Three small settings decide whether a scammer can send email that looks exactly like it came from your business: SPF, DKIM, and DMARC. Get them wrong or leave them off, and criminals can spoof your domain to phish your customers and staff, with your name on the message. Get them right, and most of that impersonation simply bounces. They sound technical, but the idea behind each is simple, and this is what they do and the order to set them up.
The problem they solve
Email was built in a more trusting era, so by default anyone can put your address in the "from" line, the digital equivalent of writing someone else's return address on an envelope. That is how a fraudster sends "an invoice from your company" to your client, or a fake message from the boss to your finance person. SPF, DKIM, and DMARC are the three records that let the receiving mail server check whether a message claiming to be from your domain is genuine, and decide what to do if it is not.
What each one does, in plain terms
- SPF is a public list of the servers allowed to send email for your domain. The receiver checks whether the message came from one of them. Think of it as a guest list.
- DKIM adds an invisible tamper-proof signature to each message, so the receiver can confirm it genuinely came from you and was not altered in transit. Think of it as a wax seal.
- DMARC ties the two together and, crucially, tells receivers what to do when a message fails the checks: do nothing, quarantine to spam, or reject outright. It also emails you reports on who is sending as your domain. Think of it as the policy and the security camera.
The order that matters
Set them up in sequence, because DMARC only works once the first two are solid. First publish SPF and DKIM correctly for every service that legitimately sends on your behalf (your email provider, your newsletter tool, your invoicing software). Then add DMARC in "monitor only" mode so you get reports without blocking anything, and watch for a couple of weeks to catch any legitimate sender you forgot. Only then tighten DMARC to quarantine and finally reject. Jumping straight to "reject" is the classic mistake that sends your own real email to spam.
How to check where you stand
You do not have to guess. Our free Email Security Checker reads your domain's SPF, DKIM, and DMARC records and tells you what is configured and what leaves you open to spoofing, in a few seconds and with nothing stored. It is the fastest way to see whether your business is protected or wide open, and if you would rather have someone handle the setup end to end, that is routine work. Strong email authentication also underpins deliverability, so your real mail lands in the inbox, not the junk folder.