SPF, DKIM, and DMARC Explained for Small Businesses

Updated October 22, 2026

SPF, DKIM, and DMARC are three DNS records that prove email from your domain is really from you. Without them, your email is more likely to land in spam, and criminals can more easily send email that appears to come from your business.

Since 2024, Google and Yahoo have required bulk senders to have all three, and they expect at least SPF or DKIM from everyone. Microsoft added similar requirements for high-volume senders in 2025. Even if you send only a few emails a day, setting them up properly improves delivery and protects your reputation.

What each one does

SPF: who’s allowed to send

A Sender Policy Framework record lists the services allowed to send email for your domain, like Microsoft 365, your email marketing platform, or your invoicing software.

Example for a business using Microsoft 365 only:

v=spf1 include:spf.protection.outlook.com -all

Common mistakes:

• More than one SPF record. You can have only one. Combine all services into a single record.
• Too many lookups. SPF allows at most 10 DNS lookups. Each “include” counts, and some include others. Exceed it and SPF fails.
• Forgetting a service. If your CRM or billing system sends as your domain, it needs to be in SPF (or set up with DKIM).

DKIM: a signature on each message

DomainKeys Identified Mail adds a cryptographic signature to each email, proving it wasn’t altered and was sent by an authorized service. Each sending service gives you DNS records to publish (often CNAME records).

In Microsoft 365, DKIM for your custom domain must be turned on in the Microsoft Defender portal after you publish the two CNAME records Microsoft gives you. Google Workspace generates a DKIM key in the Admin console that you add as a TXT record.

DMARC: what to do when checks fail

Domain-based Message Authentication, Reporting, and Conformance ties SPF and DKIM to the “From” address people see, tells receiving servers what to do with messages that fail, and sends you reports.

A DMARC record lives at _dmarc.yourdomain.com. A safe starting point:

v=DMARC1; p=none; rua=mailto:[email protected]

The p (policy) value has three settings:

• p=none: monitor only. Deliver everything, but send reports.
• p=quarantine: send failing messages to spam.
• p=reject: block failing messages.

How to roll it out safely

1. List every service that sends email as your domain. Microsoft 365 or Google Workspace, website contact forms, newsletter tools, CRM, invoicing, payroll, scanners and copiers, and your phone system’s voicemail-to-email.
2. Set up SPF with all of them in one record.
3. Turn on DKIM for each service that supports it.
4. Publish DMARC at p=none with a reporting address.
5. Read the reports for a few weeks. Raw DMARC reports are XML files that are hard to read, so use a free or low-cost DMARC report service to summarize them. Look for legitimate services that are failing, and fix them.
6. Move to p=quarantine, then later to p=reject once you’re confident everything legitimate passes.

Moving straight to p=reject without checking can silently block your own invoices or contact form submissions.

Domains you don’t send email from

Parked domains and old domains can be spoofed too. If a domain never sends email, publish:

v=spf1 -all

and a DMARC record with p=reject.

How to check your current setup

Free online tools from email security vendors can look up your domain and show what’s published. You can also open an email you sent to a Gmail account, choose “Show original,” and check whether SPF, DKIM, and DMARC show “PASS.”

If you’re not comfortable editing DNS, ask your IT provider. It’s a short job, and it’s one of the cheapest security improvements available.