SPF, DKIM and DMARC explained: stop others sending email in your name
5 min read · Updated on 19 October 2026
Without the right DNS records, anyone can send an email that appears to come from your domain. Fraudsters use that for fake invoices and phishing in your name. Four records prevent it.
What do they do?
- SPF: a list of the services allowed to send email on behalf of your domain, for example Microsoft 365 and your newsletter service.
- DKIM: a digital signature on every outgoing email, so the recipient can see it really comes from you and wasn't changed on the way.
- DMARC: your instruction to receivers on what to do with email that fails SPF or DKIM (nothing, quarantine or reject), plus reports on who sends in your name.
- MTA-STS and TLS-RPT: make sure email to you is always delivered encrypted, and that you're told when that fails.
In this order
- List every service that sends email on behalf of your domain: your mailbox, accounting, newsletter, website.
- Publish one SPF record with all those services, ending with -all or temporarily ~all.
- Enable DKIM for every service that sends email. For Microsoft 365 you do this in the Defender portal.
- Set DMARC to p=none first with a reporting address, and watch for a few weeks who sends in your name.
- If everything checks out, move to p=quarantine and then to p=reject.
- Optional: MTA-STS and TLS-RPT for encrypted delivery.
Checking
With the free security check on this site you can see in a few seconds whether SPF, DKIM, DMARC and MTA-STS are set up correctly, together with DNSSEC and the security of your website.
Common mistakes
- Two SPF records: then SPF doesn't work at all. Merge them.
- Staying on p=none too long: you get reports, but fake email still arrives.
- Forgetting a new service that sends email (a web shop, a survey tool) in SPF and DKIM, so its email no longer arrives after p=reject.