DMARC, SPF and DKIM explained: stop people spoofing your email
By Jorge Graells · November 9, 2026 · 7 min read
SPF, DKIM and DMARC are three DNS records that let mail servers check whether an email using your domain really came from you. Set up properly, they stop fake emails that use your exact address. What each one does, why Outlook requires them and how to set them up step by step.
DMARC, SPF and DKIM explained: stop people spoofing your email
- Type
- Article
- Author
- Jorge Graells
- Date
- Reading time
- 7 min read
- Subjects
Summary
SPF, DKIM and DMARC are three DNS records that let mail servers check whether an email using your domain really came from you. Set up properly, they stop fake emails that use your exact address. What each one does, why Outlook requires them and how to set them up step by step.
A supplier gets an email that appears to come from your company. The sender address is yours, with your exact domain, and the message asks them to use a new bank account from now on. You never sent it. Whether that's possible, or whether the receiving server rejects it before anyone reads it, depends to a large extent on three DNS records that hardly anyone looks at: SPF, DKIM and DMARC.
They're the three pieces that let a mail server check whether a message claiming to come from your domain really does. Without them, it's easy for anyone to send email with your address as the sender. And Microsoft already requires them from anyone who sends a lot of email to Outlook.com.
◢What are SPF, DKIM and DMARC?
The UK's National Cyber Security Centre (NCSC)1 sums them up like this in its guidance on email spoofing:
- ▹SPF (Sender Policy Framework) is a list, published in your domain's DNS, of the servers and IP addresses allowed to send email on your behalf.
- ▹DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every message you send. The receiver checks it against a public key that's also in your DNS, so it knows the email came from your domain and wasn't changed along the way.
- ▹DMARC (Domain-based Message Authentication, Reporting and Conformance) tells the receiving server what to do with email that claims to be from you but fails those checks: let it through, send it to spam or reject it. It also produces reports so you can see who is sending email using your domain.
All three are text records in your domain's DNS, the same place your website is configured. Nothing needs installing on your staff's computers.
◢Why do I need DMARC if I already have SPF?
SPF and DKIM check things on their own, but they don't say what should happen when a check fails. DMARC makes that call. DMARC also requires what Microsoft calls alignment in the FAQ to its sender requirements2: the domain the recipient sees in the From address has to match the one validated by SPF or DKIM. That's what stops an attacker from passing the checks with a domain of their own while showing yours.
Be clear about the limit, though. DMARC protects your exact domain. If someone registers a lookalike, with one letter swapped or an extra word, that domain is theirs and they can configure it however they like. Against that, people still need to look carefully at the sender, as I explain in how to spot a phishing email.
◢Why is Outlook rejecting emails without DMARC?
Because Microsoft has required it from bulk senders since May 2025. In its announcement for Outlook.com2, its consumer email service covering hotmail.com, live.com and outlook.com addresses, Microsoft said that domains sending more than 5,000 emails a day must pass SPF, pass DKIM and have DMARC with at least a p=none policy, aligned with SPF or DKIM. According to its 29 April 2025 update, messages that don't comply are rejected with the error "550; 5.7.515 Access denied".
If you send less than that, the rule doesn't apply to you, but Microsoft recommends the same practices to every sender because they protect your reputation. It also points out that if you send through an outside company, such as a newsletter platform, the records are still your responsibility: they live in your domain, and you need to work with the provider to get them right.
If you ever get a bounce mentioning authentication when writing to a Hotmail or Outlook address, these three records are the first thing to check.
◢How to set up DMARC step by step
The NCSC recommends doing it gradually, because a strict policy set up wrongly can stop your own legitimate email from arriving. Its implementation plan3 works in phases.
- ▹List everything that sends email using your domain. Not just your own server or your Microsoft 365 or Google Workspace, but also the marketing newsletter tool, the invoicing system, the CRM and the website that sends notifications. The NCSC advises asking every department whether they use outside sending services.
- ▹Set up SPF with those services and turn on DKIM in each one. With cloud email this is usually an option in the admin panel.
- ▹Publish DMARC in monitoring mode. According to the NCSC guidance4, it's a TXT record named
_dmarc.yourdomain.comwith a value such asv=DMARC1;p=none;rua=mailto:reports@yourdomain.com. A p=none policy doesn't affect how your email is delivered, it just sends you reports. The NCSC says the first ones arrive from the major providers within 24 hours. - ▹Read the reports and fix what they show. You'll see which services send on your behalf and whether they pass or fail. That's where the ones you forgot turn up, along with anyone spoofing your domain.
- ▹Move to p=quarantine. Email that fails will go to the recipient's spam folder, where it can still be recovered. The NCSC notes5 that many organisations take this step after about 6 to 8 weeks, and recommends applying it to only part of your email at first with the pct tag, then increasing it.
- ▹Finish at p=reject. With this policy, fake emails are rejected. The NCSC calls it the best way to prevent spoofing6, and many organisations get there around three months after quarantine.
Before each policy change, give marketing and communications a heads-up. A mass mailing from a tool that isn't in your records is exactly what will fail.
◢Common SPF and DKIM mistakes
The most common one is SPF's lookup limit. According to the NCSC7, an SPF check can't make more than 10 DNS lookups, and each provider's include: can count for several. With three or four cloud services it's easy to go over, and then SPF fails even though everything looks fine. The record also shouldn't exceed 450 characters. The NCSC's fix is to split sending across subdomains, for example one for newsletters.
Another frequent mistake is copying an example record as it is. Each provider gives you its exact values.
For DKIM, if you run your own servers, the NCSC recommends 2048-bit keys rotated every 12 months, according to its DKIM guidance8. And any signature or legal disclaimer added to the footer has to be added before signing, because if the message changes afterwards the signature no longer holds.
◢What about domains that don't send email?
They need protecting too. Many companies register variations of their name or keep old domains they no longer use, and any of them can be used to send fake emails that look like yours. The NCSC recommends starting with exactly those9, because they're the easiest and need no maintenance: an SPF record that authorises nobody (v=spf1 -all), a DMARC record set straight to p=reject, and a null MX record so they don't accept email.
◢What each person can do
If you run a small business, you don't need to know how to write these records, but you should ask whoever handles your IT or your domain two questions: do we have SPF, DKIM and DMARC, and which policy is DMARC on? If the answer is "I don't know" or "p=none for years", there's work to do. The NCSC offers a free check1 that tests how a domain is configured.
If you're the one doing the technical work, follow the order above and don't jump to p=reject without reading the reports.
For everyone else on the team, the lesson is different: a well-protected domain stops emails that use your exact address, not those using a similar one, and not those sent from the real account of someone whose password was stolen. That's why confirming through another channel before changing bank details or making an urgent payment is still essential, as I explain in how to spot CEO fraud.
Getting to a strict DMARC policy takes a few months, most of it spent watching reports. Teaching people to distrust what doesn't add up is the other half, and it's what I work on in my cybersecurity training for companies.
Related documents
- News
Claude Fable 5.2 and Mythos 5.2: what's new from Anthropic
Anthropic launches Claude Fable 5.2, open to everyone with cybersecurity and biology safeguards, and Mythos 5.2, the same model without those brakes for vetted organizations. What improves, the cybersecurity part, where it is and what it costs.
- Article
Voice deepfake of your boss: how to verify a call is real
A voice deepfake uses AI to imitate a specific person, such as your boss, to ask you for an urgent payment. Don't try to judge it by ear: hang up, call back on the number you already have, and make sure no payment can be approved by phone alone.
- News
mittwald hosting breached through its MCP server for AI
German hosting provider mittwald suffered an attack that got in through the MCP server its customers used to connect AI assistants. Session tokens were stolen and 56 projects compromised. What we know and what to check if you use AI connectors.