SPF, DKIM, DMARC, Explained for Business Owners (Not Just IT People)

When email was invented, security wasn’t a priority. As a result, anyone can send an email claiming to be from any address they like. SPF, DKIM, and DMARC add the verification layer that email was never born with. Think of them as three security guards, each checking a different credential.

SPF: The Authorised Senders List

You publish a list in your DNS that says “these are the mail servers authorised to send email for my domain.” When someone receives an email from your domain, their server checks the list. Think of it as a guest list at the door.

For M365, your SPF record needs to include Microsoft’s mail servers. If you use marketing platforms or invoicing software that sends email, those need to be listed too.

DKIM: The Digital Signature

DKIM adds a cryptographic signature to every outgoing email, like a wax seal on a letter. It proves the email came from where it claims and hasn’t been tampered with. For M365, enabling DKIM involves creating two CNAME records in your DNS.

Many organisations with M365 have never enabled DKIM. Without it, every email you send is unsigned.

DMARC: The Policy and the Reports

DMARC builds on SPF and DKIM by adding a policy (what to do with failing emails) and reporting (what’s happening with your email). It also adds alignment, checking that the domains in SPF/DKIM match the visible From address.

Three DMARC policies: none (monitor), quarantine (send failures to spam), reject (block failures). None is a starting point. Reject is the goal.

How They Work Together

None is fully effective alone. Together they form a layered system: SPF verifies the sending server, DKIM verifies the signature, DMARC aligns both with the From address and enforces a policy.

Where to Start

Check your status using MXToolbox: run SPF, DKIM, and DMARC lookups for your domain. If any are missing or misconfigured, it’s worth getting a review done.