A large share of spam and phishing relies on forged sender addresses. An email that seems to come from your accounts department may in fact come from anywhere. Three mechanisms help recipients detect this.
SPF: who is allowed to send?
The Sender Policy Framework is a list in your domain’s DNS. It defines which servers may send email on your behalf – for example your mail server and your newsletter tool. If an email comes from another server, it fails the check.
DKIM: is the email genuine and unchanged?
With DomainKeys Identified Mail, your mail server digitally signs every outgoing message. The recipient verifies the signature using a public key published in your DNS. This ensures the email comes from your domain and was not altered on the way.
DMARC: what happens to forgeries?
DMARC builds on SPF and DKIM. You define how recipients should treat emails that fail the checks: deliver them, move them to spam or reject them. You also receive reports showing who sends email using your domain worldwide.
Rolling it out step by step
- Set up SPF and DKIM for all legitimate senders.
- Start DMARC with the policy
p=noneand analyse the reports for a few weeks. - Add forgotten senders (web shop, printers, CRM).
- Raise the policy to
p=quarantineand finallyp=reject.
Since 2024, Google and Yahoo require proper authentication from bulk senders anyway. A clean setup also improves deliverability. See our email security service.
Frequently asked questions
Do I need DMARC if I send few emails?
Yes. DMARC does not only protect your deliverability, but above all protects your customers from fake emails sent in your name.
Can DMARC disrupt my email delivery?
Only if legitimate senders are forgotten. That is why you start with p=none and analyse the reports before tightening the policy.
How do I check my current configuration?
Public tools can query the DNS records. We are happy to do the analysis for you.
