SPF, DKIM, and DMARC: What Business Owners Need to Know

If you have never heard of SPF, DKIM, or DMARC, you are not alone — most business owners haven't, even though these three records determine whether someone else can send email that appears to come from your own domain. That gap is exactly what business email compromise attacks exploit.

SPF: who is allowed to send

Sender Policy Framework is a DNS record listing the mail servers authorized to send email on behalf of your domain. Receiving mail servers check this list; a message from a server not on it is a red flag.

DKIM: proving the message was not altered

DomainKeys Identified Mail attaches a digital signature to outgoing email, generated with a private key your mail system holds. Receiving servers verify that signature against a public key published in your DNS — confirming the message really came from you and was not modified in transit.

DMARC: telling the world what to do about failures

Domain-based Message Authentication, Reporting, and Conformance ties SPF and DKIM together and tells receiving mail servers what to do when a message fails those checks: do nothing (p=none), quarantine it (p=quarantine), or reject it outright (p=reject). It also gives you visibility into who is sending mail using your domain — including attackers.

Why the rollout has to be gradual

Jumping straight to p=reject without first monitoring your legitimate mail flow is a common and costly mistake — it can silently block real customer or vendor email that was never properly authenticated in your DNS. A responsible rollout moves from monitoring, to quarantine, to enforcement, correcting legitimate senders along the way.

Getting all three records right, and getting to full enforcement without breaking legitimate mail, is exactly the kind of ongoing work our Advanced Email Defense service manages.