SPF, DKIM, and DMARC: What They Actually Mean for Your Business Email
Three acronyms standing between your emails and the spam folder—or between your domain and a scammer impersonating you. Here’s what they do, in plain language.
You send an invoice. Your client never sees it — it went to spam. Or worse: a scammer sends an email that looks exactly like it came from you, asking your client to wire money to a different account. Your client complies. You find out a week later.
Both of these scenarios are preventable. SPF, DKIM, and DMARC are the three authentication records that prevent them. Most small businesses either don't have them configured, have them partially configured, or have no idea whether they're set up correctly at all.
The short version:
- SPF tells receiving mail servers which servers are allowed to send email from your domain.
- DKIM adds a digital signature to every email you send, proving it hasn't been tampered with in transit.
- DMARC tells receiving servers what to do if an email fails SPF or DKIM — and sends you reports when that happens.
Together, they verify that email sent from your domain is actually from you. Without them, your domain is an open identity — anyone can borrow it.
SPF: The approved senders list
SPF stands for Sender Policy Framework. It's a DNS record that lives on your domain and lists which mail servers are authorized to send email on your behalf.
Think of it like a guest list. When an email arrives claiming to be from [email protected], the receiving mail server checks your SPF record: "Is the server this email came from on the approved list?" If yes, it passes. If no, it's flagged — and depending on your DMARC policy, it may be rejected or sent to spam.
Why this matters in practice
If you use Microsoft 365 to send email but your SPF record doesn't include Microsoft's mail servers, your emails may be flagged as suspicious by Gmail, Yahoo, and other providers — even though they're completely legitimate. This is one of the most common reasons business emails land in spam.
SPF alone isn't enough — it only checks where the email came from, not whether it's been altered. That's where DKIM comes in.
DKIM: The tamper-evident seal
DKIM stands for DomainKeys Identified Mail. When you send an email, DKIM adds an encrypted digital signature to the message header. The receiving server uses a public key stored in your DNS records to verify that signature.
If the email has been altered in any way during transit — content changed, links swapped, attachments modified — the signature won't match and the email fails DKIM verification.
If SPF is the guest list, DKIM is the wax seal on the envelope. It proves the message arrived exactly as it was sent — unopened and unaltered.
DKIM also helps with deliverability over time. Mail providers track the reputation of signing domains. A domain with consistent DKIM signatures and no spam complaints builds a positive sending reputation — which means your emails are more likely to land in the inbox, not the junk folder.
DMARC: The policy and the paper trail
DMARC stands for Domain-based Message Authentication, Reporting, and Conformance. It ties SPF and DKIM together and adds two things: a policy for what to do when email fails authentication, and a reporting mechanism so you can see what's happening with your domain.
DMARC policy options
None
Monitor only. Emails are delivered regardless — you just receive reports on what's passing and failing. Good starting point.
Quarantine
Emails that fail authentication go to the spam folder instead of the inbox. A middle ground while you tighten up your setup.
Reject
Emails that fail authentication are blocked entirely. Maximum protection — but only safe to enable once SPF and DKIM are fully verified.
The reporting side of DMARC is underrated. It sends you aggregate data on every email sent from your domain — including emails you didn't send. If someone is spoofing your domain to run a phishing campaign, DMARC reports will show you exactly what's happening and where it's coming from.
Most small businesses set DMARC to p=none initially to monitor without impacting deliverability, then move to p=quarantine or p=reject once they've confirmed their legitimate email is passing authentication correctly. Jumping straight to reject without verification can block your own legitimate emails.
How the three work together
SPF, DKIM, and DMARC aren't alternatives — they're layers. Each one handles a different piece of the authentication problem. Together they create a complete picture of whether an email is legitimate.
An email has to pass both SPF and DKIM to be considered DMARC-compliant. If either fails and your DMARC policy is set to quarantine or reject, the email doesn't reach the inbox. That's the protection. It's also why the order of configuration matters — you set up SPF and DKIM first, verify they're passing correctly, then layer DMARC on top.
Why most small businesses get this wrong
These records live in your DNS — the same place your website and email routing live. They're not visible to users and they don't cause obvious problems when they're wrong. Your email still sends. It just doesn't always arrive.
The most common failure modes we see:
SPF record missing entirely
Common with older domains that were set up before these standards were widespread. No SPF means no sender verification at all.
SPF doesn't include all sending services
If you use Microsoft 365 for email but also send from a CRM, marketing platform, or invoicing tool, each of those needs to be in your SPF record. Missing one means those emails fail authentication.
DKIM not enabled in Microsoft 365
Microsoft 365 doesn't enable custom DKIM signing by default for every domain. It requires manual configuration in the admin center — a step that often gets skipped during setup.
No DMARC record at all
Without DMARC, you have no policy and no visibility. Your domain can be spoofed freely and you'd have no way of knowing it's happening.
The way to find out where you stand: run your domain through a free tool like MXToolbox or Google's Email Markup Tester. They'll show you exactly what records exist, whether they're configured correctly, and what's missing. If anything comes back red, it's worth fixing before your next important email ends up in a spam folder.
This is a set-it-and-verify-it problem
SPF, DKIM, and DMARC aren't things you revisit constantly. Once they're configured correctly and verified, they run in the background without your attention. The problem is the "configured correctly" part — DNS records are unforgiving, and a single syntax error can break authentication silently.
At Weightless IT, we configure and verify all three as part of every Microsoft 365 setup and email migration we handle — and we check them as part of ongoing managed IT support. If you're not sure whether your current setup is airtight, that's worth 30 minutes to find out.
Related reading
Not sure where you stand?
Let's check your email authentication.
We'll take a look at your SPF, DKIM, and DMARC setup, tell you what's missing or misconfigured, and fix it — no jargon, no runaround.
Book a 30-minute conversation →