Implement SPF, DKIM, and DMARC to Stop Email Spoofing

Nothing in the original SMTP protocol verifies that an email actually comes from the domain in the From header — anyone can send mail claiming to be your CEO, your invoicing department, or your helpdesk. SPF, DKIM, and DMARC are the three DNS-based standards that retrofit this verification, and they only deliver their full value together: SPF and DKIM provide the authentication signals, DMARC ties them to the visible From address and tells receiving servers what to do when the check fails. Increasingly, this is not optional — major mailbox providers now require DMARC from bulk senders, and an unauthenticated domain is both easy to impersonate and increasingly likely to land in spam.

What each standard does

• SPF publishes, in a DNS TXT record, which servers are allowed to send mail for your domain. Receivers check the connecting server's IP against the list. Limitation: SPF validates the invisible envelope sender, not the From header the user sees, and it breaks on forwarding.
• DKIM adds a cryptographic signature to outgoing messages, validated against a public key in DNS. The signature survives forwarding and proves the message was not altered — but by itself does not require the signing domain to match the visible From.
• DMARC closes the gap with alignment: the domain that passed SPF or DKIM must match the From header domain. It also gives receivers a policy (none, quarantine, reject) and sends you aggregate reports showing who is sending mail as your domain — legitimate or not.

Implementation order

• Inventory first: list every service that sends mail as your domain — Exchange Online or your mail platform, marketing tools, CRM, helpdesk, monitoring systems, printers doing scan-to-email, application servers. Missed senders are the number one cause of lost legitimate mail later.
• SPF: publish one TXT record on the root domain, e.g. v=spf1 include:spf.protection.outlook.com include:_spf.vendor.com -all. Hard rules: only one SPF record per domain, stay under the 10 DNS lookup limit (flatten or reduce includes if needed), and end with -all once the inventory is trusted (~all during rollout).
• DKIM: enable signing on every legitimate sender. In Microsoft 365, publish the two CNAME records per domain and enable DKIM in the Defender portal; each third-party service provides its own selector records. Use 2048-bit keys and plan for periodic rotation.
• DMARC: start in monitoring mode: v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com. This changes nothing about delivery but starts the report flow.

From p=none to p=reject — the careful part

• Analyze aggregate reports for two to four weeks using a report processor (raw DMARC XML is unreadable at scale — use a free or commercial analyzer). Every legitimate source failing alignment needs fixing: add missing SPF includes, enable missing DKIM signing, or reconfigure the service to send from a subdomain it can authenticate.
• Move to p=quarantine, optionally easing in with pct=25 and stepping up. Watch reports and helpdesk tickets for another few weeks.
• Finish at p=reject — the only policy that actually stops spoofing. Also publish sp=reject (or explicit records) for subdomains and v=spf1 -all plus DMARC reject on parked domains that never send mail — attackers deliberately hunt for forgotten domains.

Common pitfalls

• Stopping at p=none forever — monitoring mode provides visibility but zero protection; treat it as a phase with an end date, not a destination.
• Two SPF records (one from IT, one pasted by a vendor's instructions) — this makes SPF permanently fail validation.
• Mailing lists and forwarders occasionally break alignment by design; accept the small residual failure rate rather than weakening policy for edge cases.
• DMARC protects only exact-domain spoofing. Lookalike domains (yourcompany-invoices.com) are a separate threat — pair this control with the anti-phishing and user-awareness items on this site.

The end state is verifiable from the outside in minutes and pays off permanently: your domain becomes cryptographically hard to impersonate, your legitimate mail gains deliverability, and you get continuous reporting on every abuse attempt against your brand.