Imagine a criminal sending an email that appears to come from [email protected], asking a client to pay an invoice into a new bank account. Without the right protections, that’s surprisingly easy. SPF, DKIM and DMARC are three email authentication standards that make it much harder, and they also help your genuine emails land in the inbox.
Why email needs authentication
Email was designed decades ago without built-in identity checks. Anyone can type any “From” address into a message. Authentication standards add a way for receiving servers to verify that a message really came from the domain it claims.
SPF: who is allowed to send
Sender Policy Framework (SPF) is a DNS record that lists the servers allowed to send email for your domain. When a receiving server gets a message claiming to be from yourcompany.com, it checks whether the sending server is on that list.
Think of it as a guest list at the door.
DKIM: a tamper-proof signature
DomainKeys Identified Mail (DKIM) adds a digital signature to every outgoing message. The receiving server uses a public key published in your DNS to check the signature. If it matches, the message genuinely came from your domain and wasn’t altered in transit.
Think of it as a wax seal on a letter.
DMARC: the policy and the reports
Domain-based Message Authentication, Reporting and Conformance (DMARC) ties SPF and DKIM together. It tells receiving servers what to do with messages that fail the checks:
- p=none — monitor only, take no action.
- p=quarantine — send failing messages to junk.
- p=reject — refuse failing messages entirely.
DMARC also sends reports showing who is sending email using your domain, revealing both misconfigured services and spoofing attempts.
Think of it as the instructions you give the door staff, plus a log of everyone who tried to get in.
Benefits for your business
1. Stops domain spoofing, protecting clients and partners from fraud in your name.
2. Improves deliverability, as major mailbox providers increasingly expect authenticated mail.
3. Protects your brand reputation.
4. Gives visibility into every service sending on your behalf.
A safe rollout path
1. Publish an SPF record listing all legitimate senders, including your email host, CRM and marketing tools.
2. Enable DKIM signing with your email provider.
3. Start DMARC at p=none and review the reports.
4. Fix any legitimate services that fail.
5. Move to p=quarantine, then p=reject once you’re confident.
Common mistakes
- Forgetting third-party senders such as newsletter or invoicing platforms.
- Creating more than one SPF record for the same domain.
- Jumping straight to p=reject and blocking your own legitimate mail.
Smardove and email authentication
Smardove supports SPF, DKIM and DMARC for your domain, and our team can help you set them up correctly. Combined with SpamFoo AI antispam, which also checks authentication on incoming mail, plus virus scanning, two-factor authentication and country-based login restrictions, your domain and your inbox are both protected.
| Stop criminals using your name. Contact Smardove for help configuring SPF, DKIM and DMARC. |
