Email Authentication Explained: SPF, DKIM, and DMARC for Small Business

Anyone can send an email that says it’s from your business. They don’t need to hack your systems. They just need to put your name in the “From” line.

That’s why email authentication matters. SPF, DKIM, and DMARC are three free, DNS-based settings that tell the rest of the internet which emails really come from you, and what to do with the ones that don’t. They also decide whether your own emails reach your customers’ inboxes or land in spam.

This post explains each one in plain language, why they matter now, and how to get started.

MX: your mailroom address

MX (mail exchanger) records tell the rest of the internet where to deliver email sent to your domain. For most small businesses they point to Microsoft 365 or Google Workspace.

MX records don’t protect anything on their own, but they’re the starting point. They show who handles your email, and a missing or outdated MX record means email to your business can quietly go undelivered.

SPF: the guest list

SPF (Sender Policy Framework) is a short text record in your domain’s DNS settings. It lists the services allowed to send mail on your behalf, such as Microsoft 365 or Google Workspace, your email marketing platform, and your invoicing or ticketing software.

When an email arrives claiming to be from your domain, the receiving server checks the sending server’s address against your SPF list. If it isn’t on the list, the email fails the check.

Think of it as a guest list at the door. If the name isn’t on it, the email doesn’t get in.

A typical SPF record for a Microsoft 365 business looks like this:

v=spf1 include:spf.protection.outlook.com -all

Google’s own example for a Google Workspace business looks like this:

v=spf1 include:_spf.google.com ~all

The ending matters. -all tells receivers to reject email from servers that aren’t on the list. ~all asks them to treat it as suspicious. Either is fine. What matters is having one, and your record will list your own providers, not these examples.

Watch out: each domain should have only one SPF record. Adding a second one, or listing too many services, can break the whole thing. SPF also has a limit of 10 DNS lookups, and many small businesses go over it after adding tools over the years.

DKIM: the wax seal

DKIM (DomainKeys Identified Mail) signs each outgoing email with a private key that only your mail provider holds. The matching public key is published in your DNS. The receiving server uses that public key to confirm two things:

1. The email really came from a system authorized to send for your domain.
2. The message wasn’t altered on the way.

Think of it as a wax seal on a letter. If the seal is intact and matches the family crest, the letter is genuine and hasn’t been opened and changed.

Your email provider usually generates the keys for you. You copy a DNS record they give you, and turn signing on. It takes a few minutes, but it is easy to get wrong if you’re not comfortable in your DNS settings.

DMARC: the instructions and the report

SPF and DKIM check emails. DMARC (Domain-based Message Authentication, Reporting and Conformance) tells receivers what to do when those checks fail, and it sends you a report about what it sees.

A DMARC record has two main settings:

• Policy (p=): what to do with failing emails. none means monitor only. quarantine means send them to spam. reject means block them.
• Reporting (rua=): where to send the daily reports.

DMARC also adds alignment, a check that’s on by default rather than a setting you add. It requires the domain in the visible “From” address to match the domain that passed SPF or DKIM. This is the part that stops someone from spoofing your exact domain.

A starter record looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com

DMARC is the piece that turns SPF and DKIM from background checks into real protection. Without it, a receiver can see that a message failed, but it doesn’t have a clear instruction for what to do.

One heads-up: DMARC reports arrive as raw XML data files, not readable summaries. They’re valuable, but most businesses need a tool or a partner to make sense of them.

Why this matters for your business now

Gmail, Yahoo, and Microsoft Outlook.com have tightened their rules over the past few years. Every sender now needs at least SPF or DKIM. Bulk senders, meaning organizations sending thousands of emails a day, need both SPF and DKIM, a DMARC record, and alignment. Those rules keep getting stricter.

Even if you send only a few emails a day, the same signals decide whether your invoices, quotes, and client updates land in the inbox. They also affect whether criminals can impersonate your business to your clients. A fake “payment details have changed” email is a common way small businesses lose money.

If your business does cold outreach, these records matter even more. Unauthenticated or badly configured cold emails are the fastest way to get your domain flagged as spam. Many businesses send cold outreach from a separate domain or subdomain, so any reputation damage doesn’t reach their main domain and customer email.

Using a Gmail or Outlook.com address for your business? Then none of this is in your hands. Those records belong to Google or Microsoft, and you can’t set them for your business. A business domain, such as yourcompany.com, puts you in control.

How to get started

1. Find out what you have. Request a free report below and we’ll email you a plain-language breakdown of your MX, SPF, DKIM, and DMARC records. Also look at which tools already send email on your behalf.
2. Turn on DKIM in your email platform, then publish the record it gives you.
3. Publish one SPF record that lists every legitimate sender, and nothing else.
4. Add a DMARC record with p=none and a reporting address. This monitors without blocking anything, so you can see what’s happening.
5. Read the reports for a few weeks. Find any legitimate tools that are failing, and fix them.
6. Tighten the policy. Move to p=quarantine, then p=reject once you’re confident legitimate mail passes.

Don’t skip step 4. Going straight to reject can block your own invoices and client emails if a tool is misconfigured.

Don’t do this alone

Email authentication is simple in concept and easy to break in practice. A typo in a DNS record, a second SPF record, or a forgotten sending tool can stop email quietly. Most of the problems we see come from changes made over years of adding software, not from one big mistake.