Email is one of the most important communication tools used by businesses, but how does somebody receiving an email know that it genuinely came from you?
Unfortunately, simply seeing your company name and email address in the “From” field isn’t enough.
Cybercriminals can attempt to spoof a business domain, making a fraudulent email appear as though it has been sent by a legitimate organisation.
This is where SPF, DKIM and DMARC come in.
These three email authentication technologies work together to help protect your domain, improve email deliverability and make it harder for criminals to impersonate your business.
What Is Email Spoofing?
Email spoofing is when somebody sends an email that appears to originate from another person or organisation.
For example, an attacker could attempt to send an email that appears to come from:
accounts@yourcompany.co.uk
The message might ask a customer to pay an invoice into a different bank account or encourage an employee to open a malicious attachment.
Without the correct email authentication in place, receiving email systems have fewer ways to determine whether that message genuinely came from your organisation.
What Is SPF?
SPF, or Sender Policy Framework, tells receiving email providers which servers are authorised to send email on behalf of your domain.
Think of it as an approved sender list.
If your organisation uses Microsoft 365, an email marketing platform and another cloud service that sends emails, your SPF record can identify those authorised systems.
When an email arrives, the recipient’s email provider can check whether it came from an approved source.
If it didn’t, that can be treated as a warning sign.
What Is DKIM?
DKIM, or DomainKeys Identified Mail, adds a digital signature to outgoing emails.
The receiving email server can check this signature against information published within your domain’s DNS records.
If everything matches, it provides evidence that:
- The email was sent by an authorised system
- The message hasn’t been altered in transit
- The sender is legitimately associated with the domain
You can think of DKIM as placing a tamper-resistant digital seal on an email.
What Is DMARC?
DMARC, or Domain-based Message Authentication, Reporting and Conformance, brings SPF and DKIM together.
DMARC allows your organisation to tell receiving email systems what they should do when a message claiming to come from your domain fails authentication.
Depending on the policy you configure, suspicious emails can potentially be:
- Monitored
- Sent to spam or quarantine
- Rejected completely
DMARC can also provide reports showing which systems are sending email using your domain.
These reports can help identify legitimate services that need configuring as well as potential attempts to impersonate your business.
Why Do SPF, DKIM and DMARC Matter?
There are two major reasons: security and deliverability.
Protect Your Business From Impersonation
Your domain is part of your company’s identity.
If criminals can easily send convincing emails pretending to be your organisation, they may target your employees, customers and suppliers.
SPF, DKIM and DMARC make domain impersonation more difficult and give receiving email providers more information to identify fraudulent messages.
Help Your Emails Reach the Inbox
Email providers increasingly expect legitimate businesses to authenticate their email.
Google recommends setting up SPF, DKIM and DMARC, and requires stronger authentication from organisations sending large volumes of email to Gmail users.
Microsoft has also introduced SPF, DKIM and DMARC requirements for domains sending more than 5,000 emails per day to Outlook.com consumer addresses.
Even if your business doesn’t send thousands of emails each day, correctly configuring email authentication is a sensible step towards protecting your reputation and helping legitimate messages reach their destination.
Isn’t Microsoft 365 Already Secure?
Microsoft 365 provides many security features, but simply using Microsoft 365 does not automatically mean every aspect of your domain’s email authentication is configured correctly.
Your organisation may also have other platforms sending email on its behalf.
These could include:
- Email marketing platforms
- CRM systems
- Website contact forms
- Accounting systems
- Helpdesk platforms
- Booking systems
- E-commerce websites
- Automated applications
All of these systems need to be considered when configuring your domain.
A poorly configured change can result in legitimate emails being rejected, so SPF, DKIM and DMARC should be implemented carefully.
What Happens If DMARC Is Configured Incorrectly?
DMARC isn’t something businesses should simply switch to its strictest setting without checking their email environment first.
Imagine your marketing platform legitimately sends emails as your business but hasn’t been correctly authenticated.
If a strict DMARC policy is enabled immediately, those genuine emails could potentially be rejected.
A sensible implementation normally involves identifying all authorised email sources, configuring SPF and DKIM correctly, monitoring DMARC reports and then gradually strengthening the DMARC policy.
The objective is to block fraudulent email without blocking your own.
Does My Business Need DMARC?
If your business uses its own domain for email, implementing proper email authentication is increasingly considered good practice.
It is particularly worth reviewing if:
- You use Microsoft 365
- You send marketing emails
- Multiple systems send email using your domain
- You regularly send invoices by email
- Your organisation handles sensitive information
- Customers rely heavily on email communication
- You’re unsure whether SPF, DKIM or DMARC are configured
You don’t need to be a large organisation to be impersonated.
For a criminal, successfully convincing just one customer or employee that a fraudulent email came from your business may be enough.
How Sitesi Can Help
Email authentication can quickly become complicated, particularly when several different services are sending email using the same domain.
Sitesi can help businesses review their email and DNS configuration and ensure services are properly authenticated.
We can assist with:
- SPF configuration
- DKIM configuration
- DMARC implementation
- Microsoft 365
- Domain and DNS management
- Email deliverability
- Email marketing
- Cybersecurity
- Managed IT support
We can also help identify which systems are currently sending email on behalf of your organisation before making changes.
Is Your Business Email Properly Protected?
Your domain represents your business every time you send an email.
SPF, DKIM and DMARC help prove that legitimate emails really came from you while making it harder for criminals to successfully impersonate your organisation.
With email providers placing increasing importance on authentication, now is a good time to check whether your domain is configured correctly.
Not sure whether your SPF, DKIM and DMARC records are set up properly? Speak to Sitesi and we can review your business email configuration and help strengthen your domain’s email security.
Frequently Asked Questions
SPF identifies which servers are authorised to send email on behalf of your domain.
DKIM adds a digital signature to outgoing email, allowing receiving servers to verify that a message genuinely came from an authorised sender and hasn’t been modified.
DMARC uses SPF and DKIM to help determine whether an email claiming to come from your domain is legitimate and tells receiving servers how failed messages should be handled.
Businesses using Microsoft 365 should consider configuring all three as part of a properly secured email environment, particularly where other services also send email using the company’s domain.
Yes. Sitesi can review your current email configuration and help implement SPF, DKIM and DMARC while accounting for the different systems that legitimately send email on behalf of your business.