E-mail was designed without any check on the sender. Just as anyone can write any return address on an envelope, anyone can send a message with info@yourcompany.com in the From line. Criminals use this for invoice fraud: a “supplier” mails a changed bank account number, or “the director” asks for an urgent payment.

Three DNS records let receiving mail servers check whether a message really comes from you. Together they take a few minutes to set up, and most of the work is finding out which services send mail on your behalf.

The three records

SPF (Sender Policy Framework) is a list of servers that may send mail for your domain. A receiver compares the server that delivered a message with that list.

DKIM (DomainKeys Identified Mail) adds a digital signature to every outgoing message. The receiver checks the signature against a public key in your DNS. A valid signature proves the message came from a server with your key, and wasn’t changed on the way.

DMARC ties the two together. It tells receivers what to do when a message claims to be from your domain but fails SPF and DKIM: deliver it anyway (none), put it in spam (quarantine) or refuse it (reject). It also lets you receive reports on who sends mail in your name.

Without DMARC, SPF and DKIM are mostly advice. With DMARC on reject, forged mail from your domain is refused by Gmail, Outlook and every other major provider.

Step 1: check where you stand

Run your domain through the e-mail domain check. It shows which of the three records exist and whether they are set up correctly.

Step 2: list everything that sends mail for you

This is the step that takes thought. Besides your mailbox provider, think of:

  • newsletter and marketing tools
  • your web shop or booking system, which sends order confirmations
  • accounting and invoicing software that e-mails invoices
  • a contact form on your website
  • printers or scanners that send scans by e-mail

Every one of these needs to be in SPF, or sign with DKIM, or its mail will be rejected once DMARC is enforced.

Step 3: publish SPF and DMARC

The SPF and DMARC record builder produces both records from the list you just made. Add them at your domain registrar or hosting provider. A domain may have only one SPF record, so replace an existing one rather than adding a second.

Start DMARC with p=none and a report address. That changes nothing for delivery, but you start receiving reports.

Step 4: turn on DKIM and tighten DMARC

Turn on DKIM in the admin panel of your mail provider, and of your newsletter tool if it supports it. The provider generates the keys and tells you which records to add.

Read the DMARC reports for two to four weeks. When they only show your own services, change the policy to quarantine, and after another few weeks to reject.

Domains you don’t use for mail

Domains that never send mail are attractive for spoofing because nobody watches them. Give them a record set that refuses everything: SPF v=spf1 -all and DMARC p=reject. The record builder produces that set when you select that the domain doesn’t send mail.

Common mistakes

  • Two SPF records. Then SPF is invalid and fails entirely.
  • Too many includes. SPF allows at most 10 DNS lookups, nested includes included. Remove services you no longer use.
  • Staying on p=none forever. It measures, but protects nothing.
  • +all at the end of SPF. That allows every server in the world.