The problem these three records solve
Email was designed without authentication. Originally, any server could send a message claiming to be anyone, exactly as you can write whatever you like on the back of an envelope.
Two direct consequences for a business:
- Your identity can be impersonated. A fraudster sends a fake invoice that appears to come from your address, to your own customers. That is CEO fraud and supplier fraud, and it almost always starts with an unprotected domain.
- Your genuine messages look suspicious. Unable to verify that you are you, mail providers apply doubt and file you under junk.
SPF, DKIM and DMARC close that gap. They are three lines of text published in your DNS zone, at your host or your registrar. They cost nothing.
SPF: the list of authorised senders
SPF publishes the list of servers allowed to send mail for your domain. Your business mailbox, your emailing tool, your website sending form notifications.
What matters, beyond its mere presence, is how it ends:
- -all means: any server outside this list is an impostor, reject it. That is the strict stance.
- ~all means: mark it as doubtful but let it through. That is the soft stance, the most common one, and a reasonable compromise as long as you are not certain you have listed every one of your senders.
- +all authorises everyone. It is the equivalent of publishing nothing, and it turns up more often than you would think.
Classic trap: SPF has a limit of ten DNS lookups. A record that stacks five different tools exceeds it silently, and the whole thing stops working without a single error message.
DKIM: the signature on your messages
DKIM adds a cryptographic signature to every outgoing message. The receiving server fetches your public key from your DNS and verifies the signature. If it matches, two things are proven: the message really comes from you, and it was not altered in transit.
Unlike SPF, DKIM survives forwarding: a relayed message keeps a valid signature. That is what makes it the sturdiest of the three.
Setting it up is almost always done from your mail provider's interface, which hands you a record to copy. The difficulty, when there is one, comes from forgotten senders: your invoicing software, your newsletter tool, your booking platform. Each needs its own signature.
DMARC: the instruction, and the mistake that makes it useless
DMARC answers the question the other two leave open: what should be done with a message that fails the checks? Three possible answers:
- p=none: do nothing, just send reports. That is observation mode.
- p=quarantine: file as junk.
- p=reject: refuse the message.
Here is the most frequent mistake we measure: a domain publishes DMARC at p=none, and nobody ever goes back to it. The record is there, a checking tool shows a green tick, and yet no impersonation is blocked. Observation mode is a transition step, useful for a few weeks, not a destination.
The path is simple: publish at p=none, read the reports for two to four weeks to identify the legitimate senders you forgot, then move to quarantine, then to reject. Tightening too fast risks blocking your own invoices.
The three complements that follow
Once the trio is in place, three lesser-known settings become available, and our audit measures them too:
- MTA-STS requires that mail addressed to you travels encrypted, which blocks interception by protocol downgrade.
- TLS-RPT sends you a report when that encryption fails.
- BIMI displays your logo in your recipients' inbox. It requires DMARC at quarantine or reject: it is the visible reward for the previous work, and a brand signal your competitors probably do not have.
What our audit measures exactly
Nine checks, all performed from the outside on your public records: presence of SPF and the strength of its ending, presence of a DKIM signature on the common selectors, presence of DMARC and the strength of its policy, MTA-STS, TLS-RPT, BIMI, and your receiving servers.
We measure nothing your recipient could not verify themselves, which makes every finding replayable. That is the principle of our methodology, and it is what separates a finding you can hold up from an opinion.
If your emails land in junk, start here before rewriting your subject lines. And if your site scores poorly elsewhere, our website security guide covers the other three projects.