SPF, DKIM and DMARC Explained in Plain Language
How three small DNS records protect your email from being faked.
If you have ever received an email that looked like it came from your bank but did not, you have seen email spoofing. Email was designed in a time when everyone trusted everyone, so by default anybody can write any name in the 'From' line. Three DNS records help receiving mail servers decide whether a message is genuine: SPF, DKIM and DMARC.
SPF, short for Sender Policy Framework, is a list published in your domain's DNS of the servers allowed to send email for you. When a message arrives, the receiving server checks whether the sending server is on that list. A record ending in -all says that anything not on the list should be rejected, while ~all means it should be treated with suspicion.
DKIM, short for DomainKeys Identified Mail, adds a digital signature to each outgoing message. The matching public key is published in DNS. If the message is changed on the way, the signature no longer matches, so the receiver knows it was tampered with. Email providers such as Google Workspace and Microsoft 365 give you the exact DKIM record to add.
DMARC ties the two together. It tells receiving servers what to do when a message fails SPF and DKIM checks, and it sends you reports about who is sending mail using your domain. A DMARC policy of none only monitors, quarantine sends failing mail to spam, and reject blocks it completely.
The usual way to roll these out is in steps. First publish SPF and turn on DKIM with your provider. Then add a DMARC record with the policy set to none and read the reports for a few weeks to find legitimate senders you forgot, such as a newsletter tool or a billing system. Once everything that should pass does pass, move the policy to quarantine and finally to reject.
Setting these records takes less than an hour for most small organizations, costs nothing, and makes it much harder for criminals to send convincing emails in your name. If your domain does not have them yet, it is one of the most useful security tasks you can finish this week.