SPF, DKIM and DMARC for small businesses: stop people sending email as you
SPF, DKIM and DMARC are three DNS records that let receiving mail servers check that email claiming to be from your domain really is. Gmail and Yahoo require at least SPF or DKIM from every sender, and all three from bulk senders. Set them up, then move DMARC from monitoring to enforcement so criminals cannot send invoices that look like yours.
By the editors of ProtectYour.com Last reviewed 5 min read
Affiliate disclosure: this guide links to Proton for Business and Fastmail. If you sign up through those links we may earn a commission, at no extra cost to you, and that does not change what we recommend. Free options come first, and we say where a competitor is the better fit. How we make money
Key takeaways
- SPF lists the servers allowed to send for your domain. DKIM signs each message. DMARC tells receivers what to do when a message fails, and sends you reports.
- Gmail requires every sender to use SPF or DKIM; senders of more than 5,000 messages a day to Gmail need SPF, DKIM and DMARC.
- Yahoo's rules match: SPF or DKIM for all senders, and SPF, DKIM and a DMARC policy of at least p=none for bulk senders.
- A p=none DMARC policy only monitors. Real protection against spoofing comes from p=quarantine or p=reject.
- Start by listing every service that sends mail as you (email host, newsletter tool, invoicing, website forms).
Why a small business should care
Without these records, anyone can send an email with your domain in the From line. Criminals use that to send fake invoices to your customers, fake payment changes to your suppliers and fake messages to your own staff. It is one of the building blocks of business email compromise. Authentication does not stop lookalike domains (yourc0mpany.com), but it stops your exact domain being forged, and it is now required for reliable delivery to the big mailbox providers.
The three records in plain English
What each record does
| Record | What it says | Lives in DNS as |
|---|---|---|
| SPF | "These servers are allowed to send mail for this domain." | One TXT record on the domain, starting v=spf1 |
| DKIM | "This message was signed by a key that belongs to this domain, and was not altered." | A public key in a TXT or CNAME record, one per sending service |
| DMARC | "If a message fails SPF and DKIM alignment, do this (nothing, spam folder, or reject), and send reports here." | A TXT record at _dmarc.yourdomain.com, starting v=DMARC1 |
"Alignment" is the part people miss: DMARC passes only when the domain in the visible From address matches the domain that passed SPF or DKIM. Gmail's rules for bulk senders spell this out (Google).
What Gmail and Yahoo require
Since February 1, 2024, Google's sender guidelines say:
- All senders to Gmail accounts must set up SPF or DKIM, have valid forward and reverse DNS, use TLS, and keep spam rates in Postmaster Tools below 0.3%.
- Senders of more than 5,000 messages a day must set up SPF and DKIM and a DMARC record (the policy can be none), align the From domain with SPF or DKIM, and support one-click unsubscribe on marketing messages.
Yahoo's requirements are the same in substance: SPF or DKIM for all senders, and for bulk senders SPF and DKIM, a valid DMARC policy of at least p=none that passes, a working one-click unsubscribe and unsubscribes honored within two days (Yahoo Sender Hub).
Most small businesses send far fewer than 5,000 messages a day from their own mailboxes, but a newsletter tool sending on your domain can cross the line, and setting all three up is good practice either way.
How to set them up without breaking your email
- List every service that sends as your domain: your email host (Microsoft 365, Google Workspace or another), the newsletter tool, invoicing and accounting software, the booking system, the website's contact form, the help desk.
- Turn on DKIM in each one. Each service gives you its own DNS record to add. Microsoft 365 and Google Workspace have a DKIM setting in their admin consoles; business email providers such as Proton for Business and Fastmail walk you through the records when you add a custom domain.
- Write one SPF record that includes every service that needs it. You can only have one SPF record per domain, and SPF allows at most ten DNS lookups, so merge rather than add a second record.
- Publish DMARC at p=none with a reporting address, for example a mailbox or a DMARC reporting service. Leave it for two to four weeks and read the reports to find any legitimate sender you missed.
- Move to p=quarantine, then p=reject once the reports show only your own services passing. This is the step that actually stops spoofing.
Do not jump straight to reject
Protect domains you do not send from
How to check what you have now
- Send a message from your business account to a Gmail address, open it, choose Show original, and look for SPF, DKIM and DMARC: PASS.
- Use Google's free Check MX tool or a DNS lookup to see whether your domain has SPF and DMARC records.
- Ask your IT provider or web host to read the DMARC reports with you. They look intimidating but answer a simple question: who is sending as us?
CISA's ransomware guide lists enabling DMARC among its phishing defenses (CISA). It belongs on the same list as multi-factor sign-in in our small business security checklist.
Common questions
What is the difference between SPF, DKIM and DMARC?
SPF lists the servers allowed to send mail for your domain, DKIM adds a signature to each message that proves it came from your domain unaltered, and DMARC tells receiving servers what to do with mail that fails those checks and sends you reports.
Does Gmail require DMARC?
Google requires DMARC for senders of more than 5,000 messages a day to Gmail accounts, and the policy can be set to none. All senders must use at least SPF or DKIM.
Is a DMARC policy of p=none enough?
It satisfies the Gmail and Yahoo bulk sender rules and gives you reports, but it does not stop spoofing. Move to p=quarantine or p=reject once every legitimate sender passes.
Can I have two SPF records?
No. A domain should have one SPF record that lists every service allowed to send for it. Two records cause SPF to fail.
Your next step
If you want a paid toolAffiliate link
Proton for Business
Best for: Small teams that want encrypted email, a shared password manager and a business VPN from one privacy-focused company.
Not for: Teams already standardised on Microsoft 365 or Google Workspace that only need one missing piece, and anyone needing deep Office integration.
Visit Proton for BusinessRelated guides
- Business email compromise and invoice fraud: how it works and how to stop itThe scam that costs small businesses the most involves no malware, only a convincing email and a rushed payment. Here is how it works and how to stop it.
- Small business cybersecurity checklist: the 10 controls that matter mostTen controls, in the order we would do them, for a business without an IT department. Most are free and take an afternoon.
- How to spot phishing emails and texts (and what to do if you clicked)Phishing works by making you act before you think. These are the lures that show up most, the checks that catch them, and the steps to take if one got through.
- Ransomware and small businesses: how to prevent it, and what to do in the first hoursRansomware usually gets in through a phishing email, a stolen password or an unpatched internet-facing system. Offline backups, phishing-resistant multi-factor sign-in and prompt updates stop most of it. If it hits, isolate the affected machines, do not wipe anything, and report it to the FBI and CISA before deciding anything about payment.