SPF DKIM DMARC Explained: 5 Essential Steps to Stop Fraud
By Claudia Sterling · 4 November 2026
Imagine a supplier receives an email that looks exactly like it came from your accounts department, asking them to “update” your bank details. Or your client gets an invoice from your address that you never sent. This kind of email fraud is aimed squarely at finance teams. Three settings, known as SPF, DKIM and DMARC, make it much harder for criminals to send email pretending to be you. Here’s what they do in plain English, and how to get them right.
Why SPF DKIM DMARC matter to your business
Email was designed decades ago without any way to prove who sent a message. Anyone can type your address into the “From” line. These three records, which live in your domain’s DNS settings (the address book that tells the internet where your website and email are), let receiving mail servers check whether an email really came from you.
Get them right and you gain two things:
- Protection: emails faking your domain are far more likely to be blocked or sent to spam.
- Delivery: your genuine emails are more likely to reach the inbox. Since February 2024, Google has required these checks from businesses that send large volumes of email to Gmail users (Google’s email sender guidelines), and Yahoo introduced similar rules at the same time.
SPF, DKIM and DMARC in plain English
SPF (Sender Policy Framework) is your guest list. It’s a single line in your DNS that lists the services allowed to send email for your domain, for example Microsoft 365 and your newsletter platform. Mail from anywhere else doesn’t match the list.
DKIM (DomainKeys Identified Mail) is a tamper-proof seal. Your email service adds a digital signature to every message. The receiving server checks it against a public key in your DNS. If the signature is missing or broken, the message may have been forged or changed.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is your instruction to the world. It tells receiving servers what to do when an email fails SPF and DKIM: let it through (p=none), send it to spam (p=quarantine) or block it (p=reject). It can also send you reports showing who is sending email using your domain.
What we found in our own records
When we moved our own email from GoDaddy to Microsoft 365 last month, our records were a good example of how these settings drift over time:
- Our SPF record listed GoDaddy’s mail servers, not Microsoft 365. Once we moved, leaving it unchanged would have made our genuine emails fail SPF, so we updated it on cutover day.
- Two other services had their own DKIM records: our newsletter platform and our website host. Deleting them during the move would have hurt those emails, so we kept them.
- Our DMARC policy was set to
p=none, meaning “monitor only”. That’s the right place to start, but it doesn’t stop anything on its own.
If your email has moved provider, or you’ve added tools like a newsletter, booking system or accounting software that sends email, the chances are your records need a check too.
5 steps to set up SPF DKIM DMARC properly
1. List everything that sends email as you
Include Microsoft 365 or Google Workspace, newsletters, your website’s contact form, accounting and invoicing software, ticketing systems, and scanners. Each one needs to be covered by SPF or DKIM, or its emails will start failing.
2. Fix your SPF record (only one!)
Your domain must have one SPF record. Two records break SPF entirely. It should include every legitimate sender, for example v=spf1 include:spf.protection.outlook.com -all for Microsoft 365, and remove old providers you no longer use. SPF also has a limit of 10 lookups, so don’t keep adding services you’ve stopped using.
3. Turn on DKIM for each service
In Microsoft 365, this means adding two DNS records and then switching DKIM on in Microsoft Defender. Newsletter and invoicing platforms give you their own DKIM records. Add them all.
4. Start DMARC on monitor, with reports
Publish a DMARC record such as v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. The rua address receives reports showing every service sending as your domain, including ones you’d forgotten. Read them for a few weeks.
5. Tighten to quarantine, then reject
Once the reports show your genuine email passing, change the policy to p=quarantine, so fakes go to spam, and later to p=reject, so they’re blocked outright. That’s when DMARC actually protects your clients and suppliers from fake emails using your name.
What SPF DKIM DMARC won’t stop
These records stop criminals from using your exact domain. They don’t stop lookalike domains, such as a letter swapped or added in your company name, or emails from a hacked supplier mailbox. So keep these habits too:
- Always confirm changes to bank details by phone, using a number you already have, never one from the email.
- Turn on multi-factor authentication for every mailbox.
- Train staff to check the full sender address, not just the display name.
- Protect laptops properly; see our post on EDR vs antivirus.
Your SPF DKIM DMARC checklist
- ✅ Every service that sends email as you is listed
- ✅ One SPF record, old providers removed, ending in
-allor~all - ✅ DKIM switched on for Microsoft 365 and every other sender
- ✅ DMARC published with a reporting address
- ✅ Reports reviewed, then policy moved to quarantine and reject
- ✅ Bank-detail changes always confirmed by phone
How ZSI helps
Zenith Services Inc. checks and fixes email security records for businesses in Georgetown and across Guyana as part of our Microsoft 365 services and cybersecurity services. If you’re moving email provider, read how we moved ours from GoDaddy to Microsoft 365.
Not sure if your SPF DKIM DMARC records are right? Talk to our team for a free email security check of your domain.