Do I need all three of SPF, DKIM and DMARC?

Yes. SPF and DKIM each authenticate mail in a different way, and DMARC is what ties them to the From address people see and tells receivers to reject spoofed mail. Google, Yahoo and Microsoft require all three from high-volume senders and SPF or DKIM from everyone else.

What does DMARC p=reject do?

It tells receiving mail systems that a message using your domain that fails both SPF and DKIM should be rejected; in practice it is usually discarded. It is the policy that actually stops spoofing, and the one to work towards after monitoring at p=none.

Will DMARC stop all phishing emails?

No. It stops criminals sending mail as your exact domain. It does nothing about look-alike domains, compromised accounts at suppliers, or phishing from free webmail addresses, so you still need filtering, multi-factor authentication and staff awareness.

Can setting up DMARC stop my own email being delivered?

Only if you move to quarantine or reject before every legitimate sender is in SPF or signing with DKIM. That is why the rollout starts at p=none with reports switched on: the reports show you every service sending as your domain before any mail is blocked.

Does Microsoft 365 set this up automatically?

Partly. Microsoft 365 provides an SPF include and DKIM signing for your domain, but you have to publish the DNS records, enable DKIM for each custom domain, add any third-party senders, and create the DMARC record yourself. Nothing protects the domain until the DMARC policy is quarantine or reject.

SPF, DKIM and DMARC explained for business owners: how do you stop email spoofing?

SPF, DKIM and DMARC are three records in your domain's DNS that together stop criminals sending email that appears to come from your business. SPF lists which servers may send mail for your domain, DKIM adds a tamper-proof signature to each message, and DMARC tells receiving mail systems what to do when a message fails those checks and sends you reports on who is using your domain ^{1Source 1Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configureAccessed 3 November 2026See in Sources}^{2Source 2RFC 6376: DomainKeys Identified Mail (DKIM) Signatures — Internet Engineering Task Force, September 2011.datatracker.ietf.org/doc/rfc6376/Accessed 3 November 2026See in Sources}^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}. Without them, anyone can put your address in the From line, and the mail is often delivered. With DMARC set to p=reject, Google, Microsoft and Yahoo discard it. Since 2024 all three have also required SPF, DKIM and DMARC from anyone sending them more than 5,000 messages a day, and SPF or DKIM from everyone else, so the records now affect whether your own email arrives at all ^{4Source 4Email sender guidelines — Google Workspace Admin Help.support.google.com/a/answer/81126Accessed 3 November 2026See in Sources}^{5Source 5Sender best practices — Yahoo Senders Hub.senders.yahooinc.com/best-practices/Accessed 3 November 2026See in Sources}^{6Source 6Strengthening email ecosystem: Outlook's new requirements for high-volume senders — Microsoft Tech Community, updated 30 April 2025.techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730Accessed 3 November 2026See in Sources}.

The short version

SPF: which servers may send as you. DKIM: a signature that proves the message wasn't altered. DMARC: the policy and the reports ^{1Source 1Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configureAccessed 3 November 2026See in Sources}^{2Source 2RFC 6376: DomainKeys Identified Mail (DKIM) Signatures — Internet Engineering Task Force, September 2011.datatracker.ietf.org/doc/rfc6376/Accessed 3 November 2026See in Sources}^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}.
A message passes DMARC if SPF or DKIM passes and the domain lines up with the From address; it fails only if both fail ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}.
Set DMARC to p=none first and read the reports, then move to quarantine, then reject ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}.
The usual failures are a forgotten third-party sender, too many SPF lookups, or a subdomain nobody protected ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}^{7Source 7Email security and anti-spoofing — National Cyber Security Centre (NCSC), collection, 2019.www.ncsc.gov.uk/collection/email-security-and-anti-spoofingAccessed 3 November 2026See in Sources}.

Why does email spoofing matter to a small business?

Because the losses are real and the mail looks like yours. UK Finance's 2026 fraud report records £41.3 million lost to invoice and mandate scams in 2025, with 68% of that on business accounts, and notes the criminal typically intercepts emails or compromises an email account ^{8Source 8Annual Fraud Report 2026 — UK Finance, June 2026.www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdfAccessed 3 November 2026See in Sources}. CEO fraud, where a criminal accesses the company's email or uses spoofing software to email the finance team, cost an average of just over £28,000 per confirmed case ^{8Source 8Annual Fraud Report 2026 — UK Finance, June 2026.www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdfAccessed 3 November 2026See in Sources}. In the Government's 2025/2026 survey, 12% of UK businesses reported people impersonating the organisation or its staff in emails or online, and phishing remained by far the most common attack ^{9Source 9Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026Accessed 3 November 2026See in Sources}. Email authentication doesn't stop every phishing email, but it stops the ones that use your own domain.

What do SPF, DKIM and DMARC actually do?

The three email authentication records, in plain English
Record	What it is	What it protects against	What it can't do
SPF (Sender Policy Framework)	A DNS text record listing the servers allowed to send email for your domain, such as Microsoft 365 and your invoicing tool ^{1Source 1Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configureAccessed 3 November 2026See in Sources}	A stranger's server sending mail with your domain in the envelope	Forwarded mail breaks it, and it only checks the hidden envelope address, not the From line people see ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}
DKIM (DomainKeys Identified Mail)	A digital signature added to each outgoing message, checked against a public key in your DNS ^{2Source 2RFC 6376: DomainKeys Identified Mail (DKIM) Signatures — Internet Engineering Task Force, September 2011.datatracker.ietf.org/doc/rfc6376/Accessed 3 November 2026See in Sources}	Messages being altered in transit, and spoofing of the visible domain	Only mail your systems sign; a message with no signature simply isn't checked
DMARC (Domain-based Message Authentication, Reporting and Conformance)	A DNS record that says what receivers should do when SPF and DKIM both fail, and where to send reports ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}	Spoofing of the From address your customers see, once the policy is quarantine or reject	Nothing until you move past p=none, and it never protects a domain with no record at all

DMARC adds one idea the other two lack: alignment. The domain that passed SPF or DKIM must match the domain in the From line, loosely by default (subdomains allowed) or exactly in strict mode ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}. That is what connects the technical checks to the address a person actually reads.

What do p=none, p=quarantine and p=reject mean?

DMARC policy values (Microsoft Learn, read 3 November 2026)
Policy	What the receiver does with mail that fails	When to use it
p=none	Nothing; it is delivered as normal, but the failure is reported to you ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}	The starting point, for testing and tuning, while you find every legitimate sender ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}
p=quarantine	The message is accepted but marked, which usually means the junk folder ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}	Once the reports show your genuine mail passing
p=reject	The message should be rejected; what happens depends on the receiving system, but it is typically discarded ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}	The goal: spoofed mail using your domain never reaches the inbox

The reports are the part business owners miss. The rua address in your record receives an aggregate report, typically once a day, from each receiver, showing which servers sent mail as your domain and whether it passed ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}. Not every receiver sends them; coverage is typically 70% to 90% of mail volume ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}. A free or low-cost DMARC reporting service turns the XML into a readable dashboard.

Why do Google, Microsoft and Yahoo's sender rules matter?

Since February 2024, Google and Yahoo have required every sender to authenticate with SPF or DKIM, to have valid forward and reverse DNS, and to keep spam complaints below 0.3% ^{4Source 4Email sender guidelines — Google Workspace Admin Help.support.google.com/a/answer/81126Accessed 3 November 2026See in Sources}^{5Source 5Sender best practices — Yahoo Senders Hub.senders.yahooinc.com/best-practices/Accessed 3 November 2026See in Sources}. Senders of more than 5,000 messages a day to Gmail or Yahoo must have SPF and DKIM, a DMARC policy of at least p=none, a From domain aligned with SPF or DKIM, and one-click unsubscribe on marketing mail ^{4Source 4Email sender guidelines — Google Workspace Admin Help.support.google.com/a/answer/81126Accessed 3 November 2026See in Sources}^{5Source 5Sender best practices — Yahoo Senders Hub.senders.yahooinc.com/best-practices/Accessed 3 November 2026See in Sources}. Microsoft applied the same requirements to Outlook.com, Hotmail and Live addresses from 5 May 2025, routing mail from non-compliant high-volume domains to the junk folder, with outright rejection planned for a date to be announced ^{6Source 6Strengthening email ecosystem: Outlook's new requirements for high-volume senders — Microsoft Tech Community, updated 30 April 2025.techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730Accessed 3 November 2026See in Sources}.

A 20-person business rarely sends 5,000 messages a day, but its newsletter platform, invoicing system or CRM might, on a shared domain. And the baseline rules apply to everyone: unauthenticated mail to Gmail "might be marked as spam or rejected" ^{4Source 4Email sender guidelines — Google Workspace Admin Help.support.google.com/a/answer/81126Accessed 3 November 2026See in Sources}. Setting the records up is now as much about your own deliverability as about fraud.

How do you check your own domain?

NCSC Email Security Check (checkcybersecurity.service.ncsc.gov.uk/email-security-check): the National Cyber Security Centre's free checker for any UK domain; it needs no sign-up and reports on your anti-spoofing and encryption settings ^{7Source 7Email security and anti-spoofing — National Cyber Security Centre (NCSC), collection, 2019.www.ncsc.gov.uk/collection/email-security-and-anti-spoofingAccessed 3 November 2026See in Sources}.
MxToolbox DMARC Check (mxtoolbox.com/DMARC.aspx): parses your DMARC record and explains each tag; the same site checks SPF, DKIM and MX records ^{10Source 10DMARC Check Tool — MxToolbox.mxtoolbox.com/DMARC.aspxAccessed 3 November 2026See in Sources}.
dmarcian DMARC Record Checker (dmarcian.com/dmarc-inspector/): a free inspector that shows your policy and flags errors ^{11Source 11DMARC Record Checker (DMARC Inspector) — dmarcian.dmarcian.com/dmarc-inspector/Accessed 3 November 2026See in Sources}.
Google Admin Toolbox Check MX (toolbox.googleapps.com/apps/checkmx/): checks MX and SPF records, with a DKIM selector field ^{12Source 12Check MX — Google Admin Toolbox.toolbox.googleapps.com/apps/checkmx/Accessed 3 November 2026See in Sources}.

What you want to see: one SPF record ending in -all with fewer than ten DNS lookups, DKIM signing on for your mail system and every third-party sender, and a DMARC record with a reporting address and a policy of quarantine or reject.

In what order should you roll them out?

1.List every service that sends email as your domain: your mail platform, invoicing and accounting software, CRM, helpdesk, newsletter tool, website forms, scanners and printers.
2.Publish SPF covering all of them. Microsoft's guidance is to use -all rather than ~all, because a soft fail can leave DMARC effectively ignored for unsigned mail ^{1Source 1Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configureAccessed 3 November 2026See in Sources}.
3.Turn on DKIM signing in your mail platform and in each third-party service, using your own domain so the signature aligns ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}.
4.Publish DMARC with p=none and a reporting address, and watch the reports for a few weeks. Microsoft's own advice is to start at none and monitor ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}.
5.Move to p=quarantine, then p=reject, fixing each legitimate sender the reports reveal. Do subdomains first and the main domain last ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}.
6.Protect domains that never send email with v=spf1 -all and a DMARC policy of reject, including your onmicrosoft.com domain if it isn't used for mail ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}.

What usually goes wrong?

Too many SPF lookups. SPF allows ten DNS lookups; go over and every message fails with a permanent error, even though the record looks fine ^{1Source 1Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configureAccessed 3 November 2026See in Sources}^{13Source 13RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1 — Internet Engineering Task Force, April 2014.datatracker.ietf.org/doc/rfc7208/Accessed 3 November 2026See in Sources}. Fewer than ten include statements doesn't guarantee fewer than ten lookups, because includes nest ^{1Source 1Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configureAccessed 3 November 2026See in Sources}.
Two SPF records. A second record for the same domain also causes a permanent error ^{1Source 1Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configureAccessed 3 November 2026See in Sources}.
A sender nobody listed. The most common DMARC failure is a service that isn't in SPF and doesn't sign with DKIM, or one that signs with its own domain instead of yours ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}. Fix it at the service, or move bulk mail to a dedicated subdomain ^{1Source 1Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configureAccessed 3 November 2026See in Sources}.
Forwarding and mailing lists. Forwarding breaks SPF and some list software alters the body and breaks DKIM; that is normal, and the answer is ARC support or accepting a few failures rather than staying on p=none for ever ^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}.
Subdomains. DMARC on the main domain covers subdomains automatically, but each subdomain that sends mail needs its own SPF record ^{1Source 1Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configureAccessed 3 November 2026See in Sources}^{3Source 3Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configureAccessed 3 November 2026See in Sources}.
Stopping at p=none. Monitoring mode reports spoofing; it doesn't stop it. Among the FTSE 250, 19% were still at p=none in May 2026 and 7% had no DMARC record at all ^{14Source 14UK FTSE 250 DMARC report — Red Sift, 12 May 2026 (vendor study).redsift.com/blog/uk-ftse-250-dmarc-reportAccessed 3 November 2026See in Sources}.

How does BTNI help, and how can you check for free?

SPF, DKIM and DMARC are set up and monitored as part of BTNI's Cybersecurity and Microsoft 365 services, with the reports read by someone rather than filed. If you'd like your own domain checked, request the Business Technology Buyer's Guide: your copy arrives with an invitation to a complimentary external security assessment of your email domain and public-facing systems, with the results emailed to you.

Sources

1.Set up SPF to identify valid email sources for your Microsoft 365 domain — Microsoft Learn, updated 17 July 2026.↩https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure — accessed 3 November 2026
2.RFC 6376: DomainKeys Identified Mail (DKIM) Signatures — Internet Engineering Task Force, September 2011.↩https://datatracker.ietf.org/doc/rfc6376/ — accessed 3 November 2026
3.Set up DMARC to validate the From address domain for senders in Microsoft 365 — Microsoft Learn, updated 17 July 2026.↩https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure — accessed 3 November 2026
4.Email sender guidelines — Google Workspace Admin Help.↩https://support.google.com/a/answer/81126 — accessed 3 November 2026
5.Sender best practices — Yahoo Senders Hub.↩https://senders.yahooinc.com/best-practices/ — accessed 3 November 2026
6.Strengthening email ecosystem: Outlook's new requirements for high-volume senders — Microsoft Tech Community, updated 30 April 2025.↩https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/strengthening-email-ecosystem-outlook%E2%80%99s-new-requirements-for-high%E2%80%90volume-senders/4399730 — accessed 3 November 2026
7.Email security and anti-spoofing — National Cyber Security Centre (NCSC), collection, 2019.↩https://www.ncsc.gov.uk/collection/email-security-and-anti-spoofing — accessed 3 November 2026
8.Annual Fraud Report 2026 — UK Finance, June 2026.↩https://www.ukfinance.org.uk/system/files/2026-06/UK%20Finance%20Fraud%20Report%202026.pdf — accessed 3 November 2026
9.Cyber security breaches survey 2025/2026 — Department for Science, Innovation and Technology (official statistics), 30 April 2026.↩https://www.gov.uk/government/statistics/cyber-security-breaches-survey-20252026/cyber-security-breaches-survey-20252026 — accessed 3 November 2026
10.DMARC Check Tool — MxToolbox.↩https://mxtoolbox.com/DMARC.aspx — accessed 3 November 2026
11.DMARC Record Checker (DMARC Inspector) — dmarcian.↩https://dmarcian.com/dmarc-inspector/ — accessed 3 November 2026
12.Check MX — Google Admin Toolbox.↩https://toolbox.googleapps.com/apps/checkmx/ — accessed 3 November 2026
13.RFC 7208: Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1 — Internet Engineering Task Force, April 2014.↩https://datatracker.ietf.org/doc/rfc7208/ — accessed 3 November 2026
14.UK FTSE 250 DMARC report — Red Sift, 12 May 2026 (vendor study).↩https://redsift.com/blog/uk-ftse-250-dmarc-report — accessed 3 November 2026

See where your business stands

A Business Technology Review turns these ideas into a clear, prioritised plan for your business.

Book Your Business Technology Review

Or start smaller: Discover Your TechState™ Index

SPF, DKIM and DMARC explained for business owners: how do you stop email spoofing?

The short version

Why does email spoofing matter to a small business?

What do SPF, DKIM and DMARC actually do?

What do p=none, p=quarantine and p=reject mean?

Why do Google, Microsoft and Yahoo's sender rules matter?

How do you check your own domain?

In what order should you roll them out?

What usually goes wrong?

How does BTNI help, and how can you check for free?

Sources

See where your business stands

Quick answers

Keep reading

Microsoft 365 vs Google Workspace for a small UK business: which should you choose?

What does Microsoft 365 Business Premium include, and does a small business in Northern Ireland need it?

Do professional firms need Cyber Essentials?

Ready to run your business on its technology?