SPF, DKIM and DMARC

What it means

SPF, DKIM and DMARC are three technical records in the DNS of a company’s domain that protect email against spoofing. Together they let a recipient check that a message claiming to come from your domain really was sent by an authorised server and was not altered on the way.

SPF lists the servers allowed to send mail for the domain. DKIM adds a digital signature to the message, which the recipient verifies with a public key published in DNS. DMARC tells the recipient what to do with a message that fails the checks and sends the domain owner reports on abuse attempts.

Without these records an attacker can easily send phishing in the company’s name, such as fake invoices to clients. Major email providers also require them from bulk senders, otherwise their messages end up in spam.

How it works in practice

When setting up a client’s domain we check which services send email for it: their own mail, the invoicing system, an email marketing tool or the online shop. Each must be included in SPF and have DKIM set up, or its messages will start failing under a strict DMARC policy.

We introduce DMARC gradually. First in a report-only mode; then we see where mail comes from, add any missing services, and only then tighten the policy so that spoofed messages are rejected.

These records complement other measures against social engineering. They protect against spoofing of your exact domain, not against look-alike domains with a typo, so training people remains essential.

What to watch out for

A DMARC policy made strict without preparation can block legitimate email too, such as invoices from the accounting system. Before tightening it we therefore always review several weeks of reports.

SPF has a technical limit on the number of DNS lookups. A company using many external services can easily exceed it, and the record then stops working. With many services, careful maintenance is needed.