If someone can send an email that looks like it came from your domain, your customers, suppliers and staff are at risk, and so is your reputation. SPF, DKIM and DMARC are three email authentication standards that work together to stop that. They are also now expected by the big mail providers. Here is what each one does and how to set them up for Microsoft 365.
SPF: who is allowed to send
Sender Policy Framework (SPF) is a DNS record that lists the servers allowed to send email for your domain. Receiving servers check it and flag mail from anywhere else. A typical record for a business using only Microsoft 365 looks like this:
v=spf1 include:spf.protection.outlook.com -all
If you also send mail from other services, such as a marketing platform or accounting system, each must be added. SPF is limited to ten DNS lookups, so keep the record tidy, and you can only have one SPF record per domain.
DKIM: proving the message was not altered
DomainKeys Identified Mail (DKIM) adds a digital signature to outgoing mail. The receiver checks the signature against a public key in your DNS to confirm the message really came from your domain and was not changed in transit. In Microsoft 365 you publish two CNAME records (selector1 and selector2) for each domain and then enable DKIM signing in the Microsoft Defender portal under email authentication settings.
DMARC: enforce and report
Domain-based Message Authentication, Reporting and Conformance (DMARC) ties SPF and DKIM together. It tells receiving servers what to do with mail that fails authentication: nothing, quarantine it or reject it. It also sends you reports showing who is sending email using your domain. A starter record looks like this:
v=DMARC1; p=none; rua=mailto:[email protected]
Why these records matter for Microsoft 365
- They make it much harder for criminals to impersonate your business to your customers and staff.
- They improve email delivery, because authenticated mail is trusted more.
- Large providers including Google, Yahoo and Microsoft now expect authentication from bulk senders.
- They give you visibility of every system sending email as your domain.
Recommended setup
- List every sender. Find all the systems that send email using your domain.
- Publish SPF including Microsoft 365 and any approved services.
- Enable DKIM for every domain and for third-party senders that support it.
- Publish DMARC at p=none and collect reports for a few weeks.
- Fix the gaps that the reports reveal.
- Move to quarantine, then reject. Increase enforcement gradually until p=reject protects your domain fully.
How to check your records
You can look up a domain’s records with free online DNS and email authentication checkers, or with PowerShell using the Resolve-DnsName command. Send a test email to an external address and view the message headers to confirm SPF, DKIM and DMARC all show as pass.
Common mistakes
- More than one SPF record on a domain.
- Forgetting a third-party sender, then blocking its mail when enforcement starts.
- Leaving DMARC at p=none forever, which reports but does not protect.
- Ignoring parked or unused domains, which criminals can also spoof.
Key takeaways
- SPF lists the servers allowed to send email for your domain, DKIM signs outgoing mail, and DMARC tells receiving servers what to do with mail that fails.
- A starter DMARC record uses p=none to collect reports before you move towards quarantine or reject.
- Large providers including Google, Yahoo and Microsoft now expect authentication from bulk senders.
DMARC: frequently asked questions
What do SPF, DKIM and DMARC each do?
SPF is a DNS record that lists the servers allowed to send email for your domain. DKIM adds a digital signature to outgoing mail that receivers check against a public key in your DNS. DMARC ties the two together, tells receiving servers whether to do nothing, quarantine or reject mail that fails, and sends you reports.
How do you set up DKIM in Microsoft 365?
You publish two CNAME records, selector1 and selector2, for each domain and then enable DKIM signing in the Microsoft Defender portal under email authentication settings.
Are there limits on SPF records?
Yes. SPF is limited to ten DNS lookups, so keep the record tidy, and you can only have one SPF record per domain. Every other service that sends mail as your domain, such as a marketing platform or accounting system, must be added.
Related reading: Exchange Online and business email.
Total Solutions IT can audit your email authentication and take you safely through to DMARC enforcement. Call 02 6061 4222 to get started.
