Home / Insights / SPF, DKIM and DMARC Explained
Cybersecurity / Email Security
Could Someone Send Email as Your Business? SPF, DKIM and DMARC in Plain English
Anyone can type your email address into the From line of a message. Three small DNS settings decide whether other mail servers believe it, and many Irish small businesses have none of them set up properly.
What each one does
SPF is a public list of the servers allowed to send email for your domain. DKIM adds a digital signature to each message so the receiver can check it really came from you and was not altered. DMARC ties the two together: it tells receiving servers what to do with mail that fails, and sends you reports showing who is using your domain.
Why it matters even if you have never been hacked
Without these settings, a criminal can send an invoice to your customers that appears to come from you, with no break-in required. Your genuine emails are also more likely to land in spam, and the big mailbox providers increasingly expect proper authentication, especially from anyone sending in volume.
How to roll it out without breaking your email
- Check where you stand today with our free Email Security Checker.
- List everything that sends email as your domain: Microsoft 365, your website contact form, invoicing software, your CRM and any newsletter tool.
- Publish one SPF record that includes all of them. Only one SPF record is allowed per domain.
- Turn on DKIM signing for each sender. In Microsoft 365 this is in the Defender portal under email authentication settings.
- Add a DMARC record with a policy of none and a reporting address, review the reports for two to four weeks, then move to quarantine and finally reject.
The mistake to avoid
Jumping straight to a reject policy before every legitimate sender is covered. Your own invoices or newsletters can start bouncing. The other common errors are publishing two SPF records, or building one that needs more than ten DNS lookups, which many receivers treat as a failure. Our checker flags both.