If you've ever had someone reply "did you really send this?" to an email you never sent, the missing piece was probably one of these three DNS records.

SPF (Sender Policy Framework)

SPF is a DNS record that lists which mail servers are allowed to send email on behalf of your domain. When another mail server receives a message claiming to be from you, it checks this list — if the sending server isn't on it, the message can be flagged or rejected.

DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to outgoing email, tied to a private key only your mail system has. The receiving server checks that signature against a public key published in your DNS — if it matches, the message wasn't altered in transit and genuinely came from your system.

DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC ties SPF and DKIM together and tells receiving servers what to do if a message fails both checks — quarantine it, reject it outright, or (during initial setup) just monitor and report on it. DMARC is also what gives you visibility: it can send you reports showing who is sending email using your domain, which is often how spoofing attempts get discovered in the first place.

How to Check Your Domain

1. Use a free DNS lookup tool (such as MXToolbox) and search your domain for SPF, DKIM, and DMARC records.
2. If any are missing, work with your IT provider or domain host to add them — DMARC in particular should start in monitoring-only mode ("p=none") before moving to enforcement, to avoid accidentally blocking your own legitimate mail while it's being set up.

Common Questions

Do I need all three?

SPF and DKIM alone provide some protection, but DMARC is what actually enforces action and gives you reporting — without it, a failed SPF or DKIM check doesn't necessarily stop anything from reaching the recipient's inbox.

Will this stop all phishing aimed at my company?

No — these records only control who can send email that claims to be from your own domain. They don't stop a look-alike domain (like yourcompany-billing.com) or a compromised vendor account from emailing your team, which is why staff training and link/attachment checks still matter alongside this.