SPF, DKIM and DMARC, explained without the jargon

Published 2026-08-25

Anyone can attempt to send an email that claims to be from your domain. Whether the receiving mail server believes them depends on three DNS records, and most small businesses have zero, one, or a badly configured version of all three.

What each record actually does

SPF is a published list of the mail servers allowed to send as your domain. DKIM attaches a cryptographic signature to outgoing mail so the receiver can verify it was not altered in transit and did come from a server you authorized. DMARC ties the two together with a policy telling receivers what to do when a message fails both, plus a reporting address so you can see who has been sending mail as you.

Why partial setup is the most common problem

SPF alone does not stop someone from spoofing your display name in a way many inboxes still show as legitimate. DKIM alone does not stop a lookalike domain. Each record closes a different gap, and a business with only one of the three has a false sense of coverage.

The safe rollout order

Publish SPF first, listing every real sending source: your mail provider, your invoicing tool, your helpdesk software, your marketing platform, anything that sends as your domain. Add DKIM signing through your mail provider next. Then publish DMARC starting at p=none with a reporting address, and actually read the reports for two weeks before tightening anything.

What breaks if you skip straight to enforcement

Moving directly to p=reject without the reporting period is how legitimate mail starts bouncing. Most businesses discover mid-rollout that a tool they forgot about, such as an old marketing platform or a scanner that emails PDFs, has been sending as their domain the entire time. The reporting period at p=none is what surfaces that before customers stop receiving real invoices.

Who this actually protects

It protects the people receiving mail that claims to be from you, which is your customers, your vendors and your own staff, from a message that looks legitimate but is not. It also protects your own deliverability, since mail providers increasingly deprioritize domains with no authentication at all.