Email spoofing underpins invoice fraud, CEO fraud and phishing. Three standards — SPF, DKIM and DMARC — let receiving mail servers verify that an email claiming to be from your domain really is.
SPF: who is allowed to send
Sender Policy Framework is a DNS TXT record listing the servers permitted to send mail for your domain, e.g. v=spf1 include:spf.protection.outlook.com -all. The ending matters: -all (hard fail) is stronger than ~all (soft fail).
DKIM: a tamper-proof signature
DomainKeys Identified Mail adds a cryptographic signature to each message. The public key is published in DNS under a selector (for Microsoft 365 typically selector1 and selector2). If the message is altered in transit, the signature fails.
DMARC: the policy that ties it together
DMARC tells receivers what to do when SPF or DKIM fail and aligns them with the visible From address. A record like v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain instructs receivers to reject spoofed mail and send you reports.
A safe rollout path
- Publish DMARC with
p=noneand reporting to see who sends on your behalf. - Fix legitimate senders (CRM, marketing, invoicing platforms) so they pass SPF/DKIM.
- Move to
p=quarantine, thenp=reject. - Domains that never send email should publish
v=spf1 -allandp=reject.
Check your domain now with our free Website & Email Security Scan.