Email, cloud & backup
SPF, DKIM and DMARC explained: stop scammers sending email as your business
Without a few DNS records, anyone can send an email that appears to come from your business address. Scammers use this to send fake invoices to your customers. SPF, DKIM and DMARC are three settings that tell the rest of the internet which email is really yours. They’re free, and most businesses can set them up in an afternoon.
The short version
In short
- SPF lists the services allowed to send your email.
- DKIM adds a digital signature to your messages.
- DMARC tells receivers what to do with fakes, and sends you reports.
- Start DMARC in monitoring mode, then tighten it.
What each record does
| Record | Plain-English job | Analogy |
|---|---|---|
| SPF | Lists the mail servers and services allowed to send email for your domain | A guest list at the door |
| DKIM | Adds a cryptographic signature proving the message came from your domain and wasn’t changed | A wax seal on a letter |
| DMARC | Tells receiving servers what to do if a message fails SPF and DKIM checks, and sends you reports | The instructions to the door staff |
They work best together. On their own, SPF and DKIM help, but DMARC is what actually tells Gmail, Outlook and others to reject fakes.
Why it matters now
- It stops scammers easily sending email that looks like it’s from your exact domain.
- Email providers increasingly expect it. Google and Yahoo require bulk senders to have SPF, DKIM and DMARC, and messages from domains without them are more likely to land in spam.
- The ASD recommends all organisations implement all three.
Setting it up
List everything that sends email for you
Your email platform (Microsoft 365 or Google Workspace), plus things people forget: your website’s contact form, newsletter tool, CRM, accounting software sending invoices, booking system and helpdesk.
Set up SPF
Add one SPF TXT record in your domain’s DNS that includes each sending service. Your email provider and each tool’s help pages give you the exact text. You can only have one SPF record per domain, so combine entries rather than adding several.
Turn on DKIM
In Microsoft 365 or Google Workspace, enable DKIM signing and add the DNS records they give you. Do the same for other services that send on your behalf, like your newsletter tool.
Add DMARC in monitoring mode
Add a DMARC record with a policy of p=none and a reporting address. This changes nothing about delivery but sends you reports showing who is sending email using your domain.
Read the reports for a few weeks
Reports are hard to read raw. A free or low-cost DMARC reporting service turns them into something readable. Look for legitimate services that are failing, and fix their SPF or DKIM.
Tighten the policy
Once your legitimate email passes, move to p=quarantine (failures go to spam), and then p=reject (failures are refused).
Don’t jump straight to reject
If you set DMARC to reject before every legitimate service is configured, your own invoices or website enquiries may stop arriving. Monitoring first avoids that.
Domains you don’t send email from
If you own extra domains that never send email, protect them too, with an SPF record that allows nothing and a DMARC policy of reject. Otherwise scammers can use them freely.
Checking your setup
- Send a test email to a Gmail account, open it, and choose Show original. You’ll see whether SPF, DKIM and DMARC passed.
- Use a reputable online DMARC or DNS checker to review your records.
Train your team
Spot a phishing email is a free NovaSoft Labs course with six fictional scenarios and an explanation for every answer. It covers lookalike senders and the checks that catch them. Pass it to print a completion certificate.
Common questions
Will this stop all phishing that mentions my business?
No. It stops email pretending to come from your exact domain. Scammers can still use look-alike domains or hacked accounts, so payment verification rules remain essential.
Who should set this up?
Whoever manages your DNS and email, often your IT provider or web host. It’s technical but not complicated.
Do we need to do anything after it’s set up?
Update SPF and DKIM whenever you add a new service that sends email for you, and glance at DMARC reports occasionally.
Sources
This guide is general information, not legal or financial advice. If you think you’ve lost money or personal information, contact your bank and the services named above straight away.
Keep reading
Related help
Talk to NovaSoft
Want a hand with this at work?
These guides are free to use. If your business wants help putting the checks, accounts and devices in place, our team can do it with you.