SPF, DKIM and DMARC: A Plain-English Email Security Guide for Small Businesses

If your invoices land in a client's spam folder, or a customer gets an email that looks like it came from you but didn't, the cause is often the same: your domain's email authentication isn't set up correctly. Three DNS records, SPF, DKIM and DMARC, tell the rest of the internet which email really comes from your business. Here's what each one does, why the big mailbox providers now expect them, and how to roll them out safely.

Why this matters now

Email was designed without any built-in way to prove who sent a message. That's why it's so easy for criminals to send a fake invoice "from" your accounting firm or a wire-change request "from" a law office's managing partner. SPF, DKIM and DMARC were created to close that gap.

The major mailbox providers have also started enforcing them. Google's email sender guidelines require everyone who sends to personal Gmail accounts to set up SPF or DKIM, and require bulk senders (more than 5,000 messages a day to Gmail) to use SPF, DKIM and DMARC together. Google says unauthenticated messages "might be marked as spam or rejected." Microsoft has set similar requirements for Outlook.com: high-volume senders must pass SPF and DKIM, publish a DMARC record and pass DMARC alignment.

Most small businesses don't send 5,000 emails a day. But Google still recommends that every domain set up all three, and the same records that keep your mail out of spam folders also make it much harder for someone to impersonate you.

SPF: who is allowed to send for you

SPF (Sender Policy Framework) is a single DNS record that lists the servers and services allowed to send email for your domain. When a message arrives claiming to be from you, the receiving server checks that list.

The common small-business problem is an incomplete SPF record. Your main mailbox might be Microsoft 365 or Google Workspace, but you may also send email from a newsletter tool, a CRM, your practice-management or accounting software, a website contact form, or a copier that scans to email. If any of those aren't listed, their messages are more likely to be marked as spam.

Two other rules trip people up:

• A domain should have only one SPF record. Each new service gets added to that record, not published as a second one.
• SPF has a limit of 10 DNS lookups. A record stuffed with includes can quietly break.

DKIM: a tamper-evident signature

DKIM (DomainKeys Identified Mail) adds a digital signature to every outgoing message. The matching public key is published in your DNS, so receiving servers can confirm the message really came from your domain and wasn't changed along the way.

Microsoft 365 and Google Workspace both support DKIM, but it often has to be turned on by an administrator. Each third-party sending service usually needs its own DKIM setup too. Google recommends a 2048-bit key where your provider supports it.

DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when a message claiming to be from you fails the checks. It also requires alignment: the domain that passes SPF or DKIM has to match the domain in the visible "From" address. That's what stops someone from passing SPF with their own domain while displaying yours.

A DMARC record has three main policy settings:

• p=none: monitor only. Nothing is blocked, but you start receiving reports.
• p=quarantine: failing messages go to spam or junk.
• p=reject: failing messages are refused outright.

DMARC also sends you aggregate reports showing every source that sends email using your domain. Those reports are how you find the forgotten scanner, the old marketing tool, or someone spoofing you.

A safe rollout plan

Jumping straight to p=reject is the fastest way to block your own invoices. A safer order:

1. Inventory your senders. List every system that sends email as your domain: your mailbox provider, marketing and CRM tools, billing and scheduling software, website forms, and devices.
2. Fix SPF. Publish one SPF record that includes every legitimate sender and stays under the lookup limit.
3. Turn on DKIM in your mailbox provider and in each third-party service.
4. Publish DMARC at p=none with a reporting address, and read the reports for a few weeks.
5. Fix anything that fails, then move to p=quarantine and eventually p=reject once legitimate mail passes consistently.
6. Recheck whenever you add a tool. New software that sends email has to be added to SPF and DKIM before it goes live.

What it means for your industry

• Law firms and CPA firms are frequent targets of payment-redirection and wire-fraud emails. DMARC at enforcement makes it much harder to send convincing fakes from your exact domain. Pair it with a rule that payment changes are always confirmed by phone.
• Medical and dental offices send appointment reminders and billing statements through third-party systems that are easy to leave out of SPF and DKIM. When they fail, patients miss messages.
• Aerospace and manufacturing suppliers exchange quotes, purchase orders and drawings with primes and vendors. Spoofed messages from a supplier's domain are a common phishing lure, and authentication protects your reputation with customers.

What authentication doesn't do

SPF, DKIM and DMARC protect your domain from being impersonated. They don't stop look-alike domains (like a swapped letter in your company name), and they don't stop a criminal who has stolen a real employee's password. You still need multi-factor authentication, email filtering and staff who know the warning signs of phishing.

Let us check your domain

Integrity Tech helps businesses in Rancho Cucamonga and across the Inland Empire set up and monitor SPF, DKIM and DMARC as part of our managed IT and cybersecurity services. We'll inventory your senders, fix your records, read the DMARC reports and move you to enforcement without disrupting your email. Contact us for a free email security review.