SPF, DKIM and DMARC explained: stop scammers sending email as your business
SPF, DKIM and DMARC explained in plain English: stop scammers sending email as your business, keep invoices out of junk, plus a Microsoft 365 checklist.
SPF, DKIM and DMARC are three DNS records that let mail systems check whether an email claiming to come from your domain really did. SPF lists the services allowed to send as you, DKIM adds a tamper-evident signature, and DMARC tells receivers what to do with anything that fails, then reports back. Set up fully, they make your domain much harder to forge and help genuine invoices reach the inbox.
That covers two problems that usually land on different desks. Security: payment redirection scams, the "our bank details have changed" email, cost Australians $166.8 million in 2025, more than any type except investment scams, according to the National Anti-Scam Centre's Targeting Scams report (as covered by Cyber Daily). Deliverability: Gmail and Outlook.com now check these records before deciding whether your quote reaches the inbox.
What are SPF, DKIM and DMARC, in plain English?
Plain email has no built-in way to check who sent a message, so anyone can put your address in the From line. These three records add the checks.
| Record | Plain-English job | What it checks |
|---|---|---|
| SPF (Sender Policy Framework) | The approved-senders list | Whether the sending server is one you've authorised |
| DKIM (DomainKeys Identified Mail) | The tamper seal | A digital signature that won't verify if the message was forged or altered |
| DMARC (Domain-based Message Authentication, Reporting and Conformance) | The instruction for fakes | Whether SPF or DKIM passed for the domain your recipient sees, and whether to do nothing, junk or reject if not |
The step most setups miss is alignment. Under Microsoft's DMARC guidance, a message passes only when SPF or DKIM passes and matches the From domain your client sees. That's how an invoicing tool can "pass SPF" and still fail DMARC.
Do I need DMARC for a 20-person business?
Yes. A 20-person firm's domain is just as easy to forge as a big company's, and its clients act on its emails just the same. Without DMARC, receiving systems get no instruction from you about forgeries, and you never see what's being sent in your name.
Your clients are the target.
A forged email from your exact address asking for payment to a "new" account is the opening move of a payment redirection scam.
Inbox placement.
Gmail requires anyone sending to personal Gmail accounts to use SPF or DKIM, and its stricter bulk rules can catch small firms too (more below).
Australia's government benchmark asks for it.
The Australian Signals Directorate's Information Security Manual (ISM) calls for hard-fail SPF, DKIM signing on outgoing mail and a DMARC policy that rejects failing mail, across an organisation's domains and subdomains, even at the non-classified level.
Someone is sending email from my domain: what's going on?
Three different problems look identical from outside, and DMARC fixes only one.
| What's happening | Typical clues | Does DMARC fix it? |
|---|---|---|
| Spoofing: a stranger forges your address from their own server | Bounce-backs for mail nobody sent; nothing in Sent Items | Yes. At p=reject, receivers that honour DMARC refuse the forgeries |
| A hijacked mailbox: someone has a staff password | Strange Sent Items, new inbox rules, odd sign-ins | No, the mail genuinely passes. Treat it as an incident: what to do when a Microsoft 365 account is hacked |
| A lookalike: a domain one character off, or your name as the display name | Looks right at a glance, but the domain isn't yours | No. That's a filtering and awareness job, and AI has made these fakes harder to spot |
Ask a recipient to forward a suspect message as an attachment, then find the Authentication-Results header: dmarc=fail against your domain usually means spoofing (or a sender you haven't set up yet), while a pass on mail nobody remembers sending points to a compromised account or a forgotten service.
How do you roll out DMARC without breaking your invoices?
In stages. Microsoft's guidance, echoed in Outlook's sender FAQ, is p=none first, then p=quarantine, then p=reject, watching reports throughout. Jumping straight to reject is how a firm discovers its invoicing system was never authorised.
List every service that sends as you, using the checklist below. Ask whoever pays the software bills too.
Tidy SPF: one record per domain (two break it), an include per service, and no more than 10 DNS lookups. Microsoft recommends ending with -all (hard fail) alongside DKIM and DMARC.
Turn on DKIM for every sender, each service signing with your domain under its own selector. Put bulk and marketing tools you don't directly control on a subdomain such as news.yourfirm.com.au, as Microsoft recommends, so their problems can't drag down your main domain's reputation.
Publish DMARC at p=none with a rua address, so receivers send aggregate reports (typically daily) to a dedicated mailbox or reporting service.
Fix the gaps until every legitimate source shows as aligned. Allow at least one full billing cycle so monthly invoice runs show up.
Step up to quarantine, then reject, optionally using the pct tag to cover a growing share of failing mail, as Microsoft suggests.
The third-party sender checklist
| Sender | Why it gets missed |
|---|---|
| Accounting software (invoices, statements, reminders) | Set up once by the bookkeeper, then forgotten |
| Newsletter and marketing platforms | Run by marketing on a separate login; ideal for a subdomain |
| CRM and quoting tools | The send button may route through the vendor |
| Practice and property management software | Appointment reminders, tenant notices and portal alerts run quietly |
| Website forms and online booking | The web host sends "from" your address; good web development routes it through authenticated mail |
| Scan-to-email copiers, e-signature, payroll and ticketing tools | Some send as the vendor, some as you; check each |
What about domains you never send email from?
Lock them down. Old brand names, the .com matching your .com.au and domains bought defensively can all be forged, and they're easy to forget. Microsoft's parked-domain guidance:
| Record | Host | Value |
|---|---|---|
| SPF (TXT) | @ | v=spf1 -all |
| DMARC (TXT) | _dmarc | v=DMARC1; p=reject; |
| DKIM | Not applicable | Publish nothing, so no signature can ever verify |
SPF says no server may send; DMARC says reject anything that tries. On Microsoft 365, apply the same DMARC lockdown to your onmicrosoft.com domain if nobody sends from it.
What do Gmail and Outlook now require?
Both enforce authentication, strictest for high-volume senders, according to Google's sender guidelines, Microsoft's Outlook announcement and its 5.7.515 support article.
| Rule | Gmail: all senders | Gmail: bulk senders | Outlook.com: high volume |
|---|---|---|---|
| Who | Anyone sending to personal Gmail accounts | Close to 5,000 or more a day to personal Gmail accounts | Over 5,000 a day to Outlook.com, Hotmail, Live and MSN |
| Authentication | SPF or DKIM | SPF and DKIM, plus DMARC (p=none is fine), aligned with the From domain | SPF and DKIM must pass, plus DMARC of at least p=none, aligned |
| Also note | Forward and reverse DNS, TLS, spam rate under 0.3% | One-click unsubscribe on marketing mail | Rejection with error 550 5.7.515 |
| Since | 1 Feb 2024 | 1 Feb 2024 | 5 May 2025 |
Google counts everything sent from the same primary domain together, subdomains included. A sender that crosses the bulk threshold even once is treated as a bulk sender permanently, and Google says enforcement has ramped up since November 2025, including temporary and permanent rejections.
Not a bulk sender? The floor still applies: Google says unauthenticated mail might be marked as spam or rejected. And since subdomains count too, one campaign reaching around 5,000 personal Gmail addresses in a day could make you a bulk sender for good. Set up all three records now, before a newsletter forces the issue.
Is DMARC free?
The records are: they're text entries at your DNS host, and DKIM signing is built into Microsoft 365. The cost is the work: finding every sender, fixing failures and reading reports. Aggregate reports arrive as XML attachments, and Microsoft warns the data can be vast and difficult to parse. It suggests Power BI reports or an external reporting service, which may charge.
Microsoft 365 checklist: how do you stop email spoofing in Office 365?
Microsoft 365 has no admin page for SPF or DMARC on your own domain, so those records go in at your DNS host.
Check SPF: a single record along the lines of v=spf1 include:spf.protection.outlook.com -all, plus an include for each other sender (see Microsoft's SPF guide).
Enable DKIM:
Microsoft 365 doesn't DKIM-sign mail with your custom domain until you switch it on. In the Defender portal, go to Email & collaboration, Policies & rules, Threat policies, Email authentication settings, DKIM. Publish the two CNAME records shown, then turn on signing (Microsoft's DKIM steps).
Add DMARC: a TXT record at _dmarc reading v=DMARC1; p=none; rua=mailto: plus your reports address.
Close the onmicrosoft.com gap: if unused, add v=DMARC1; p=reject under Settings, Domains in the Microsoft 365 admin centre.
Check inbound: make sure the Honor DMARC record policy setting is on in your anti-phishing policy, so forged supplier mail is junked or rejected when those suppliers publish an enforcing policy.
Review, then enforce: read the reports, fix legitimate failures, then move to quarantine and reject.
Frequently asked questions
DMARC vs DKIM vs SPF: what's the difference?
SPF checks which servers may send for your domain. DKIM checks a signature proving the message came from the signing domain unaltered. DMARC sits on top: it needs SPF or DKIM to pass for the domain in the From line, tells receivers what to do with failures and sends you reports. Each alone leaves gaps, so use all three.
Is DMARC p=reject safe for a small business?
Yes, once your reports show every legitimate sender passing. Reject tells receiving systems to refuse forgeries of your domain, and Microsoft names it as the goal for every domain you own. The danger is getting there too fast, when a forgotten invoicing or booking system will have its mail refused. Monitor, then quarantine, then reject.
Will DMARC stop all phishing emails?
No. It stops forgeries of domains with an enforcing policy, but not lookalike domains, display-name tricks or a hijacked genuine mailbox. Pair it with email filtering, multi-factor authentication, monitoring for odd sign-ins and inbox rules, and a call-back rule: new bank details are never accepted until someone rings the payee on a number you already hold.
Why do our invoices go to junk when we already have SPF?
Often it's alignment. Some billing tools send from their own servers and sign with their own domain, so authentication passes for the vendor, not for your From address. Turn on custom-domain DKIM in the tool or set it to use your domain for bounces, then confirm in your DMARC reports that invoices show as aligned.
Can a domain have two SPF records?
No. Two SPF records on one domain cause a permanent error, so SPF fails for everything you send. Merge them into a single record with one include per service, keep it within 10 DNS lookups including nested includes, and end with -all. If lookups run out, move bulk tools to a subdomain with its own record.
Get your domain checked
Not sure where your domain stands? Ask us to look over your SPF, DKIM and DMARC records during a free IT & Cyber Security Review. It matters most where email moves money: law firms, conveyancers, real estate agencies and accounting practices. To hand it over entirely, see our email security service, or look up any term in the glossary. Call 1300 053 948.
More insights
The $25M deepfake phone call
AI voice cloning lets scammers fake your voice to authorise payments. Here's how Melbourne…
Read article →ScamsScams Prevention Framework for small business
Scams Prevention Framework for small business: from 31 March 2027 banks must act on scams and AFCA…
Read article →PrivacyPrivacy Act reforms 2026
Privacy Act reforms 2026 explained: the draft Bill's 72-hour breach reporting, processor rules and…
Read article →Book your free IT & Cyber Security Review
See exactly where your IT and security stand, and what to fix first. No jargon, no obligation.