DMARC, SPF, and DKIM: Stop Criminals From Spoofing Your Domain
One of your customers gets an email. The From line says your company. The signature block is yours. The invoice looks right, except the bank details are new. They pay it, and the money is gone. You never sent that email — but as far as your customer is concerned, you did.
That works because plain email has no built-in proof of identity. Anyone can type anything into the From line. SPF, DKIM, and DMARC are the three DNS records that close that hole.
SPF: who is allowed to send as you
SPF (Sender Policy Framework) is a text record in your DNS listing the servers and services allowed to send mail using your domain. Receiving servers look it up and check whether a message actually came from one of them.
The hard part is not the syntax, it is the inventory. Most businesses send legitimate mail from more places than they realize: Microsoft 365 or Google Workspace, a marketing platform, invoicing software, a CRM, and the copier that emails scans. Miss one and its mail starts failing.
DKIM: a tamper-evident signature
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message as it leaves your mail platform, and the matching public key lives in your DNS. The receiving server checks it and learns two things: the message was signed by a system holding your private key, and it was not altered in transit. Enabling it is usually a few clicks in a modern mail tenant plus a couple of DNS entries; use 2048-bit keys where supported, and rotate them periodically.
DMARC: the policy that makes the other two count
SPF and DKIM report results. DMARC decides what happens next. Your DMARC record tells receiving servers what to do when a message claiming to be from your domain fails authentication — do nothing, send it to junk, or reject it outright.
DMARC also adds alignment, the piece that actually stops spoofing. It requires the domain that passes SPF or DKIM to match the domain your recipient sees in the From line. Without it, an attacker can pass SPF for a throwaway domain while still displaying yours.
The second half of DMARC is reporting. Add a reporting address and mailbox providers send you regular summaries of who is sending as your domain and whether it passed — which is how you find both your forgotten legitimate senders and the people abusing your name.
The rollout path: none, then quarantine, then reject
Do not publish a rejection policy on day one; you will block your own payroll notifications. The safe sequence:
- p=none with reporting. Nothing changes for recipients. You collect several weeks of reports and build a real list of every system sending as you.
- Fix the legitimate senders. Add them to SPF, enable DKIM signing where the vendor supports it, and retire anything that should not be sending.
- p=quarantine. Failing mail goes to junk instead of the inbox. Keep watching the reports.
- p=reject. Spoofed mail is refused at the door. This is where the protection actually lives.
Cover your subdomains too, including ones you never send from — attackers like them because nobody is watching.
Deliverability improves too
Major mailbox providers have spent years tightening requirements on senders, and authentication is now table stakes. Domains with clean records get the benefit of the doubt; domains without them get filtered, and the owner usually blames the marketing platform. If your quotes and newsletters keep landing in junk, start here.
Misconfigurations we find constantly
- Two SPF records. A domain may publish only one; a second invalidates both.
- Too many DNS lookups. SPF has a hard lookup limit, and stacking vendor includes blows past it. The record then fails for everyone.
- DKIM enabled but never verified. The tenant switch is on, the DNS selectors were never published, and signing silently does nothing.
- Reports nobody reads. A DMARC record pointing at an abandoned mailbox is decoration.
- Stuck at p=none. Monitoring mode blocks exactly zero spoofed messages. A starting point, not a destination.
One honest limitation: DMARC protects the domain you own. It does not stop a lookalike domain or an attacker changing their display name to your CEO. Those need training, external-sender warnings, and lookalike domain monitoring.
Equal Tech Solutions handles email authentication end to end — inventory your senders, fix SPF and DKIM, publish DMARC, watch the reports, and walk the policy up to reject without breaking your mail.
If you are not sure whether someone could send mail as your domain today, that is worth an hour. Equal Tech Solutions serves Chattanooga, Cleveland, and the Southeast US. Contact Equal Tech Solutions and we will tell you straight where you stand.