Email Security 101: DMARC, DKIM, SPF And How They Stop Spoofing

Email is still the easiest way for criminals to walk into your business. A convincing message that looks like it came from your finance team, your managing director, or a trusted supplier can trigger an urgent payment, a leaked login, or a ransomware incident. The good news is you can stop most of this with three simple building blocks: SPF, DKIM, and DMARC. In this guide you will learn what they do, how to roll them out without breaking legitimate email, and how to keep them tuned so spoofers are locked out.

DMARC in plain English

Think of DMARC as your domain’s checkpoint at the border. It checks arriving emails that claim to be from your domain and asks two questions:

• Does the email come from a server you approve? (SPF)
• Is the email untouched in transit and linked to your domain with a tamper seal? (DKIM)

If the answer to at least one is yes, and the visible From address matches, DMARC lets the email in. If not, DMARC follows your instruction: allow and report, put it in quarantine, or reject.

This matters for real world scams like invoice fraud and supplier spoofing. Attackers send lookalike or forged emails that say, here is our new bank account, please pay today. With DMARC set to quarantine or reject, those fakes are flagged or blocked at your recipient’s server. That reduces the chance that a busy colleague trusts the wrong email.

What is DMARC and how does it work?

DMARC, short for Domain-based Message Authentication, Reporting, and Conformance, is a DNS record that tells receiving mail servers how to handle messages that claim to be from your domain. It builds on SPF and DKIM, and it adds alignment and reporting.

• Alignment: the domain in the visible From header must align with the domain validated by SPF or DKIM. This stops attackers passing SPF or DKIM with their own domain while displaying yours to the user.
• Policy: you publish p=none, p=quarantine, or p=reject to set the action for failed messages.
• Reporting: you provide addresses for RUA (aggregate XML summaries) and RUF (forensic samples, often redacted) so you can see who is sending on your behalf, who is failing, and which sources need fixing.

In practice, a recipient server receives an email from you, checks your SPF list and DKIM signature, tests alignment with the From domain, then applies your DMARC policy and sends you a report.

Is DMARC really necessary?

Yes. SPF and DKIM alone do not tell a recipient what to do if checks fail. They also lack alignment, which is the trick that stops a criminal using a legitimate DKIM signature from attacker.com while pretending to be you@example.co.uk. DMARC closes that gap and gives you visibility through reports. For most SMEs, DMARC is one of the highest impact steps you can take to cut spoofing risk, satisfy customer due diligence, and improve deliverability.

SPF vs DKIM vs DMARC, who does what?

• SPF: a list in DNS of servers allowed to send for your domain. It answers, did this come from a permitted IP? It can break when emails are forwarded, since the forwarding server is not on your list.
• DKIM: a cryptographic signature added to each email by your sending system. It answers, was this message altered? Signatures survive forwarding.
• DMARC: the policy and alignment layer that says, only trust emails where the visible From matches the domain validated by SPF or DKIM, and here is what to do with failures. It also feeds reports back to you.

If you prefer a simple analogy, SPF is a guest list, DKIM is a tamper seal, DMARC is the front of house rulebook that ties the guest’s name and the seal to the name on the invitation, then instructs the door staff.

A safe, staged rollout plan

You can deploy DMARC without disrupting your business email by following a three stage plan.

Discovery and monitoring, p=none

• Publish DMARC with p=none and set RUA reporting to a mailbox or a reporting platform.
• Collect at least 2 to 4 weeks of reports. Identify all legitimate sources, for example Microsoft 365, your website contact forms, your CRM, your marketing platform, your service desk tool, scanners or MFDs, and any third party sender used by suppliers on your behalf.
• For each sender, configure SPF and DKIM correctly, and ensure alignment. Where possible, use DKIM alignment since it survives forwarding.

Begin enforcement, p=quarantine with percentage

• Move to p=quarantine with pct=20 or pct=50 so a slice of failing emails goes to spam while you watch for false positives.
• Continue tuning: update SPF, enable DKIM on all platforms, and align domains. For marketing senders use a dedicated subdomain like mail.example.co.uk so you can align DKIM and keep a clean reputation.

Full enforcement, p=reject

• Once reports show all legitimate sources pass and align, shift to p=reject, remove the pct tag, and keep monitoring. This is where spoofed emails that pretend to be you are blocked by recipients.

How to avoid breaking legitimate email

The main risk is missing a sender. Tackle these areas early:

• Third party senders: marketing platforms, CRM, ticketing, payroll, and survey tools often send on your domain. Enable DKIM in those tools and, where needed, add their include: entries to SPF. Consider using subdomains per platform for tidy alignment.
• Forwarding and aliases: SPF can fail after forwarding. Rely on DKIM alignment to pass DMARC where possible. Ensure DKIM is on for Microsoft 365 and other core systems.
• Web forms and devices: many sites post to SMTP directly from web servers or MFDs. Point them to relay through Microsoft 365 or your mail relay that is covered by SPF, or sign with DKIM if supported.
• Reply workflows: if a supplier sends on your behalf, agree on a subdomain you control, for example notifications.example.co.uk, and publish their DKIM key there.

A brief note on email filtering: the meaning of email filtering is the automated review and handling of inbound or outbound messages, using rules and threat intelligence to block spam, phishing, and malware. DMARC is not a filter by itself, but it plugs into that decision process by telling receivers how to treat messages that fail authentication.

Advanced Email Filtering

Stop threats before they reach the inbox. Our AI-powered email filtering catches advanced phishing, malware, and impersonation attempts while keeping your legitimate mail flowing smoothly.

DMARC reporting and ongoing tuning

DMARC reports are your steering wheel. Review them weekly at first, then monthly once stable. Look for:

• New sources: acquisitions, new tools, or supplier changes can introduce fresh senders.
• Rising failure rates: may indicate configuration drift, expired DKIM keys, or abuse.
• Alignment gaps: verify that the d= domain in DKIM and the Mail From domain for SPF match your visible From domain or subdomain strategy.

Rotate DKIM keys annually, limit SPF lookups to under the 10 lookup limit, and keep DNS tidy by removing old vendor entries. Document who can add new senders and how they must be configured to keep governance strong.

Explaining DMARC to non‑technical colleagues

Use this script with finance or leadership teams:

• Problem: anyone on the internet can print your logo on an envelope and post a fake letter that looks like it came from you. Email works the same.
• Controls: SPF is the list of post rooms allowed to send on your behalf. DKIM is the wax seal that proves the contents were not changed. DMARC is your instruction to the post office to reject letters that do not match both the sender identity and your seal.
• Result: fake invoices and supplier change requests are far less likely to reach inboxes; genuine emails are more likely to be trusted.

Where Jedi Services fits in

Rolling out DMARC touches DNS, Microsoft 365, third party platforms, and staff workflows. We design the domain strategy, configure SPF and DKIM, publish DMARC safely, monitor reports, and train your team to spot lookalikes. If you want expert help from a trusted UK partner, we can manage the full lifecycle from assessment to enforcement and ongoing reporting.

If you are already investing in layered defences, you can also explore email filtering to reduce spam and phishing volume for users while DMARC blocks impersonation.

Managed DMARC Services

Don't let criminals spoof your domain. We handle the complex rollout of SPF, DKIM, and DMARC to ensure your emails reach the inbox while blocking attackers from impersonating your business.

Summary

SPF, DKIM, and DMARC work together to stop criminals sending emails that pretend to be you. Start with p=none to map your senders, move to p=quarantine with partial enforcement to test, then to p=reject once everything aligns. Keep DKIM on everywhere, keep SPF lean, and use DMARC reports to guide tuning. This approach cuts invoice fraud and supplier spoofing risk without breaking legitimate email. If you want a practical rollout with clear governance and continuous monitoring, Jedi Services can help you move from theory to protection quickly, then keep it that way.