Cybersecurity
SPF, DKIM and DMARC: understanding and protecting your business email
Three DNS settings that stop fraudsters from sending email in your name — and improve delivery of your real messages.
By the SolutionsCW team7 min read
Anyone can write “your” address
Email was designed without identity verification: by default, nothing stops a fraudster from sending a message showing your domain as the sender. This is the mechanism behind CEO fraud and fake billing emails sent to your customers in your name. Three complementary mechanisms, configured in your domain’s DNS, fix this flaw.
SPF: the list of authorized senders
SPF (Sender Policy Framework) is a DNS record declaring which servers may send email for your domain — for example your email provider’s servers and your newsletter platform. The receiving server checks this list; a message from elsewhere fails the test. The classic mistake: forgetting a legitimate service (invoicing software, website form), which sends your own messages to spam.
DKIM: the signature that proves origin
DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing message. The receiving server verifies it with a public key published in your DNS. Unlike SPF, the signature survives forwarding and guarantees the content was not altered in transit. It is enabled in your email provider’s console, then published in DNS.
DMARC: the policy and the reports
DMARC ties the two together: it tells receivers what to do when SPF and DKIM fail (monitor, quarantine or reject) and requires the domain visible to the reader to align with the authenticated one. It also provides reports showing who sends email with your domain — including misconfigured legitimate services and fraudulent attempts.
Caution is required: start with a monitoring policy (p=none), fix the legitimate services spotted in the reports, then gradually tighten toward quarantine and finally reject. Jumping straight to reject without an inventory loses real email.
Practical implementation
Configuration touches your domain’s DNS: a mistake can interrupt your email delivery. SolutionsCW inventories your sending services, configures SPF, DKIM and DMARC in the right order, monitors reports and tightens the policy progressively — without service interruption. It is also a deliverability asset: major providers now require these mechanisms from bulk senders.
Sources and references
- Centre pour la cybersécurité du Canada — Sécurité du courriel
- Google — Exigences pour les expéditeurs de courriels
Products and rules can change. Check official sources before making a decision. SolutionsCW guides are informational and are not legal advice.