Stop Scammers Sending Email as Your Business: SPF, DKIM and DMARC in Plain English

Here's an uncomfortable fact: unless your domain is set up properly, anyone can send an email that appears to come from you@yourbusiness.co.uk. Scammers use this to send fake invoices to your customers, or "change of bank details" emails that look completely genuine.

Three settings stop it: SPF, DKIM and DMARC. They also help your real emails land in inboxes instead of spam folders. They sound technical, but each one is a single line added to your domain's settings, and your email provider tells you exactly what to add.

Where these settings live

All three are DNS records: small text entries stored wherever your domain's DNS is managed. That's usually your domain registrar (such as IONOS, GoDaddy or 123 Reg), your web host, or a service like Cloudflare. If you're not sure, the company that sends your domain renewal bill is a good place to start.

SPF: who is allowed to send email for you

SPF (Sender Policy Framework) is a list of the services allowed to send email using your domain. When a receiving mail server gets a message "from" you, it checks whether the server that sent it is on your list.

An SPF record is a TXT record that looks something like this:

v=spf1 include:spf.protection.outlook.com include:_spf.google.com ~all

Each include: is a service allowed to send for you, such as Microsoft 365, Google Workspace, Zoho, or your newsletter tool.
~all at the end means "treat anything else as suspicious". -all is stricter: "reject anything else".

Common mistakes:

Having two SPF records. You can only have one. Combine everything into a single line.
Forgetting a service. If your website's contact form, booking system or newsletter sends email as your domain, it needs to be included, or those emails may go to spam.
Too many includes. SPF allows a maximum of 10 DNS lookups, so remove services you no longer use.

DKIM: a tamper-proof signature

DKIM (DomainKeys Identified Mail) adds a hidden digital signature to every email you send. The receiving server checks the signature against a public key in your DNS. If the email was forged or changed on the way, the check fails.

You don't need to understand the cryptography. In your email provider's admin settings, look for "DKIM" or "domain authentication", switch it on, and copy the record (or records) it gives you into your DNS. Do the same in your newsletter tool if you use one.

DMARC: what to do when the checks fail

DMARC ties SPF and DKIM together. It tells receiving servers what to do with an email that claims to be from you but fails the checks, and it can send you reports showing who is sending email using your domain.

A DMARC record is a TXT record named _dmarc and looks like this:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourbusiness.co.uk

The important part is p=, the policy:

p=none: just monitor and send reports. Start here.
p=quarantine: send failing emails to spam.
p=reject: block failing emails completely. This is the goal.

Start with p=none for a few weeks and read the reports (or use a free DMARC report service to make sense of them). Once you're sure all your genuine email passes, move to quarantine and then reject.

Why this matters more than it used to

Since February 2024, Google and Yahoo have required everyone sending to Gmail and Yahoo addresses to have at least SPF or DKIM set up, and bulk senders (over 5,000 messages a day to Gmail) must have SPF, DKIM and DMARC. Even if you only send a few emails, setting up all three makes it much more likely your quotes and invoices reach your customers.

Don't forget domains you don't use for email

Got a second domain that just points to your website, or an old one you're keeping hold of? Scammers can spoof those too. If a domain never sends email, add these two records to say so:

SPF: v=spf1 -all
DMARC (on _dmarc): v=DMARC1; p=reject;

A quick checklist

Find out who manages your domain's DNS.
List every service that sends email as your domain: your mailbox provider, website forms, booking system, newsletter tool.
Create one SPF record that includes them all.
Switch on DKIM in each service and add its records.
Add a DMARC record with p=none and a reporting address.
After a few weeks of clean reports, move to p=quarantine, then p=reject.

Check what your website and domain reveal

Email security is one part of the picture. Our sister service SecureSiteCheck runs a free quick check that shows who appears to host your website, DNS and email, plus your HTTPS setup and security headers. For the rest, see our small business website security checklist.

Disclosure: SecureSiteCheck is run by the same team as Future Tech Blog.