Email authentication: SPF, DKIM and DMARC

Why your domain needs protection

Email was designed without any built-in way to confirm the sender. Without additional controls, anyone can send a message that claims to come from your domain, such as accounts@yourcompany.ca, and many receiving systems will deliver it. Criminals use this to send fake invoices to your clients, payment change requests to your suppliers and phishing messages to your own staff.

Three DNS-based standards address this. SPF lists the servers allowed to send for your domain, DKIM adds a digital signature to each message, and DMARC ties the two together and tells receivers how to handle failures. Major providers such as Google and Microsoft now expect bulk senders to have them in place, and they help ordinary businesses too.

SPF: who is allowed to send

SPF, the Sender Policy Framework, is a single DNS text record listing the services allowed to send email for your domain. A typical small business record includes Microsoft 365 or Google Workspace plus any other services that send on your behalf, such as a newsletter platform, CRM, accounting software or website contact form.

Two common mistakes cause trouble. The first is publishing more than one SPF record, which invalidates both. The second is exceeding the limit of ten DNS lookups, which happens when many services are added over time. End the record with a soft fail or hard fail setting, and review it whenever you add or remove a service.

DKIM: signing your messages

DKIM, DomainKeys Identified Mail, adds a cryptographic signature to outgoing messages. The receiving server checks the signature against a public key published in your DNS. If the message was altered in transit or did not come from an authorized system, the check fails. Unlike SPF, DKIM survives most forwarding, which makes it valuable for DMARC.

In Microsoft 365 and Google Workspace, DKIM is enabled from the admin console after you add the DNS records they provide. Third-party senders such as marketing platforms usually offer their own DKIM records. Enable signing for every service that sends as your domain, not just your main mailbox provider. Test by sending a message to an external address and checking the headers.

DMARC: the policy that makes it work

DMARC, Domain-based Message Authentication, Reporting and Conformance, tells receivers what to do when a message fails SPF and DKIM alignment, and asks them to send you reports. There are three policies. None means monitor only. Quarantine means send failures to spam. Reject means refuse them outright. The goal is to reach quarantine or reject, because a policy of none does not stop anyone from spoofing you.

Start with a policy of none and a reporting address. Reports arrive as XML files that are hard to read directly, so use a DMARC reporting service to turn them into something useful. Within a few weeks you will see every system sending as your domain, including ones you had forgotten about.

• p=none: monitor and learn
• p=quarantine: failures go to spam
• p=reject: failures are refused

Moving to enforcement safely

Once the reports show that all your legitimate senders pass SPF or DKIM with proper alignment, move to quarantine, starting with a percentage of messages if you prefer. Watch for complaints about missing mail, fix any services you missed, then move to reject. For most small businesses the full process takes one to three months.

Do not forget domains you own but do not use for email, such as old brand names. Publish an SPF record that allows no senders and a DMARC reject policy for them, so criminals cannot use them either. Keep monitoring reports after enforcement, because new services get added and records drift over time.