SPF, DKIM and DMARC Explained for Small Business Email

Email was designed decades ago without a reliable way to prove who sent a message. That is why scammers can send emails that appear to come from your business, and why legitimate messages sometimes land in spam. Three standards, SPF, DKIM and DMARC, fix much of this by letting receiving mail servers check whether a message really came from someone allowed to send for your domain.

Major mailbox providers now expect authentication, especially from organizations that send in volume. If you use your own domain for email, these records are no longer optional.

Where these records live

All three are text records published in your domain's DNS, the settings that also control where your website and email are delivered. DNS is usually managed at your domain registrar or hosting provider. Changes there affect your email directly, so make them carefully and keep a copy of the original settings.

SPF: which servers may send for you

SPF, short for Sender Policy Framework, is a list of the servers and services allowed to send email using your domain. When a message arrives, the receiving server checks whether it came from a sender on your list.

Key points:

• One SPF record per domain. If you use several services, they are combined into a single record.
• Include every service that sends as your domain: your main email provider, newsletter platform, invoicing or accounting tool, donation platform, scheduling tool and website contact forms.
• There is a limit on lookups. SPF allows a maximum of ten DNS lookups, so very long lists can break. Your providers' instructions will show what to include.
• The ending matters. A record ending in a soft fail (~all) asks receivers to treat unlisted senders as suspicious, while a hard fail (-all) asks them to reject.

DKIM: a signature on every message

DKIM, short for DomainKeys Identified Mail, adds a digital signature to each outgoing message. The sending service holds a private key, and you publish the matching public key in your DNS under a name called a selector. Receivers use the public key to confirm that the message was authorized by your domain and was not altered in transit.

Each service that sends as your domain usually provides its own DKIM record for you to add. Turn DKIM on in every one of them.

DMARC: your policy and your reports

DMARC, short for Domain-based Message Authentication, Reporting and Conformance, ties SPF and DKIM together. It tells receiving servers:

• What to do with messages that fail: do nothing special (p=none), treat as suspicious and send to spam (p=quarantine) or reject outright (p=reject).
• Where to send reports about messages using your domain, so you can see which services are sending and whether they pass.

DMARC also checks alignment: the domain in the visible From address must match the domain verified by SPF or DKIM. This is what stops a scammer from passing checks with their own domain while showing yours in the From line.

A safe order for setting them up

1. Inventory every service that sends email as your domain. This step prevents most problems. People often forget website forms, invoicing tools and donation platforms.
2. Set up SPF with all of those services included.
3. Turn on DKIM in each service and publish its record.
4. Add a DMARC record with p=none and a reporting address, which monitors without changing delivery.
5. Review reports for a few weeks. Fix any legitimate service that is failing.
6. Move to p=quarantine, then p=reject, once you are confident all legitimate mail passes.

Protect domains that never send email

If you own extra domains that do not send email, such as misspellings or old brand names, publish records that say so: an SPF record that allows no senders and a DMARC reject policy. This prevents scammers from using those domains to impersonate you.

Get help when you need it

Your email provider's help pages give exact records to add. Whoever manages your DNS can make the changes. If authentication is in place but messages still land in spam, our guide to why emails land in spam covers the other common causes. And if you are still sending from a free email address, start with why your business email should use your own domain.

Frequently asked questions

Do I need all three: SPF, DKIM and DMARC?

Yes, for reliable delivery and protection against spoofing. SPF and DKIM verify senders, and DMARC tells receivers how to handle failures and gives you visibility through reports.

Will DMARC stop all email spoofing?

An enforced DMARC policy stops others from sending email that uses your exact domain in the From address. It does not stop lookalike domains with small spelling changes, so staff and customers still need to watch for those.

Can setting these up break my email?

Mistakes can cause legitimate messages to fail, which is why you inventory senders first and start DMARC in monitoring mode. Make changes carefully and keep a copy of the original records.