Three DNS records (SPF, DKIM and DMARC) decide whether the world's mail systems can tell your genuine email from a criminal's forgery of it. Without them, anyone can send email that appears to come from your domain, and your real email is more likely to land in junk folders. Setting them up correctly takes an afternoon, costs nothing in licences, and you can check your own domain free in about 30 seconds. This guide explains what each record does, without assuming you ever want to read a DNS record yourself.
Why would criminals send email as your business?
Because your name is more trusted than theirs. The classic attack against Norfolk businesses isn't hacking your systems at all: it's sending your customers an invoice "from you" with new bank details.
It works because, by default, email lets anyone put anything in the "from" field, the same way anyone can write any return address on an envelope. If a supplier in Wymondham, a client in Great Yarmouth or your own finance team can receive an email that says it's from your managing director, and nothing checks that claim, then your actual security hardly matters: the criminal never needed to break in. SPF, DKIM and DMARC are the three checks that make the claim verifiable, and they only work if you publish them, because only you can vouch for your own domain.
What does SPF do?
SPF is your domain's approved sender list: a public record saying "these mail servers are allowed to send email for us". Receiving systems check the sending server against the list.
When your provider sets up SPF, they list the systems that genuinely send as you: Microsoft 365, your invoicing software, your marketing platform. Mail from anywhere else fails the check. The catch is completeness: businesses accumulate sending services over the years (the CRM, the payroll system, the booking tool), and each needs including, or its genuine mail starts failing. That's why SPF records drift out of date and why they're worth re-checking after any new system goes live.
What does DKIM do?
DKIM is a tamper-proof signature: your mail server cryptographically signs each outgoing message, and receivers verify the signature against a public key you publish.
Where SPF vouches for the server, DKIM vouches for the message: that it genuinely came from your systems and wasn't altered on the way. It's invisible to your staff (signing happens automatically once configured) and it travels better than SPF does when email gets forwarded. There's no reason not to have it on every service that supports it, which today is nearly all of them.
What does DMARC do, and why is it the one that matters?
DMARC is the policy that gives the other two teeth. It tells receiving systems what to do when a message fails SPF and DKIM: do nothing, send it to junk, or reject it outright.
Without DMARC, a failed check is just a data point that most receivers shrug at. With a DMARC policy of "quarantine" or "reject", forged mail from your domain actually stops arriving. DMARC also sends you reports showing who's sending as your domain worldwide, which is how businesses discover both forgotten legitimate systems and active abuse.
| DMARC policy | What receivers do with forged mail | What it says about you |
|---|---|---|
| none | Deliver it anyway, just report it | Monitoring mode; fine to start, wrong to stay |
| quarantine | Send it to junk | Protection with a safety net |
| reject | Refuse delivery entirely | The destination: your domain can't be spoofed |
The honest path is gradual: start at "none", read the reports, fix the legitimate senders the reports surface, then step up to "quarantine" and finally "reject". Going straight to "reject" without the monitoring phase is how businesses accidentally block their own newsletters.
Does this affect whether your own email lands in junk?
Directly. Google and Microsoft now require authentication from bulk senders and increasingly distrust mail from domains without it, so weak records don't just enable fraud, they hurt your deliverability.
If your quotes and invoices keep landing in customers' junk folders, authentication is the first thing to check; we've covered the wider deliverability picture in why your emails are going to junk, and the spoofing angle in more depth in our earlier guide to email spoofing and DMARC. The short version: these records have quietly moved from best practice to table stakes.
How do you check where your business stands?
Run your domain through our free email security check: it reads your SPF, DKIM and DMARC records and explains what they mean in plain English. For the related problem of lookalike domains (criminals registering yourcompany-ltd.co.uk and emailing from that instead), our email impersonation check shows you what's registered near your name.
Both tools are free and run by us, Snap IT, an IT support company in Poringland, Norwich; email authentication is part of the security layer we include for every client rather than an add-on, and the tools exist because we got tired of seeing local businesses defrauded by attacks these records would have stopped. If you'd rather a human walked you through the results, that's what we're for. Authentication also feeds into certification: the same housekeeping mindset behind Cyber Essentials applies, and assessors increasingly expect to see it done.
What does this say about your IT provider?
If you have an IT provider and your domain fails these checks, that's a conversation worth having this week. These records are free, standard and years old; a provider who hasn't set them up either doesn't know or didn't think you were worth the afternoon.
To be fair, there are legitimate part-done states: a DMARC policy sitting at "none" might mean the monitoring phase is genuinely in progress. So ask the question before drawing the conclusion: "where are we with SPF, DKIM and DMARC, and when do we reach reject?" A good provider answers in plain English with a date. A blank look is an answer too. Email authentication makes a usefully concrete test case when you're comparing providers; our guide to choosing an IT support company in Norwich and Norfolk has the rest of the test.
Frequently asked questions
What are SPF, DKIM and DMARC in one sentence each?
SPF publishes which servers may send email for your domain; DKIM cryptographically signs each message so tampering and forgery are detectable; DMARC tells the world's mail systems to junk or reject messages that fail those checks, and sends you reports.
How do I check if my domain has them?
Use our free email security check: enter your domain and it reads the records and explains the results. No technical knowledge needed.
Do small businesses really get targeted by email spoofing?
Constantly, because the attack is automated and free to attempt. Criminals don't research targets; they forge mail from any domain without protection and see what lands. Small firms with weak records are the easiest wins.
Will setting these records break our email?
Done carelessly, it can: a too-strict SPF record or a premature "reject" policy can block legitimate systems. Done in the standard phased way (monitor, fix, then tighten) it's safe, and your staff never notice anything.
How much does email authentication cost?
The records themselves are free; they're just DNS entries. The work is identifying every legitimate sending service and configuring each one, which for a typical SME is a few hours of someone competent, then light ongoing attention to DMARC reports.
Is DMARC required for Cyber Essentials?
Not formally; the five controls don't mandate it. But it's baseline hygiene by any modern standard, insurers ask about it, and it protects the people you email even when every device you own is perfect.
