SPF, DKIM and DMARC explained for small teams
2 min read · Updated October 15, 2026
SPF lists which servers may send mail for your domain, DKIM adds a digital signature proving a message was not altered and DMARC tells receivers what to do when checks fail. Together they make it much harder for criminals to spoof your domain.
What each one does
- ✓SPF (Sender Policy Framework): a DNS record listing the servers allowed to send mail for your domain.
- ✓DKIM (DomainKeys Identified Mail): a cryptographic signature added to outgoing messages and verified using a DNS record.
- ✓DMARC: a policy that ties SPF and DKIM to the visible From address and tells receivers to monitor, quarantine or reject failures.
Why they matter
Without them, anyone can send mail that appears to come from your domain. That means fake invoices to your customers and phishing that uses your name. With them, receiving servers can detect and block most forged messages.
See how exposed your team’s email is
Leaked work emails fuel phishing and account takeover. Review your company’s exposure with a corporate audit.
How to roll them out safely
- ✓List every service that sends mail for you: your mailbox provider, newsletter tools, billing systems.
- ✓Publish SPF and enable DKIM signing in each service.
- ✓Start DMARC in monitoring mode and review the reports.
- ✓Fix any legitimate senders that fail, then move toward quarantine or reject.
Where to find your settings
These are DNS records managed where your domain is registered or hosted. Your email provider’s documentation explains the exact values for each record type.
Frequently asked questions
Does DMARC stop phishing entirely?+
It stops direct spoofing of your domain. Lookalike domains and compromised accounts still need other defences.
Do I need all three?+
Yes. They work together, and DMARC depends on SPF or DKIM.
Can I check my configuration?+
Free online tools can look up and validate your DNS records.
Stop guessing. Check your email in seconds.
The free Leakill check looks for your email address in known breach records and tells you whether it was exposed. If it was, an optional detailed report lists the incidents, dates, sources, the kinds of data involved and practical next steps. It is a one-off report, not a subscription.
A breach match is a warning signal, not proof that someone has access to your account today. No public database covers every breach, so a clean result lowers risk without guaranteeing safety.