Quick answerSPF lists the servers allowed to send email for your domain, DKIM adds a cryptographic signature proving a message wasn't altered, and DMARC tells receiving mail servers what to do when a message fails those checks (none, quarantine or reject) and sends you reports. Together they stop criminals from sending convincing email that appears to come from your domain.
Invoice fraud often uses an email that appears to come from your own domain or a supplier's: "Our bank details have changed, please pay the new account." Without SPF, DKIM and DMARC, many mail servers can't tell the fake from the real thing.
SPF: who may send
An SPF record is a TXT record on your domain listing the services that send your email. Example for Google Workspace: v=spf1 include:_spf.google.com ~all. Keep only one SPF record per domain and include every service that sends for you (email host, newsletter tool, invoicing system).
DKIM: a signature on every message
DKIM is switched on in your email provider's admin panel, which gives you a TXT or CNAME record to publish. Outgoing messages are then signed, and receivers can verify the signature against your DNS.
DMARC: the policy and the reports
- Publish a TXT record at _dmarc.yourdomain.com: v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com
- Watch the reports for two to four weeks to find any legitimate senders you forgot to add to SPF or DKIM.
- Move to p=quarantine, then p=reject once real mail passes consistently.
Check your domain
Drofsecurity's website scan and domain checker read your SPF and DMARC records and tell you exactly what's missing.
Frequently asked questions
Do I need DMARC if I have SPF?
Yes. SPF alone doesn't tell receivers what to do when a check fails, and it doesn't protect the visible From address. DMARC ties SPF and DKIM to the From domain and sets the policy.
Will DMARC p=reject block my own emails?
It can if some of your legitimate senders aren't covered by SPF or DKIM. Start with p=none, read the reports, fix gaps, then tighten the policy.