The financial stakes are enormous. The FBI’s 2025 Internet Crime Report recorded $3 billion in reported business email compromise losses. SPF, DKIM and DMARC will not stop every compromised inbox or lookalike domain, but they make direct spoofing of your domain easier to detect and reject.
What is SPF and how does it protect business email?
Sender Policy Framework, or SPF, is a DNS record listing the systems authorized to send email for your domain. When a receiving server gets a message, it checks whether the sending server is permitted by that record. This helps detect mail sent from an unauthorized server claiming to use your domain.
What is DKIM and how is it different from SPF?
DomainKeys Identified Mail, or DKIM, adds a cryptographic signature to outgoing messages. Your mail service signs the message with a private key; receiving systems use the public key in your DNS to verify the signature and confirm that signed content was not altered in transit.
SPF focuses on the sending infrastructure. DKIM focuses on a domain-backed signature that can survive some forwarding scenarios. Google’s DKIM setup guidance explains the public and private key pair and recommends 2048-bit keys when the domain provider supports them.
Do you need SPF, DKIM and DMARC?
Yes. CISA says the three methods are not intended to work in isolation. Its email-authentication guidance recommends implementing SPF, DKIM and DMARC together. DMARC checks whether authenticated domains align with the visible From address and tells receiving systems what to do with messages that fail—monitor, quarantine or reject. It also provides reports that reveal legitimate senders you missed and attempts to impersonate your domain.
How should a small business set up email authentication?
- Inventory every sender. List your primary mail platform and every vendor that sends using your domain. Include marketing, CRM, ticketing, accounting and website systems.
- Publish one complete SPF record. Follow each provider’s instructions and authorize only current senders. Remove services you no longer use.
- Enable DKIM signing. Generate the key through your email provider, publish the public key in DNS and switch signing on. Protect private keys and rotate them according to provider guidance.
- Add DMARC in monitoring mode. Start with a reporting policy so you can collect data without blocking legitimate mail. Use a dedicated mailbox or reporting service to review aggregate reports.
- Fix alignment problems. Confirm that newsletters, invoices and other third-party systems pass SPF or DKIM with a domain aligned to the visible From address.
- Increase enforcement gradually. Move from monitoring to quarantine and then reject after reports show that authorized mail passes consistently.
- Test and document. Send messages to major providers, inspect authentication results and record owners, vendors and renewal procedures.
What mistakes can break SPF or DKIM?
- Forgetting third-party senders: A billing or marketing platform may send legitimate mail that fails authentication.
- Publishing conflicting records: Multiple SPF records can cause errors; combine authorized senders correctly.
- Changing messages after signing: Gateways that add footers or rewrite content can invalidate DKIM.
- Skipping unused domains: Even a domain that sends no mail should have defensive SPF and DMARC policies to discourage spoofing.
- Enforcing too quickly: A reject policy before inventory and monitoring can block real customer communications.
- Ignoring reports: DMARC data only helps when someone reviews failures and unknown senders.
What threats do SPF and DKIM not stop?
Authentication does not prove that the message itself is honest. A criminal can compromise a legitimate employee mailbox, register a lookalike domain or abuse an authorized marketing account. Keep MFA on every mailbox, limit administrator privileges, train staff to verify payment and banking changes through a second channel, and monitor forwarding rules and unfamiliar logins.
Make email authentication part of business maintenance
Correctly configured SPF, DKIM and DMARC reduce domain spoofing and show who is sending mail in your name. Review the records quarterly and whenever a vendor changes. Start today by asking your email provider to confirm the authentication status of every business domain.
