SPF, DKIM and DMARC: a practical guide to email security

Why email authentication matters

• Fraud: phishing and invoice fraud often use a real company’s domain in the From address. Without DMARC enforcement, nothing tells the receiving server to refuse it.
• Deliverability: inbox providers trust authenticated mail. Unauthenticated email is more likely to be filtered as spam or rejected outright.
• Reputation: providers build a reputation for your domain from the mail it sends. Authentication ties that reputation to you, so spoofed mail can’t damage it and your good sending history counts.
• Visibility: DMARC reports show every service sending email as your domain, including ones you didn’t know about.

What the big inbox providers require

Since 2024, Gmail and Yahoo have required senders of more than 5,000 messages a day to their users to meet these rules, and Microsoft introduced similar requirements for Outlook.com in 2025:

• SPF and DKIM set up for the sending domain;
• a DMARC record, at least p=none, with SPF or DKIM aligned to the From domain;
• one-click unsubscribe in marketing email, with unsubscribes honoured within two days;
• a spam complaint rate kept well below 0.3%;
• valid forward and reverse DNS for sending servers, and TLS encryption.

Smaller senders benefit from the same rules: the requirements describe what good, trusted email looks like.

How the three work together

SPF: who is allowed to send

An SPF (Sender Policy Framework) record is a single TXT record on your domain listing every service that sends email for it: your own mail servers, your office email provider, and any platform that sends on your behalf, such as a CRM, helpdesk, billing system or email platform.

• One record only. A domain must have exactly one SPF record. Two records make SPF fail. Add new services to the existing record.
• Stay under 10 lookups. Each include, a, mx and redirect costs a DNS lookup, including the ones nested inside other includes. More than 10 makes SPF fail. Remove services you no longer use, and move bulk senders to their own subdomain.
• End with -all or ~all. -all (hard fail) says anything not listed is unauthorised. ~all (soft fail) is gentler while you’re still finding senders. Never use +all, which allows anyone.
• Know its limits. SPF checks the hidden envelope sender, not the From address your recipients see, and it normally fails when a message is forwarded. That’s why you need DKIM and DMARC as well.

DKIM: a signature on every message

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to the headers of each email. The sending service signs with a private key; you publish the matching public key in DNS. Receiving servers check the signature, which proves the message was authorised by the signing domain and hasn’t been changed in transit.

• Sign with your own domain. The signature’s domain (d=) should be your domain, not your provider’s. Only then does DKIM count towards DMARC.
• One selector per service. The selector (s1 above) lets each sending service have its own key, so you can change or remove one without affecting the others.
• Use 2048-bit keys where your DNS host and provider support them, and avoid 1024-bit keys for new set-ups.
• Rotate keys every 6 to 12 months, and straight away if a key may have been exposed. Publish the new selector before switching, then remove the old one.

DMARC: policy, alignment and reports

DMARC (Domain-based Message Authentication, Reporting and Conformance) ties SPF and DKIM to the From address people actually see. A message passes DMARC when SPF or DKIM passes and the domain that passed matches the From domain. This matching is called alignment. DMARC then tells receivers what to do with mail that fails, and asks them to send you reports.

A safe path to p=reject

1. List your senders. Find every system that sends email as your domain: office email, marketing, CRM, invoicing, helpdesk, website forms, scanners and devices.
2. Publish p=none with reports. Nothing is blocked, but within a day you start receiving reports.
3. Fix every legitimate sender. Add it to SPF and turn on DKIM signing with your domain. Read the reports for two to four weeks until all genuine mail passes.
4. Move to quarantine. Start with p=quarantine; pct=25 and increase to 100 while watching the reports.
5. Move to reject. Set p=reject. Mail that fakes your exact domain is now refused.
6. Keep watching. New services get added over time. Check reports regularly, and before you add a new sender, set up its SPF and DKIM first.

Protecting your sender reputation

Authentication proves who you are; reputation decides whether providers want your email. Both matter for reaching the inbox.

• Separate your streams. Send marketing from one subdomain (for example news.example.com) and transactional email from another (mail.example.com). A complaint-heavy campaign then can’t delay password resets or invoices.
• Warm up new domains and IP addresses. Start with small volumes to your most engaged recipients and increase gradually over a few weeks.
• Only email people who asked. Use confirmed opt-in for marketing, never buy lists, and make unsubscribing one click.
• Remove bounces and inactive recipients. Stop sending to addresses that hard bounce or complain, and stop marketing to people who haven’t opened or clicked in months.
• Watch your complaint rate. Keep spam complaints below 0.1%, and never let them reach 0.3%. Google Postmaster Tools and Microsoft SNDS show how providers see your domain.
• Be recognisable. Use a consistent From name and address, avoid link shorteners, and send email people expect. See transactional email template best practices.

Preventing spam and fraud

• Enforce DMARC. p=reject is the single most effective step against criminals using your exact domain.
• Lock down unused domains. For every domain or subdomain that doesn’t send email, publish the records below.
• Watch for lookalikes. DMARC doesn’t cover lookalike domains such as examp1e.com or example-billing.com. Register obvious variants and monitor new registrations that resemble your brand.
• Add your logo with BIMI. Once DMARC is at quarantine or reject, BIMI can show your verified logo next to your email in supporting inboxes. Gmail requires a verified mark certificate.
• Encrypt mail in transit. MTA-STS and TLS reporting make other servers use encrypted connections when sending to you, and tell you when that fails.
• Don’t put sensitive details in email. Send a notification that links to a secure portal instead. See digital letters.
• Train your staff to check the real sender address, not just the display name, and to verify payment changes by phone.

Add a null MX record (MX 0 .) to show the domain receives no email either.

Checklist

1. One SPF record per sending domain, listing every service, under 10 lookups, ending -all or ~all.
2. DKIM signing with your own domain on every service, using 2048-bit keys, rotated regularly.
3. A DMARC record with reporting, moved from p=none to p=reject once all genuine mail passes.
4. Separate subdomains for marketing and transactional email.
5. One-click unsubscribe, automatic bounce and complaint suppression, and a low complaint rate.
6. SPF -all, DMARC p=reject and a null MX on every domain that doesn’t send email.
7. Regular review of DMARC reports and provider reputation dashboards.

How everymessage helps

• Authenticated from the first send. Every sending domain on our business email platform is set up with SPF, DKIM and DMARC, and we help you add the records.
• Reputation protected automatically. Hard bounces, spam complaints and unsubscribes are suppressed, so you don’t keep emailing people who can’t or don’t want to receive it.
• Email to SMS checks too. Our email to SMS service only accepts mail that passes SPF, and can require DKIM, so nobody can send texts by faking your address.

Frequently asked questions