Why it matters

Attackers impersonate trusted domains because it works. Email authentication lets receiving servers verify that a message claiming to be from your domain really is. Major mailbox providers now expect it: since 2024, Google and Yahoo require bulk senders to authenticate mail and publish a DMARC policy.

The three standards

  • SPF lists the servers allowed to send mail for your domain
  • DKIM adds a cryptographic signature that proves a message was not altered and came from an authorised signer
  • DMARC tells receivers what to do when SPF or DKIM fail and align with the visible From domain, and sends you reports

A safe path to enforcement

Step 1 — Inventory every sender

Marketing platforms, CRM, ticketing, HR systems and invoicing tools all send as your domain. List them before changing anything.

Step 2 — Publish SPF carefully

Keep within the 10 DNS lookup limit. Remove services you no longer use and end with -all or ~all once you are confident.

Step 3 — Enable DKIM everywhere

Turn on DKIM signing for every platform that supports it and use 2048-bit keys where possible.

Step 4 — Start DMARC in monitoring mode

Publish p=none with a reporting address. Review aggregate reports for two to four weeks to find legitimate senders that fail.

Step 5 — Tighten in stages

  1. Move to p=quarantine with a low percentage, then increase it
  2. Fix any remaining legitimate failures
  3. Move to p=reject

Step 6 — Protect parked domains

Domains that never send mail should publish an SPF record that allows nothing and a DMARC policy of p=reject.

Authentication is not the whole answer

DMARC stops exact-domain spoofing. It does not stop look-alike domains or compromised supplier mailboxes. Combine it with:

  • Advanced filtering for malicious links and attachments
  • Banners on external email
  • Payment-change verification procedures to stop business email compromise
  • Regular security awareness training

Key takeaways

  • SPF authorises senders, DKIM signs messages and DMARC enforces alignment and reports.
  • Inventory every service that sends as your domain before tightening policy.
  • Move from p=none to p=reject in stages, and protect parked domains.

Frequently asked questions

Will DMARC reject break legitimate email?

Not if you first monitor reports, authenticate every legitimate sender and tighten gradually. Rushing straight to reject is what breaks mail.

What is the SPF 10-lookup limit?

SPF evaluation may perform at most ten DNS lookups. Exceeding it causes SPF to fail, so remove unused includes or flatten carefully.

Does DMARC stop look-alike domains?

No. It only protects your exact domain. Look-alikes need monitoring, takedowns and user awareness.

Reject is the goal. Monitoring forever is just a very detailed report of being spoofed.

See our email security services for DMARC rollout and email threat protection.