Someone sending email in your domain’s name is one of the most common techniques behind phishing and payment fraud. Three mechanisms work together to prevent it — SPF, DKIM and DMARC — each configured in your domain’s DNS.
SPF — who is allowed to send?
SPF (Sender Policy Framework) publishes, as a DNS TXT record, which servers may send mail for your domain. Receiving servers compare the sender’s IP address against that list. Keep in mind the 10-DNS-lookup limit during SPF evaluation: adding many services can push the record over the limit and make the check fail.
DKIM — the message was not altered
DKIM (DomainKeys Identified Mail) adds a digital signature to each message. The public key is published in DNS under selector._domainkey, and the receiving server verifies the signature to confirm the message really comes from your domain and was not modified in transit.
DMARC — policy and reporting
DMARC aligns the SPF and DKIM results with the “From” address users actually see, and tells receivers what to do with messages that fail: p=none (monitor only), p=quarantine (send to spam) or p=reject. The rua tag specifies where aggregate reports about mail sent in your domain’s name are delivered.
Recommended rollout
- List every service that sends mail as your domain — corporate mail, CRM, marketing and notification systems.
- Build the SPF record to cover those services.
- Enable DKIM signing for each sending service.
- Start DMARC at p=none and analyse the reports.
- Once legitimate mail passes consistently, move the policy step by step to quarantine and then reject.
Jumping straight to p=reject can cause legitimate mail to be lost — do not skip the monitoring phase.