SPF, DKIM, and DMARC are three email authentication standards that together prevent attackers from sending emails that appear to come from your domain. Without them, anyone can send a convincing phishing email that looks like it's from your CEO, your finance team, or your IT department.
These aren't optional nice-to-haves. Google and Yahoo now require them for bulk email senders, and they're a requirement for Cyber Essentials Plus and ISO 27001. More importantly, they directly protect your clients and staff from email-based fraud targeting your domain.
SPF is a DNS record that lists which mail servers are authorised to send email on behalf of your domain. When an email arrives claiming to be from your domain, the receiving mail server checks your SPF record to see if it came from an authorised source.
Add a TXT record to your domain's DNS:
v=spf1 include:spf.protection.outlook.com -all
The -all at the end means "reject mail from all other sources." Use ~all (softfail) if you're in testing mode.
DKIM adds a digital signature to every outgoing email. The signature is generated using a private key and can be verified by any receiving mail server using the corresponding public key published in your DNS. It proves the email hasn't been tampered with in transit and genuinely came from your mail server.
After enabling, DKIM can take up to 24 hours to propagate. You can verify it using an online DKIM checker.
DMARC builds on SPF and DKIM. It tells receiving mail servers what to do with emails that fail SPF or DKIM checks — nothing (monitor), quarantine (spam folder), or reject (block entirely). It also provides reporting so you can see who's sending email using your domain.
Add a TXT record to your DNS on _dmarc.yourdomain.com:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com; ruf=mailto:dmarc@yourdomain.com; fo=1
Start with p=none (monitor only) and review the reports for several weeks before moving to p=quarantine and eventually p=reject.
Don't jump straight to p=reject. If any legitimate systems sending email on your behalf — CRM, marketing tools, invoice software — aren't properly configured for SPF and DKIM, moving to reject will break those email flows. Always start with p=none, review reports, fix gaps, then tighten.
SPF alone is not enough — it can be bypassed. DKIM alone is not enough — the From header can still be spoofed. DMARC ties them together and enforces a policy. You need all three configured correctly for proper domain protection.
M365Clarity checks SPF, DKIM, and DMARC configuration as part of every tenant scan. DKIM is checked directly via the Exchange admin centre. SPF and DMARC are checked via DNS lookup against your tenant domain.
Connect your tenant, run a scan, and see exactly what needs attention — in plain English. Free plan available.
Scan your tenant free →Related articles