Why email authentication matters
Email was designed without sender verification, so anyone can type your domain into the “From” field. Attackers use this to send fake invoices, payment-change requests and password resets that look like they come from you. Customers lose money, and your domain’s reputation suffers even though your systems were never breached.
| Record | Question it answers | Where it lives in DNS |
|---|---|---|
| SPF | Is this server allowed to send for the domain? | TXT record on the domain itself |
| DKIM | Was this message signed by the domain and left unaltered? | TXT record at selector._domainkey.yourdomain |
| DMARC | What should receivers do if SPF and DKIM do not align, and who gets the reports? | TXT record at _dmarc.yourdomain |
Receiving servers run these checks automatically. A domain with no DMARC record gets no protection and no visibility. Email authentication is one of the ten CyberScore checks and carries 96 of the 850 points.
SPF: list your legitimate senders
A Sender Policy Framework record is one TXT record that names every service allowed to send as your domain. Example for a business that uses Google Workspace:
example.in. TXT "v=spf1 include:_spf.google.com ~all"
- Publish one SPF record per domain. Two records cause a permanent error.
- Add an
include:for each service that sends your mail: your mailbox provider, newsletter tool, CRM, invoicing and support desk. - End with
~all(soft fail) while testing and move to-all(hard fail) when confident. - Stay under ten DNS lookups in total.
DKIM: sign every message
DomainKeys Identified Mail adds a digital signature to outgoing messages. Your mail provider generates a key pair, and you publish the public half in DNS under a selector name. Example:
google._domainkey.example.in. TXT "v=DKIM1; k=rsa; p=MIIBIjANBgkq…"
- Turn on DKIM signing in each sending service, then publish the record it gives you.
- Use 2048-bit keys where your provider supports them.
- Some providers (Microsoft 365, for example) ask for CNAME records instead of a TXT record. Publish exactly what the admin console shows.
DMARC: set the policy and get reports
Domain-based Message Authentication, Reporting and Conformance builds on SPF and DKIM. A message passes DMARC when SPF or DKIM passes and the authenticated domain aligns with the visible From address. Example starting record:
_dmarc.example.in. TXT "v=DMARC1; p=none; rua=mailto:[email protected]; pct=100"
The three DMARC policies
| Policy | Effect on failing mail | When to use it |
|---|---|---|
| p=none | Delivered normally; you only receive reports | First 2–4 weeks, to discover every sender |
| p=quarantine | Usually routed to spam | Once all legitimate senders pass |
| p=reject | Refused by the receiving server | Final state; best protection against spoofing |
Safe rollout order
- Inventory every service that sends email as your domain, including marketing and billing tools.
- Publish SPF with all of them, using
~all. - Enable DKIM in each service and publish the keys.
- Publish DMARC at
p=nonewith a reporting address you actually read. - Review the reports for two to four weeks and fix every legitimate sender that fails.
- Move to
p=quarantine, thenp=reject, watching reports after each step.
Common mistakes that break business email
- Jumping straight to p=reject. You will block your own newsletters or invoices if one sender was missed.
- Forgetting third-party senders. CRM, helpdesk, payroll and e-commerce platforms often send as your domain.
- Two SPF records. Merge them into one.
- Ignoring subdomains. Add
sp=rejector publish records for subdomains that send mail, and protect parked domains with a deny-all SPF and a reject-policy DMARC. - Sending DMARC reports to an unread mailbox. Reports are the whole point of the monitoring phase.
SPF, DKIM and DMARC questions
What is the difference between SPF, DKIM and DMARC?
SPF lists which servers may send mail for your domain. DKIM adds a cryptographic signature that proves a message was not altered and came from a domain-authorised sender. DMARC ties the two together, tells receiving servers what to do when checks fail, and sends you reports.
Do I need all three?
Yes. SPF and DKIM each authenticate a different part of a message and either can be defeated alone. DMARC requires at least one of them to pass and align with the visible From domain, and it is the record that actually instructs receivers to quarantine or reject spoofed mail.
What DMARC policy should I start with?
Start with p=none and a reporting address so you can see who is sending as your domain without affecting delivery. Move to p=quarantine once every legitimate sender passes, then to p=reject when reports stay clean.
Why does SPF fail with “too many DNS lookups”?
SPF allows at most ten DNS-querying mechanisms (include, a, mx, ptr, exists, redirect) while evaluating a record. Adding many third-party senders can exceed that limit, which makes SPF return a permanent error. Remove senders you no longer use or flatten the record.
Is DMARC required?
Large mailbox providers require SPF, DKIM and DMARC from bulk senders, and a missing DMARC record makes it easy for criminals to send convincing mail as your domain. Even small businesses that send little mail benefit, because spoofing targets your customers and suppliers, not just your inbox.