Anyone can send an email that claims to be from your domain. Without protection, a criminal can email your clients from "[email protected]" asking them to pay a new bank account. Three DNS records, SPF, DKIM and DMARC, let receiving mail servers spot and stop those fakes.
The three checks
- SPF lists the servers allowed to send email for your domain, such as Microsoft 365 and your newsletter tool.
- DKIM adds a digital signature to every message, so the receiver can tell it wasn't changed on the way.
- DMARC ties them together. It checks that SPF or DKIM passed for the same domain shown in the From line, then tells the receiver what to do if they didn't.
The three DMARC policies
- p=none: deliver anyway, but send you reports. Use this first, to discover every service that sends email for you.
- p=quarantine: send failures to spam.
- p=reject: block them completely. This is the goal.
Most businesses that set up DMARC stop at p=none and never move on, which means fakes still get delivered. We read the reports, fix legitimate senders, and move you safely to reject, usually within a few weeks.
Book a call and we'll check your domain's records for free.