SPF, DKIM and DMARC explained for small businesses

Published October 23, 2026

Anyone can type your domain into the "From" line of an email. SPF, DKIM and DMARC are three DNS records that let the people receiving mail check whether a message really came from you, and tell them what to do when it did not. Set up properly, they make it much harder to impersonate your business to your customers and suppliers.

SPF: who may send mail for your domain

SPF is a list, published in DNS, of the servers allowed to send email for your domain. A receiving server checks whether the sending server is on the list.

example.com.  TXT  "v=spf1 include:_spf.google.com -all"

This example says that Google's mail servers may send for the domain and nobody else. The ending matters: -all means reject everything else, and ~all means treat it as suspicious but accept it.

DKIM: a signature on each message

With DKIM, your email provider adds a digital signature to every message it sends. The matching public key is published in DNS under a name called a selector, such as selector1._domainkey.example.com. A receiving server uses the key to check that the message was signed by you and was not changed on the way.

DKIM is usually switched on inside your email provider's admin settings, which then tells you the DNS record to add.

DMARC: what to do when a check fails

DMARC ties the two together. It tells receiving servers what to do with mail that fails SPF and DKIM for your domain, and where to send reports about it.

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@example.com"

The p= setting is the policy:

p=none only monitors. Nothing is blocked, and you receive reports.
p=quarantine asks receivers to treat failing mail as suspicious, usually by sending it to spam.
p=reject asks receivers to refuse failing mail. This is the setting that stops impersonation.

The order that works

Make a list of everything that sends mail as your domain: your main mailbox provider, your invoicing system, your newsletter tool, your website's contact form and any other service.
Publish one SPF record that includes all of them, and turn on DKIM for each one that supports it.
Publish DMARC with p=none and read the reports for a few weeks. They show who is sending mail as you, including services you forgot.
Fix whatever fails, then move to p=quarantine, and later to p=reject.

Common mistakes

Two SPF records. A domain may have only one. Publishing a second one breaks both.
Too many lookups. SPF allows at most 10 DNS lookups. Every include: adds some, and going over the limit makes the record fail.
A forgotten sender. A newsletter or invoicing tool that is not in your SPF record and not signing with DKIM will start failing once DMARC is enforced.
Leaving DMARC at p=none forever. Monitoring is a good first step, but it does not stop anyone from impersonating you.
DKIM never turned on. Many providers publish the record only after you enable signing in their settings.

Why it matters beyond spoofing

Large mailbox providers expect these records. Google and Yahoo require SPF, DKIM and DMARC from senders who send large volumes, and mail from domains without them is more likely to land in spam or be refused. Insurers and customers also ask about them, because they are easy to check from the outside.

How to check yours

You can look up the records with any DNS lookup tool: search for the TXT record on your domain for SPF, on _dmarc. plus your domain for DMARC, and on your selector name for DKIM. Frontage checks all three on every assessment and reports what is missing, weak or conflicting.