SPF, DKIM and DMARC Explained: Why Your Email Domain Needs Them

Email was never designed with sender verification in mind. Anything can be typed into the "From:" field of an outgoing message, and unless a domain has taken specific steps to prevent it, a receiving mail server has no way to tell the difference between a genuine email from your company and one forged by an attacker. That gap is exactly what SPF, DKIM and DMARC exist to close — and most businesses have never actually checked whether their domain has them configured correctly, let alone configured well.

Why Email Authentication Matters

Business email compromise and domain spoofing are not niche threats. An attacker who can send convincing mail "from" your domain can run invoice fraud against your own customers, impersonate your CEO or finance team internally, or launch phishing campaigns that damage a reputation your business spent years building — all without ever breaching your network. On top of the security risk, a poorly configured domain increasingly gets flagged or filtered by mailbox providers like Microsoft 365 and Gmail, hurting the deliverability of your own legitimate email.

Three DNS records — SPF, DKIM and DMARC — work together to solve this. Each does a different job, and having only one or two configured leaves real gaps.

SPF (Sender Policy Framework)

SPF is a DNS record that lists exactly which mail servers are authorized to send email on behalf of your domain. When another mail server receives a message claiming to be from you, it checks this list — if the sending server isn't on it, SPF has failed.

The most common mistake isn't a missing SPF record, it's a weak one. An SPF record ending in ~all (soft fail) tells receiving servers to flag unauthorized mail but still deliver it anyway. Only -all (hard fail) actually tells them to reject it outright — and a surprising number of business domains have never made that final change.

DKIM (DomainKeys Identified Mail)

DKIM works differently: it attaches a cryptographic signature to every outgoing message, generated with a private key your mail provider holds. The receiving server looks up the matching public key in your DNS records and verifies the signature — proving both that the message genuinely came from an authorized sender and that it wasn't altered in transit.

DKIM is also the hardest of the three to verify from the outside, because the DNS record lives under a provider-specific "selector" name rather than one fixed location. If you've never explicitly set it up with your email provider, it's worth confirming directly rather than assuming it's on by default.

DMARC (Domain-based Message Authentication, Reporting and Conformance)

DMARC is what actually ties SPF and DKIM together into an enforceable policy. It tells receiving mail servers exactly what to do when a message fails both checks — p=none just monitors and reports, p=quarantine sends failing mail to spam, and p=reject blocks it outright. DMARC also gives you visibility, through aggregate reports, into who is actually sending mail using your domain — including any spoofing attempts you'd otherwise never know about.

This is the record most businesses skip entirely, or leave sitting at p=none indefinitely "just to be safe." The problem is that p=none provides no actual protection — it's a monitoring stage, not a destination.

Beyond the Big Three: MTA-STS and BIMI

Two newer, optional layers round out a modern setup. MTA-STS enforces encrypted delivery for incoming mail, closing off downgrade and interception attacks that older SMTP traffic is otherwise exposed to. BIMI lets your verified brand logo appear next to your emails in supporting inboxes — a nice trust signal, but only available once DMARC is actually enforcing a reject or quarantine policy.

Check Your Own Domain in 10 Seconds

Rather than digging through DNS records by hand, we built a free Email Security Checker that looks up SPF, DKIM, DMARC, MTA-STS and BIMI for any domain and grades the result A through F, with a plain-English explanation of exactly what's missing or misconfigured. It takes one domain name and a few seconds — worth running against your own business today, and against any domain sending you an unusually urgent invoice or wire request.

Getting It Configured — and Kept That Way

Turning on strict enforcement isn't something to do blindly — moving straight to a DMARC reject policy without first reviewing aggregate reports can silently block legitimate mail from a marketing platform or CRM you forgot was sending on your behalf. Decoding IT's managed cybersecurity services include getting SPF, DKIM and DMARC configured correctly from the start, monitoring the reports, and tightening enforcement in step with what those reports actually show — rather than guessing.

Decoding IT is a Muscat-based IT solutions provider helping businesses across Oman lock down their email domains against spoofing and impersonation. Contact our team to have your domain reviewed properly.