If customers say your quotes never arrived, the problem is often not “the internet”. Other mail servers are unsure your message is really from you. SPF, DKIM and DMARC are the three DNS records that answer that question.
What each record does
- SPF lists the servers allowed to send mail for your domain
- DKIM adds a signature so the message cannot be quietly altered
- DMARC tells receivers what to do when SPF or DKIM fail, and can send you reports
They are not a substitute for a proper mailbox. Mail from a free Gmail address on your invoices still looks unofficial — see why your business needs professional email. Authentication sits on top of Microsoft 365 or Google Workspace once the domain is yours.
Where small firms get caught
A website contact form, a hosted accounts package and a Mailchimp-style newsletter all send “from” your domain. If they are missing from SPF, DMARC will eventually reject mail you meant to send. Add them, watch the reports, then move from monitor-only to a stricter policy.
This also cuts down a common fraud: someone emailing your customers from a lookalike of your domain and asking them to pay a new account. It does not replace training. Staff should still follow the checks in how to spot phishing emails.
We set these records as part of Microsoft 365 and email support, alongside domain and hosting DNS. Ask for a mail authentication check if invoices are going missing or you have never looked at DMARC.
Common questions
Will SPF, DKIM and DMARC stop all phishing?
No. They make it harder for strangers to send mail that pretends to come from your domain, and they help your real mail get delivered. Staff still need to spot fake Microsoft logins and unexpected payment changes. Authentication and awareness work together.
Can we add DMARC without breaking our newsletter?
Yes, if you start with a monitoring policy and include every system that sends as you — Microsoft 365 or Google, the website form, and the marketing platform. Tighten the policy only after those legitimate sources pass.