SPF, DKIM and DMARC: how to protect a business email domain

Why does a company need SPF, DKIM and DMARC?

The three controls work together to reduce domain spoofing. SPF declares authorized sources, DKIM signs messages, and DMARC enforces alignment with the visible domain and defines what to do when authentication fails. They must be configured after all services that send mail have been inventoried.

Risks to review

• Publish multiple separate SPF records or exceed your query limits.
• Apply DMARC with rejection before identifying billing, CRM, forms, and other senders.
• Activate DKIM without correctly publishing your DNS records.
• Copy records from another company or invent values not delivered by the supplier.

Safe recommendations

1. Inventory Microsoft 365, Google Workspace, and every external service that ships with the domain.
2. Maintain a single SPF record that includes only authorized sources.
3. Generate and activate DKIM from the mail provider and publish exactly the indicated records.
4. Start DMARC in monitoring mode and review reports before advancing to quarantine or rejection.
5. Verify alignment and results in test message headers.
6. Document owner, DNS provider, changes, and revision date for each record.

When to seek specialized help

• The company uses multiple platforms for campaigns, billing, forms or notifications.
• Legitimate messages go to spam or show authentication failures.
• It is planned to move DMARC to quarantine or rejection without having analyzed reports.