What are DMARC, SPF and DKIM?
DMARC is an email standard that protects your domain from being abused as a fake sender. Together with SPF and DKIM, DMARC forms the technical defence against email spoofing, where fraudsters send emails that appear to come from your company. Without the three standards, anyone can in principle send an email with your domain in the sender field, and that is exploited heavily in phishing attacks against both your customers and your own employees.
How SPF, DKIM and DMARC fit together
The three standards are layers that build on each other:
- SPF (the sender list): A DNS record listing the servers that are allowed to send mail from your domain. The recipient's mail server checks whether the sending server is on the list.
- DKIM (the signature): A digital signature that your mail server adds to every outgoing mail. Using a public key in DNS, the recipient can verify that the mail actually comes from you and has not been altered in transit.
- DMARC (the policy): The rule that ties it all together. It tells receiving servers what to do with mails that fail the SPF and DKIM checks: nothing (none), quarantine, or reject. At the same time, recipients send reports back so you can see who is sending mail in your name.
SPF and DKIM alone are not enough, because without a DMARC policy there is no consequence when the checks fail. Conversely, a strict DMARC policy requires SPF and DKIM to be set up correctly for all your legitimate senders, including newsletter systems and invoicing tools, otherwise your own mail ends up in the spam filter.
Check your DMARC record
Your DMARC record sits as a TXT record in DNS at the address _dmarc.yourdomain.dk. You can look it up in your DNS administration or from a terminal with nslookup or dig. If no DMARC record exists, you have no protection. If it says p=none, you are only monitoring without blocking anything, which is a fine starting point but not the end goal. The goal is p=quarantine and eventually p=reject, introduced gradually while you use the DMARC reports to ensure all legitimate senders are included.
DMARC and Microsoft 365
If you use Microsoft 365 for email, the foundation is in place: Exchange Online fully supports SPF, DKIM and DMARC, and DKIM signing for your own domain is enabled in the security settings. Microsoft's guides on learn.microsoft.com describe the setup step by step. The pitfall is typically third-party systems sending mail on your behalf, and old DNS records that were never cleaned up. That is why it pays to review the entire sender landscape before tightening the policy.
How MI Support IT helps
We set up SPF, DKIM and DMARC correctly, review all your sending systems and tighten the policy to reject in a controlled process, as part of a secure Microsoft 365 setup and our IT security solutions. Contact us if you want to know whether your domain can be abused today.