SPF, DKIM, DMARC: protect your e-mail domain

Without protection, anyone can send an e-mail that appears to come from your address. Your customers may then receive fake invoices 'from you'. SPF, DKIM and DMARC are three records published in your domain's DNS that let receiving servers check that a message is genuine.

SPF: who is allowed to send

SPF publishes the list of servers authorized to send e-mail for your domain: Microsoft 365, the newsletter tool, the invoicing software. Only one SPF record is allowed per domain, and it must not exceed ten DNS lookups, a limit that is quickly reached as services pile up.

DKIM: the message signature

DKIM adds a cryptographic signature to every message sent. The recipient checks this signature against a key published in your DNS: if the message was altered in transit or does not come from an authorized service, the signature does not match. Every service that sends on your behalf needs its own DKIM configuration.

DMARC: the rule to apply

DMARC tells recipients what to do with a message that fails the checks: nothing (none), send it to junk (quarantine) or refuse it (reject). DMARC also requests reports, which show which services are actually sending on behalf of your domain.

Rolling out without blocking your own e-mail

• Inventory everything that sends on behalf of the domain: e-mail, newsletter, CRM, invoicing, website forms, ERP, printers.
• Configure SPF and DKIM for each of these services.
• Publish DMARC in 'none' mode with reporting, and analyze the reports for a few weeks.
• Move to 'quarantine', then to 'reject' once all legitimate sending is aligned.
• Also protect the domains that never send e-mail, with a reject policy.

Why deal with it now

The major e-mail providers now require these mechanisms, especially for senders with high volumes. Without them, your messages are more likely to land in junk. Above all, a strict DMARC policy prevents your domain from being used directly to deceive your customers and partners.