Cyber security
Email security: SPF, DKIM, DMARC and what they do not protect you from
SPF, DKIM and DMARC are three DNS-based standards that together let receiving mail servers verify that a message genuinely came from your domain and decide what to do when it did not. Implemented properly they largely eliminate domain spoofing and materially improve deliverability. They do not stop phishing from lookalike domains, and they do nothing at all against an attacker sending from a genuinely compromised mailbox — which is the most damaging email attack small businesses face.
Key facts
- SPF publishes which servers may send mail for your domain; it has a hard limit of 10 DNS lookups.
- DKIM adds a cryptographic signature that survives forwarding better than SPF does.
- DMARC tells receivers what to do when SPF and DKIM fail, and sends you reports.
- DMARC has three policies: none (monitor), quarantine (send to junk), reject (refuse delivery).
- DMARC requires alignment — the authenticated domain must match the visible From domain.
- Major mailbox providers now require authentication for bulk senders, making enforcement effectively mandatory.
- None of the three prevents phishing from a similar-looking domain you do not control.
What each record actually does
SPF is a published list of the servers permitted to send email for your domain. A receiving server checks the sending IP against that list. Its main weaknesses are that it breaks when mail is forwarded, and that it permits a maximum of ten DNS lookups — a limit small businesses exceed surprisingly easily once Microsoft 365, a CRM, an invoicing tool and a marketing platform are all included.
DKIM attaches a cryptographic signature to outgoing mail using a private key, with the public key published in DNS. The receiver verifies the signature. Because the signature travels with the message, DKIM survives forwarding where SPF does not.
DMARC ties the two together and adds the decision. It tells receiving servers what to do when a message fails both checks, and requires alignment: the domain that passed authentication must match the domain the recipient sees in the From field. Without DMARC, a message can pass SPF for an attacker's own domain while displaying yours. DMARC also produces aggregate reports showing who is sending mail claiming to be you, which is often the first time a business discovers a forgotten system sending on its behalf.
Getting to enforcement without breaking your mail
The reason so many domains sit at p=none for years is fear of blocking legitimate mail, and that fear is justified if you skip the staged approach. Do it properly and the risk is small.
Publish SPF and DKIM first and confirm both pass for every legitimate sending source — your mail platform, your CRM, your accounting system, your marketing tool, your website contact form. Then publish DMARC at p=none with a reporting address and leave it for several weeks. Read the aggregate reports: they will show sending sources you had forgotten, and there is almost always at least one.
Fix the failures, then move to p=quarantine with a low percentage and increase it as confidence grows. Finally move to p=reject. Two to three months from start to enforcement is a realistic pace for a small business. Rushing to p=reject on day one is how invoices stop arriving.
- Inventory every system that sends email as your domain
- Publish SPF covering all of them, watching the 10-lookup limit
- Enable DKIM signing on every platform that supports it
- Publish DMARC at p=none with a reporting address
- Read the reports for several weeks and fix what fails
- Move to p=quarantine, then to p=reject
The attacks this does not stop
Lookalike domain phishing is untouched by any of it. An attacker registers a domain that differs from yours by one character, or swaps .co.uk for .com, and sends from there. That domain has perfectly valid SPF, DKIM and DMARC records of its own — because the attacker set them up correctly. Authentication proves a message came from the domain it claims; it cannot tell the recipient that the domain is not yours.
Compromised account sending is the other, and it is the serious one. If an attacker is inside your mailbox, their messages are authenticated because they are genuine. Every check passes. This is the mechanism behind business email compromise, and no amount of DNS configuration addresses it.
The mitigations for those two are different in kind: register the obvious lookalike variants of your domain, apply external sender warnings, use impersonation protection for your key names, and — for the compromise case — strong MFA, blocked external forwarding, alerting on inbox rules, and a payment verification procedure that does not rely on email.
Deliverability: the reason this gets prioritised
Security is the reason to implement email authentication; deliverability is usually the reason it gets budget. Major mailbox providers have tightened their requirements substantially, and unauthenticated mail is increasingly junked or refused outright, particularly for higher-volume senders.
If your invoices and quotes are landing in customers' junk folders, missing or broken authentication is the first thing to check — ahead of content, subject lines and sending patterns. Check your domain and IP reputation too, and make sure any marketing platform you use signs with your domain rather than its own.
Keep it maintained
Email authentication is not a one-off task. Every new SaaS tool that sends on your behalf needs adding to SPF and, where supported, DKIM signing. Every tool you stop using should be removed, because a stale SPF entry authorises a platform you no longer control.
Keep reading DMARC aggregate reports, at least monthly. They are the only mechanism that tells you when something has changed — a new sender, a misconfigured platform, or someone attempting to use your domain.
What businesses most often get wrong
- Sitting at p=none for years and calling DMARC 'implemented'
- Jumping straight to p=reject and blocking legitimate invoices
- Exceeding the 10-lookup SPF limit, which silently invalidates the record
- Forgetting the CRM, invoicing tool or website form when inventorying senders
- Believing DMARC protects against lookalike domains or compromised mailboxes
- Never reading the aggregate reports, which is where the useful information is
Where AlwaysOnIT fits — and doesn't
We will diagnose SPF, DKIM and DMARC problems with you, read your aggregate reports and tell you exactly which records to change and why — including where you are over the SPF lookup limit. We do not have access to your DNS and we do not make DNS changes on your behalf; you or your domain provider apply them. We publish that limit rather than implying we can fix it for you.
Frequently asked questions
Email security — common questions
What is the difference between SPF, DKIM and DMARC?
SPF lists which servers may send mail for your domain. DKIM cryptographically signs messages so the receiver can verify they were not altered and genuinely came from you. DMARC ties both to the visible From address, tells receivers what to do when checks fail, and sends you reports. All three are DNS records and all three are needed.
Does DMARC stop phishing?
It stops attackers sending mail that appears to come from your exact domain. It does not stop phishing from lookalike domains the attacker owns and has configured correctly, and it does not stop messages sent from a genuinely compromised mailbox on your own domain — that message is authentic and passes every check.
Why is my business email going to spam?
The most common cause is missing or broken email authentication. Check that SPF covers every system sending as your domain and does not exceed the 10-lookup limit, that DKIM signing is enabled on each platform, and that DMARC is published with alignment. After that, check domain and IP reputation, and whether a marketing platform is sending with its own domain rather than yours.
What DMARC policy should a small business use?
The goal is p=reject, reached in stages. Start at p=none with a reporting address for several weeks to discover every legitimate sender, fix the failures, move to p=quarantine, then to p=reject. Two to three months is a sensible timeline; going straight to reject risks blocking mail you depend on.
Do I need email authentication if I only send a few emails a day?
Yes. Volume affects deliverability enforcement, but spoofing protection matters at any size — arguably more for a small business, because an attacker forging a five-person company's domain to its own clients is both easy and effective. The records take under an hour to publish.
Read next
Business email compromise: how the invoice fraud actually works
How business email compromise and invoice redirection fraud work in practice, the warning signs, the controls that stop it, and what to do in the first hour.
Microsoft 365 security: the settings that actually reduce risk
A practical Microsoft 365 security baseline for small businesses: MFA, legacy authentication, admin separation, mailbox auditing, external forwarding and Defender settings.
Small business cyber security: a realistic first-year plan
A prioritised, realistic cyber security plan for UK small businesses: what to do in the first week, the first quarter and the first year, and what to ignore.
Get started
Open a chat. The AI picks up before the second ring — every time.
No onboarding calls. No sales process. Connect your devices and start raising tickets in under ten minutes.