SPF, DKIM and DMARC Explained for Small Businesses

If customers tell you your emails end up in their spam folder, or someone has received a fake invoice that looked like it came from your company, the cause is often the same: your domain isn't proving that its email is genuine. Three records fix that. They have unfriendly names (SPF, DKIM and DMARC), but the idea behind them is simple.

This article explains what each one does, why the large email providers now expect them, and how to set them up without breaking your own email.

Why email needs proof at all

Email was designed decades ago without any built-in way to check who sent a message. Anyone can put any address in the "From" line, the same way anyone can write any return address on an envelope. Criminals use this to send invoices, payment changes and password-reset messages that appear to come from businesses their victims trust.

SPF, DKIM and DMARC let the receiving email system check whether a message claiming to be from your domain really came from you, and tell it what to do if it didn't.

SPF: who is allowed to send for you

SPF (Sender Policy Framework) is a list, published in your domain's DNS, of the services allowed to send email using your domain. A typical small business might list Microsoft 365 or Google Workspace, plus a newsletter tool, an invoicing system or a website contact form.

When a message arrives, the receiving server checks whether it came from one of the services on your list. The most common SPF mistakes we see are forgetting a service that sends on your behalf (so its messages fail), and having two separate SPF records, which makes the whole check invalid.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a digital signature to every message your email platform sends. The matching public key is published in your DNS. The receiving server uses it to confirm two things: the message really was sent by a system authorized for your domain, and nobody changed it along the way.

Microsoft 365 and Google Workspace both support DKIM, but it usually has to be turned on and the records added to your DNS. Many businesses that have used Microsoft 365 for years have never enabled it.

DMARC: the policy that ties it together

DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receiving servers what to do when a message claiming to be from your domain fails SPF and DKIM. It has three possible policies:

• p=none: monitor only. Deliver the message as usual, but send me a report.
• p=quarantine: send failing messages to spam.
• p=reject: refuse failing messages outright.

DMARC also sends you regular reports showing who is sending email using your domain. That's how you discover the forgotten newsletter tool, or someone impersonating you.

Why it matters more now

The large mailbox providers have started to require authentication. Since February 2024, Google requires anyone sending around 5,000 or more messages a day to personal Gmail accounts to pass SPF and DKIM and publish a DMARC record, and it began stepping up enforcement against non-compliant mail in November 2025 (Google Workspace Admin Help). Other large providers have moved in the same direction.

Most small businesses send far less than that, but the trend is clear: properly authenticated email is treated as more trustworthy, and unauthenticated email is treated with suspicion.

How to set them up without breaking your email

1. List every service that sends email as your domain. Your email platform, marketing tools, invoicing and accounting software, your website forms, your phone system and any scanners or copiers that email documents.
2. Publish one correct SPF record that includes all of them.
3. Turn on DKIM in Microsoft 365 or Google Workspace, and in any other service that supports it.
4. Publish a DMARC record at p=none with an address to receive reports.
5. Read the reports for a few weeks and fix any legitimate service that's failing.
6. Move to p=quarantine, then p=reject once everything legitimate passes.
7. Re-check whenever you add a new tool that sends email, so it doesn't start landing in spam.

The jump from step 4 to step 6 is where people get into trouble. Moving straight to a strict policy without reading the reports is the fastest way to have your own invoices rejected.

How CyberArm can help

We set up and maintain SPF, DKIM and DMARC as part of our Microsoft 365 and Google Workspace administration, and as a one-time Email Security Overhaul project for businesses that just want it done right. We find every service that sends as your domain, publish the records, read the DMARC reports and tighten the policy step by step, so your email gets delivered and impersonators get blocked.

The bottom line

SPF, DKIM and DMARC are some of the cheapest security improvements a small business can make, and they help your legitimate email get delivered too. If you don't know whether your domain has them, or whether they're set up correctly, our free IT and security assessment checks your email and sign-in security and gives you a written Executive Summary with the fixes that matter most.