim-dmarc\nkeyword: \"SPF DKIM DMARC explained\"\nfaq:\n  - q: \"Does DMARC stop lookalike domains?\"\n    a: \"No. DMARC only protects your exact domain. A fraudster who registers a lookalike, with one letter swapped or .com instead of .ca, can publish perfectly valid SPF, DKIM and DMARC records for it. Defending against lookalikes takes domain monitoring, external sender banners and solid payment verification procedures.\"\n  - q: \"Do SPF, DKIM and DMARC block malware in email?\"\n    a: \"No. They verify who sent a message, not what's inside it. A fully authenticated email can still come from a compromised account and carry a malicious attachment. Your email platform's spam and malware filtering remains essential.\"\n  - q: \"What is BIMI, and does a small business need it?\"\n    a: \"BIMI lets supporting mailbox providers display your company logo next to your emails. It requires an enforced DMARC policy (quarantine or reject) and, for Gmail, a paid mark certificate. It's a nice branding bonus once DMARC is in place, not a security priority.\"\nsources:\n  - title: \"Google: Email sender guidelines\"\n    url: \"https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F81126\"\n  - title: \"Google: Email sender guidelines FAQ (enforcement from November 2025)\"\n    url: \"https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F14229414\"\n  - title: \"Yahoo Sender Hub: Sender best practices and requirements\"\n    url: \"https:\u002F\u002Fsenders.yahooinc.com\u002Fbest-practices\u002F\"\n  - title: \"Microsoft: Fix NDR error 550 5.7.515 in Outlook.com (high-volume sender requirements)\"\n    url: \"https:\u002F\u002Fsupport.microsoft.com\u002Foutlook\u002Ffix-ndr-error-550-5-7-515-in-outlook-com\"\n---\n\nA Toronto-area accounting firm starts getting confused calls in the middle of tax season. Clients have received an email \"from the firm,\" sent from its real address, asking them to upload their documents to a new portal. The portal is a phishing site. Nobody broke into the firm's email. The fraudster just typed the firm's address into the \"From\" field.\n\nEmail allows this because it was designed in the early 1980s for a small network of people who trusted each other. Nothing in the original protocol checks that the sender you see is the real one.\n\nThree free standards, published in your DNS, close that gap: SPF, DKIM and DMARC. No software to buy, and Gmail, Yahoo and Outlook now require them from many senders. Here's how each one works, with real record examples you can adapt.\n\n::callout{type=\"tip\" title=\"TL;DR\"}\n- **SPF** lists the servers allowed to send for your domain, **DKIM** signs each message, and **DMARC** tells receivers what to do when checks fail, then sends you reports.\n- Until DMARC is set to \"reject,\" anyone can still send email that looks like it comes from your domain.\n- Roll it out in stages: inventory your senders, fix SPF and DKIM, start DMARC in monitoring mode (p=none), then move to quarantine and reject.\n::\n\n## Why anyone can send email \"from\" your company\n\nEvery email actually carries two sender addresses. The envelope address is used by servers to route the message and handle bounces. The \"From\" header is the one you see in Outlook or Gmail. They can differ, and originally neither one was verified.\n\nSPF, DKIM and DMARC are TXT records you add to your domain's DNS zone, the same place that points to your website and mail server. Receiving servers look them up to decide whether a message is legitimate.\n\n## SPF: the list of approved senders\n\nSPF (Sender Policy Framework) publishes which servers are allowed to send email for your domain. Here's an example for a business on Microsoft 365 that also sends invoices from a server at 203.0.113.25:\n\n```txt\nexample.com.  3600  IN  TXT  \"v=spf1 include:spf.protection.outlook.com ip4:203.0.113.25 -all\"\n```\n\nOn Google Workspace, the include would be `include:_spf.google.com` instead. The final `-all` means \"reject anything else\"; `~all` (soft fail) is more lenient.\n\nThree common mistakes:\n\n- **Only one SPF record per domain.** Two records starting with `v=spf1` make SPF invalid.\n- **A maximum of ten DNS lookups.** Each `include` uses at least one. Add a payroll provider, a newsletter platform and a CRM, and you can blow past the limit.\n- **SPF checks the envelope address, not the visible From.** On its own, it doesn't stop someone spoofing the address your clients see. That's DMARC's job.\n\n## DKIM: a signature that travels with the message\n\nDKIM (DomainKeys Identified Mail) adds a cryptographic signature to every email. Your sending service signs the message with a private key, and the public key is published in your DNS under a \"selector.\" The receiver checks the signature: if the message was altered or didn't come from you, it won't match.\n\n```txt\nmail._domainkey.example.com.  3600  IN  TXT  \"v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAx7q…\"\n```\n\n(The real public key is much longer and is generated by your provider.) Google Workspace uses the selector `google` by default. Microsoft 365 has you publish two CNAME records, `selector1` and `selector2`, pointing to keys Microsoft manages.\n\nThe step people forget: DKIM must be enabled for **every** service that sends on your behalf, not just your main mailbox. Use 2048-bit keys where your provider allows it.\n\n## DMARC: the rulebook and the reports\n\nDMARC ties everything back to the address your recipient actually sees. A message passes DMARC if SPF **or** DKIM passes **and** the verified domain matches the domain in the From header. That match is called alignment.\n\nDMARC also says what to do with failures, and where to send daily reports about all email using your domain. You start in monitoring mode:\n\n```txt\n_dmarc.example.com.  3600  IN  TXT  \"v=DMARC1; p=none; rua=mailto:dmarc@example.com\"\n```\n\nThen, once every legitimate sender is authenticated, you tighten it:\n\n```txt\n; Stage 2: failing messages go to spam\n_dmarc.example.com.  3600  IN  TXT  \"v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com\"\n\n; Stage 3: failing messages are refused\n_dmarc.example.com.  3600  IN  TXT  \"v=DMARC1; p=reject; rua=mailto:dmarc@example.com\"\n```\n\n| Tag | Purpose | Example |\n|---|---|---|\n| `v` | Version, always first | `v=DMARC1` |\n| `p` | Policy: none, quarantine or reject | `p=reject` |\n| `rua` | Where aggregate reports are sent | `rua=mailto:dmarc@example.com` |\n| `sp` | Subdomain policy (defaults to `p`) | `sp=reject` |\n| `adkim` \u002F `aspf` | Relaxed (`r`, the default) or strict (`s`) alignment | `adkim=s` |\n\nReports arrive as XML files that are unreadable to humans. A DMARC reporting tool, several of which have free tiers for small volumes, turns them into a clear dashboard.\n\nYou don't have to check all of this by hand. Our free flash audit automatically checks your SPF, DKIM and DMARC records and flags the most common errors.\n\n::cta{variant=\"audit\"}\n::\n\n## Gmail, Yahoo and Outlook have raised the bar\n\nThese standards have existed for years. The big mailbox providers are now enforcing them:\n\n- **Google:** since February 1, 2024, everyone sending to Gmail must use SPF or DKIM. Senders of more than 5,000 messages a day to Gmail accounts need SPF, DKIM **and** DMARC (p=none is accepted), an aligned From domain, one-click unsubscribe and a spam complaint rate below 0.3%. Since November 2025, Gmail has been ramping up enforcement, and non-compliant messages can face temporary and permanent rejections.\n- **Yahoo:** similar requirements have applied since February 2024, including DMARC (at least p=none) for bulk senders.\n- **Microsoft:** since May 5, 2025, domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live addresses must pass SPF and DKIM and publish an aligned DMARC record (at least p=none). Non-compliant messages are rejected with error \"550 5.7.515.\"\n\nYour business may not send 5,000 emails a day. Your newsletter platform or invoicing software might. And the direction is clear: unauthenticated domains will increasingly be treated as suspicious.\n\n## A six-step rollout plan\n\n- [ ] **Inventory** every service that sends email as you: mailboxes, newsletter, CRM, invoicing, payroll, website forms, multifunction printers.\n- [ ] **Fix SPF:** one record, under ten DNS lookups, ending in `-all` or `~all`.\n- [ ] **Enable DKIM** for each of those services, using your company domain.\n- [ ] **Publish DMARC at p=none** with a `rua` address, and review the reports for a few weeks.\n- [ ] **Move to p=quarantine**, then **p=reject**, once all legitimate mail passes DMARC.\n- [ ] **Lock down unused domains:** a domain you registered to protect your brand but never use for email should refuse all mail.\n\nFor that last step, two lines are enough:\n\n```txt\nexample.net.         3600  IN  TXT  \"v=spf1 -all\"\n_dmarc.example.net.  3600  IN  TXT  \"v=DMARC1; p=reject\"\n```\n\nExact settings depend on your platform. We cover them in our [Microsoft 365 security audit](\u002Fen\u002Fblog\u002Fmicrosoft-365-security-audit) and [Google Workspace security audit](\u002Fen\u002Fblog\u002Fgoogle-workspace-security-audit) guides.\n\n## The bottom line\n\nSPF, DKIM and DMARC cost nothing and protect both your deliverability and your reputation. Without them, your domain is a ready-made tool for [CEO fraud and business email compromise](\u002Fen\u002Fblog\u002Fbusiness-email-compromise-ceo-fraud), and for fake invoices sent to your own clients.\n\nGetting to p=reject is mostly a matter of method: find every service that sends on your behalf and authenticate it properly. If you'd rather hand it off, our [remediation and hardening services](\u002Fen\u002Fservices\u002Fremediation-hardening) handle the rollout all the way to the final policy.\n\n::cta{variant=\"devis\"}\n::\n",{"title":47,"description":577},[595,598,601,604],{"title":596,"url":597},"Google: Email sender guidelines","https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F81126",{"title":599,"url":600},"Google: Email sender guidelines FAQ (enforcement from November 2025)","https:\u002F\u002Fsupport.google.com\u002Fa\u002Fanswer\u002F14229414",{"title":602,"url":603},"Yahoo Sender Hub: Sender best practices and requirements","https:\u002F\u002Fsenders.yahooinc.com\u002Fbest-practices\u002F",{"title":605,"url":606},"Microsoft: Fix NDR error 550 5.7.515 in Outlook.com (high-volume sender requirements)","https:\u002F\u002Fsupport.microsoft.com\u002Foutlook\u002Ffix-ndr-error-550-5-7-515-in-outlook-com","en\u002Fblog\u002Fspf-dkim-dmarc-explained",[609,610,611,612],"dmarc","email","dns","spoofing","spf-dkim-dmarc",null,"aDiaNUnE_XI1BerX5PzvmGoMlDCSJuJ8wYGrjqnZPKs",{"path":617},"\u002Fblogue\u002Fspf-dkim-dmarc-explication",[619,626,633],{"path":549,"title":620,"description":621,"category":575,"minutes":23,"tags":622},"Business Email Compromise and CEO Fraud: How to Stop It","Fake CEO, fake supplier, diverted payroll: how business email compromise works, what it costs Canadian small businesses and the simple controls that stop it.",[623,624,610,625],"bec","fraud","phishing",{"path":627,"title":628,"description":629,"category":575,"minutes":23,"tags":630},"\u002Fen\u002Fblog\u002Fclicked-phishing-link-what-to-do","Clicked a Phishing Link? What to Do in the Next 15 Minutes","Clicked on a phishing link? The steps to take right now, depending on what happened next: a click, a typed password, an opened attachment or bank details.",[625,631,610,632],"incident response","small business",{"path":634,"title":635,"description":636,"category":575,"minutes":27,"tags":637},"\u002Fen\u002Fblog\u002Fhow-to-spot-phishing-email-examples","How to Spot a Phishing Email: 5 Canadian Examples Decoded","Fake CRA e-Transfers, Canada Post parcel fees, Hydro-Québec refunds: five phishing examples broken down, plus the warning signs to check before you click.",[625,610,624,632],1792971360250]