Email security: SPF, DKIM and DMARC, and what they do not cover

91% of cyberattacks start with a phishing email. Business email compromise alone accounted for $2.77B of the record $16.6B in reported cyber-crime losses in 2024 (FBI IC3). Three DNS records are the baseline defence, and most domains have at least one of them wrong.

SPF: who may send as you

A Sender Policy Framework record lists the servers allowed to send mail for your domain: your mail provider, your marketing platform, your invoicing tool. A receiving server checks the sending server against the list. A record that is missing, or that ends in a soft fail, lets anyone send as you.

DKIM: proof the message was not altered

DomainKeys Identified Mail signs each outgoing message with a key published in your DNS. The receiver verifies the signature, which proves the message came from your systems and was not changed on the way. Every sending platform needs its own key, and unsigned platforms are the common gap.

DMARC: what to do when the checks fail

Domain-based Message Authentication, Reporting and Conformance tells receivers what to do with mail that fails SPF and DKIM: monitor it, quarantine it or reject it. A policy of “none” is a report, not a defence. Enforcement (quarantine, then reject) is what stops spoofed mail from your domain reaching your customers, and it is what mailbox providers increasingly require before they will deliver your bulk mail at all.

Set DMARC to monitor first, read the reports to find every legitimate sender you forgot, add them to SPF and DKIM, then move to enforcement. Done in that order, nothing legitimate breaks.

What they do not cover

These records protect your domain from being spoofed. They do nothing about a lookalike domain, a compromised supplier’s real mailbox, or an attacker writing from a free account. That is where layered detection on top of Microsoft 365 or Google Workspace earns its place, with sandbox analysis of attachments and business email compromise detection that notices a payment instruction that does not fit. Generative AI has made phishing nearly indistinguishable from legitimate communication and voice cloning made the phone an attack vector (vishing grew 442% through 2024), so people also need training on the phishing they will actually receive, not an annual video.

The email layer is on Security, and hosted business email with SPF, DKIM and DMARC configured is part of Managed hosting.