SPF, DKIM and DMARC Setup: Stop Email Spoofing

Quick answer: For SPF, DKIM and DMARC setup, first list every service that sends mail as your domain. Publish one SPF record that names them, turn on DKIM signing in each service, then add a DMARC record starting at p=none. Read the reports, fix failing senders, and move step by step to p=quarantine and p=reject.

A vendor receives an email from your accounts address asking them to update your bank details. It looks genuine, it uses your domain, and the money goes to a fraudster. Meanwhile, your real quotations keep landing in customers' spam folders, and nobody can explain why.

Both problems usually have the same cause: missing or broken email authentication. This SPF DKIM DMARC setup guide explains what each record does, shows example records, and gives a step-by-step method to protect your domain without blocking your own genuine mail.

Why Email Authentication Can No Longer Wait

Anyone can send an email that claims to come from your domain unless you tell the world's mail servers otherwise. Fake invoices, payment change requests and HR notices sent in a company's name are among the most common frauds businesses face.

There is a second reason. Large mailbox providers now check these records before accepting mail. Since February 2024, Google and Yahoo have required bulk senders, those sending around 5,000 or more messages a day to their users, to authenticate mail with SPF, DKIM and DMARC. Microsoft began applying similar requirements to high-volume senders to its Outlook.com consumer mailboxes from May 2025. Even if you send far less, missing records make it more likely that your genuine mail is treated as suspicious.

What SPF, DKIM and DMARC Each Do

Record	What it does	Where it lives	What it does not do
SPF (Sender Policy Framework)	Lists the servers allowed to send mail for your domain	One TXT record at the root of your domain	Does not check the visible From address; can break when mail is forwarded
DKIM (DomainKeys Identified Mail)	Adds a digital signature that proves the message came from an authorised system and was not changed	Public key as TXT or CNAME at a selector, for example selector1._domainkey	Does not tell receivers what to do when a check fails
DMARC	Links SPF and DKIM to the visible From domain, sets a policy for failures and sends you reports	TXT record at _dmarc.yourdomain	Does not stop look-alike domains or compromised mailboxes

SPF and DKIM prove a message is authorised. DMARC ties them to the address the reader sees and enforces the result. You need all three.

Common Setup Mistakes and Their Fixes

• Two SPF records on one domain. Both fail. Fix: merge them into a single record.
• Too many DNS lookups in SPF. The SPF standard allows at most 10 lookups, including nested includes. Exceed it and SPF returns an error. Fix: remove unused services and use subdomains for bulk tools.
• DKIM enabled in DNS but not in the service. Publishing the key is half the job. Fix: switch signing on in each service's admin console and confirm "dkim=pass" in headers.
• Jumping straight to p=reject. Forgotten senders, such as the invoicing tool, suddenly fail. Fix: start at p=none and read the reports first.
• Setting DMARC and never reading reports. p=none forever gives visibility but no protection. Fix: set a date to move to quarantine and reject.
• Forgetting parked domains. Unused domains can still be spoofed. Fix: publish "v=spf1 -all" and a DMARC p=reject record on them.

The Fix: SPF, DKIM and DMARC Setup in 6 Steps

Follow these steps in order. Skipping step 1 is the main reason rollouts break genuine mail.

1. Inventory every sending service. List every system that sends mail using your domain: Microsoft 365 or Google Workspace, ERP or accounting software, HRMS and payroll, CRM and newsletter tools, website forms, helpdesk, and scanners or applications that relay mail. Ask each department, because the finance team's invoicing tool is the one most often missed.
2. Publish one correct SPF record. Create a single TXT record at the root of your domain that includes every legitimate sender, stays within 10 DNS lookups and ends with ~all or -all.
3. Turn on DKIM signing in every service. In each service's admin console, generate a key (2048-bit where offered), publish it in DNS at the selector the service gives you, switch signing on and confirm "dkim=pass" in a test message.
4. Publish DMARC in monitoring mode. Add a TXT record at _dmarc with p=none and a reporting address, and use a DMARC report tool to read the daily aggregate reports.
5. Fix failures, then enforce. For two to four weeks, fix every legitimate sender that fails, investigate unknown sources, then move to p=quarantine and, once reports are clean, to p=reject.
6. Document and maintain. Keep a list of senders and DNS records, add new tools to SPF and DKIM before they go live, and review DMARC reports at least monthly.

Example Records

SPF

For a company using one mail provider and one invoicing service:

v=spf1 include:spf.yourmailprovider.com include:mail.invoicetool.com ~all

"-all" tells receivers to reject anything not listed, and "~all" means soft fail. Many teams start with "~all" and rely on DMARC for enforcement.

DKIM

The service gives you a selector and key. The record sits at a name such as selector1._domainkey.yourdomain.in. Repeat for every sending service, so each signs with your domain, not only its own.

DMARC, stage by stage

Stage	Example record	Effect
1. Monitor	v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.in	Nothing blocked; you receive reports
2. Quarantine	v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.in	Failing mail goes to spam
3. Reject	v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourdomain.in	Failing mail is refused

Replace the placeholder names with your provider's actual values. Your mail platform's documentation lists the exact include and selector names.

Special Cases: Subdomains, Bulk Mail and Forwarding

Most rollouts hit one of these situations. Each has a simple fix.

• Newsletters and bulk mail. Marketing tools can push your SPF record past the lookup limit and their reputation affects your main domain. Send bulk mail from a subdomain such as news.yourdomain.in with its own SPF, DKIM and DMARC records.
• Applications on your own servers. ERP, scanners and portals often relay mail through an internal server. Route them through your main mail platform's authenticated relay, so they inherit its DKIM signing, instead of adding each server's IP address to SPF.
• Forwarded mail. When a recipient auto-forwards your message, SPF often fails at the final mailbox. DKIM usually survives forwarding, which is why signing every service matters before you enforce DMARC.
• Subdomain policy. By default DMARC applies to subdomains too. Use the sp= tag only if you have a clear reason to treat subdomains differently.
• Several brands or domains. Repeat the process for each domain, including those used only for websites, and keep one owner for all DNS changes.

If you are planning a wider security review, our guide on choosing cyber security services shows where email protection fits.

How to Test Your Setup

• Send a test message to a Gmail or Outlook mailbox and open the message headers. Look for spf=pass, dkim=pass and dmarc=pass.
• Use a DNS lookup tool to confirm there is only one SPF record and that it resolves within the lookup limit.
• Check the DMARC reports for each sending service by name. Every legitimate source should pass at least one of SPF or DKIM with your domain aligned.
• Repeat the test whenever you add a new tool, change mail provider or move your DNS.

What DMARC Does Not Cover

DMARC protects your exact domain. It does not stop look-alike domains such as a misspelled version of your name, and it does not help if a real mailbox is taken over through a stolen password. Pair it with multi-factor authentication on every mailbox and regular phishing awareness training for staff. Ask finance teams to confirm any bank detail change by phone on a known number. If you are choosing or reviewing a mail platform, our comparison of Microsoft 365 vs Google Workspace covers their security features.

Frequently Asked Questions

What is the difference between SPF, DKIM and DMARC?

SPF lists the servers allowed to send for your domain. DKIM signs each message so receivers can verify it. DMARC links both to the visible From address, tells receivers what to do with failures and sends you reports.

How long does SPF, DKIM and DMARC setup take?

The records take minutes to publish. The full rollout to p=reject usually takes several weeks, because you need time to read reports and fix every legitimate sender.

Will DMARC stop all phishing?

No. It stops spoofing of your exact domain. Look-alike domains and compromised accounts need other controls such as MFA, monitoring and staff awareness.

Do small businesses need DMARC?

Yes. Fraudsters often target smaller firms because they are less likely to have these records. Missing records also make genuine mail more likely to go to spam.

Can DMARC break our email?

Only if you enforce it before every legitimate sender passes. Starting at p=none and moving up in stages avoids this.

How Affix Center Can Help

Affix Center is a Mumbai-based IT company that helps businesses secure their email domains. Our cybersecurity team can inventory your sending services, publish and test SPF, DKIM and DMARC records, read DMARC reports and take your domain safely to p=reject. Our IT operations team can then keep records up to date as you add new tools.

If you want to stop fraudsters using your domain without breaking genuine mail, contact Affix Center.