DMARC, SPF and DKIM: the 3 DNS records protecting your company's name

A customer calls asking about the invoice you emailed them last week. The banking details on it were new, so they paid the new account. You never sent an invoice. Someone else did, and the email said it came from your domain, your company name, your address in the From line.

Nothing was hacked. No password was stolen. The criminal simply sent email claiming to be you, because on the open internet anyone can put anything in a From line. The only thing that stops it is a set of 3 DNS records most small businesses have never fully configured: SPF, DKIM and DMARC.

The FBI’s IC3 has tracked billions of dollars per year in business email compromise losses, and domain spoofing is one of its cheapest entry points. The fix costs nothing but configuration time.

What the 3 records actually do

Plain-English versions, no protocol lecture:

• SPF (Sender Policy Framework) is a public list of servers allowed to send mail for your domain. A receiving mail system checks the sending server against the list
• DKIM (DomainKeys Identified Mail) is a cryptographic signature added to each message, proving it really left a system you control and was not altered along the way
• DMARC is the policy that ties them together. It tells receiving systems what to do when a message fails the first 2 checks: do nothing (p=none), send it to spam (p=quarantine) or refuse it entirely (p=reject). It also mails you reports about who is sending as your domain

Without DMARC, SPF and DKIM are advisory. A spoofed message can fail both checks and still land in your customer’s inbox, because you never told the world what to do about failures.

The state most small businesses are actually in

When Atticus Rowan reviews email security for a 10 to 30 user company, we usually find 1 of 3 situations:

• SPF only, published years ago by whoever set up Microsoft 365, never updated as new tools were added
• SPF plus partial DKIM, signing mail from the main platform but not from the marketing or invoicing tools sending on the domain’s behalf
• A dead DMARC record, p=none published in 2024 to satisfy a checklist, reports going to a mailbox nobody reads, enforcement never turned on

That last one deserves emphasis. p=none is a starting point, not a protection. It tells receiving servers to deliver spoofed mail normally. A domain can technically “have DMARC” and still be freely spoofable.

There is also a deliverability angle. Google and Yahoo began enforcing sender authentication requirements for bulk senders in 2024, and mail from domains with broken or missing authentication increasingly lands in spam even when it is legitimate. If your quotes and invoices are going to junk folders, this is a likely reason.

Why the rollout has to be staged

The reason this is a 60-day project instead of a 60-minute one: turning on enforcement before every legitimate sender is authenticated will block your own mail. The invoicing platform, the CRM, the scan-to-email copier, the e-signature tool, each one sends as your domain, and each one you forget becomes real mail your customers stop receiving.

The staged path:

• Inventory senders (week 1). List everything that emails as your domain. In a 20-person company the list is usually 5 to 10 services, and at least 1 of them will surprise the owner
• Authenticate every source (weeks 1 to 3). Update SPF to include each service and enable DKIM signing in each platform’s settings. Most business tools have a documented DNS setup page for exactly this
• Publish DMARC at p=none and actually read the reports (weeks 2 to 6). Aggregate reports show every source sending as your domain, legitimate and not. Free and low-cost report viewers turn the raw XML into something readable. This phase catches the sender you missed
• Tighten to p=quarantine, then p=reject (weeks 6 to 8). Once reports show your real mail passing cleanly, enforcement is the payoff. At p=reject, a spoofed invoice claiming to be you gets refused by any major mail provider before a customer ever sees it

None of this requires new software. It is DNS records and settings inside tools you already pay for, which is why it may be the highest-return security project available to a small business. The main investment is attention across those 60 days.

What this does and does not stop

Honest scope: DMARC stops exact-domain spoofing. It does not stop a criminal registering a lookalike domain (yourcompany-billing.com) or compromising a real mailbox and sending from it. Those need email security layers and user training and strong multi-factor authentication respectively.

But exact-domain spoofing is the version that most convincingly fools your customers and vendors, because every pixel of the From address is genuinely yours. Closing it also protects the deliverability of the mail your business depends on.

If you do not know what your domain’s DMARC policy is right now, that is worth 5 minutes today. Any DMARC lookup tool will show you, and “no record found” or p=none means the door is open.

Atticus Rowan configures SPF, DKIM and DMARC enforcement as part of the security baseline for managed IT clients, including the sender inventory and the report monitoring that makes enforcement safe. If your domain is still spoofable, contact us and we will help you close it.