If you have ever been told your business needs “SPF, DKIM and DMARC” and quietly nodded along, you are in very good company. They sound like deep technical plumbing. In practice they answer one simple question: is this email really from who it claims to be from?
Getting them right does two valuable things. It stops criminals sending email that appears to come from your domain, and it stops your own legitimate email landing in spam.
The three, in plain English
SPF (Sender Policy Framework) is a public list of who is allowed to send email for your domain. Think of it as telling the world “only these mail servers can send as us.” If something else tries, receiving servers know to be suspicious.
DKIM (DomainKeys Identified Mail) adds a tamper-proof signature to every message you send. The receiving server checks the signature against a key published in your DNS. If it matches, the message genuinely came from you and was not altered in transit.
DMARC is the policy that ties the other two together. It tells receiving servers what to do when a message fails those checks: let it through, send it to spam, or reject it outright. It can also email you reports on who is sending mail using your domain.
A useful analogy: SPF is the guest list, DKIM is the tamper-proof seal, and DMARC is the instruction to the doorman about what to do with anyone who fails.
Why it matters commercially, not just technically
Brand protection. Without DMARC, it is straightforward for someone to send an invoice or a payment-redirect request that appears to come from your domain. Your customers get scammed, and your name is on it.
Deliverability. Major providers increasingly treat proper authentication as a baseline requirement. Misconfigured records are a common reason legitimate business email quietly lands in junk. If you have ever had a client say “I never got your email,” this is a prime suspect.
Credibility. Larger clients and insurers are starting to ask. It is a cheap thing to have in order.
The policy setting people get wrong
DMARC has three policy levels:
p=nonemonitor only. Nothing is blocked; you just get reports. The correct place to start.p=quarantinefailing mail goes to spam.p=rejectfailing mail is refused outright. The strongest protection.
The mistake is jumping straight to p=reject before checking what legitimate mail you actually send. If your accounting system, booking tool or marketing platform sends email as your domain and is not properly aligned, p=reject will cause that mail to hard-bounce. Start at none, read the reports, fix what fails, then tighten.
A quick self-check
- Do you have all three records published?
- Does every system that sends email as you (accounting software, CRM, marketing tools) pass the checks?
- Is your DMARC policy still sitting at
p=nonemonths later, doing nothing but generating reports?
That last one is common. Monitoring is the first step, not the destination.
The honest summary
This is a genuinely high-value, low-cost piece of security. It takes a competent hour to set up correctly, protects your brand from impersonation, and often fixes mysterious deliverability problems as a side effect.
Want your email authentication checked and tightened properly, including a safe path to a reject policy without breaking your legitimate mail? Get in touch and we will sort it end to end.