SPF, DKIM and DMARC Explained for Small Business

Why Email Authentication Matters

Every day, attackers send millions of emails pretending to come from legitimate businesses. They impersonate banks, suppliers, government agencies — and your business. Without email authentication, there is nothing stopping someone from sending an email that appears to come from [email protected] to your customers, staff or suppliers.

This is not a theoretical risk. The ACSC identifies email as the primary attack vector for Australian businesses, and business email compromise (BEC) cost Australian organisations over $79 million in the 2022–23 financial year alone.

Three protocols work together to solve this problem: SPF, DKIM and DMARC. Individually, each provides partial protection. Together, they form a robust defence that verifies the authenticity of every email sent from your domain.

SPF: Sender Policy Framework

What It Does

SPF tells the world which mail servers are authorised to send email on behalf of your domain. When a receiving server gets an email claiming to be from your domain, it checks your SPF record to see if the sending server is on the approved list. If not, the email can be flagged or rejected.

How It Works

SPF is a DNS TXT record published on your domain. It looks something like this:

v=spf1 include:_spf.google.com include:servers.mcsv.net -all

This example says: “Only Google Workspace and Mailchimp are allowed to send email from this domain. Reject everything else.”

Key Points for SMEs

• You almost certainly need to include your email provider (Microsoft 365, Google Workspace, etc.)
• Include any third-party services that send email on your behalf (Xero, Mailchimp, your website’s contact form)
• End your SPF record with -all (hard fail) rather than ~all (soft fail) for maximum protection
• You can only have one SPF record per domain — multiple records cause failures

DKIM: DomainKeys Identified Mail

What It Does

DKIM adds a digital signature to every email sent from your domain. The receiving server checks this signature against a public key published in your DNS. If the signature matches, it confirms the email has not been tampered with in transit and genuinely originated from an authorised source.

How It Works

Your email provider generates a pair of cryptographic keys. The private key stays on the mail server and signs outgoing emails. The public key is published as a DNS TXT record, typically at a subdomain like selector1._domainkey.yourbusiness.com.au.

Key Points for SMEs

• Most email providers (Microsoft 365, Google Workspace) support DKIM — you just need to enable it and publish the DNS records they provide
• Each sending service needs its own DKIM key — your email provider, marketing platform and invoicing software may each require separate configuration
• DKIM does not prevent someone from sending a fake email — it just allows the receiver to verify authenticity. That is where DMARC comes in.

DMARC: Domain-based Message Authentication, Reporting and Conformance

What It Does

DMARC ties SPF and DKIM together and tells receiving servers what to do when an email fails authentication. Without DMARC, a failed SPF or DKIM check might result in the email being delivered anyway. DMARC gives you control and visibility.

How It Works

DMARC is another DNS TXT record, published at _dmarc.yourbusiness.com.au. A typical record looks like:

v=DMARC1; p=reject; rua=mailto:[email protected]; pct=100

This tells receiving servers: “If an email from my domain fails both SPF and DKIM checks, reject it. Send me aggregate reports about authentication results.”

DMARC Policy Levels

Policy	Action	When to Use
p=none	Monitor only (no action on failures)	Initial setup — learn who sends email as your domain
p=quarantine	Send failing emails to spam/junk	Transition phase once SPF/DKIM are configured correctly
p=reject	Block failing emails entirely	Full protection — the goal for every domain

Key Points for SMEs

• Start with p=none to monitor without breaking legitimate email flows. Review the reports for 2–4 weeks to identify all authorised senders.
• Move to p=quarantine and then p=reject once you are confident all legitimate senders are covered by SPF and DKIM
• The rua tag sends you aggregate reports — use a free service like MXToolbox or Postmark’s DMARC monitoring to make these reports readable
• DMARC protects your domain from being spoofed — it does not protect you from receiving spoofed emails from other domains

How the Three Protocols Work Together

Think of it as a three-layer verification system:

1. SPF checks: “Is this email coming from an authorised server?”
2. DKIM checks: “Is this email genuinely signed and unaltered?”
3. DMARC decides: “If either check fails, what should happen to this email?”

All three are required for robust email authentication. SPF alone can be bypassed through email forwarding. DKIM alone does not tell receivers what to do with failures. DMARC without SPF and DKIM has nothing to enforce. Together, they provide comprehensive protection.

How to Check Your Current Setup

Before making changes, check what you already have in place. Several free tools can help:

• MXToolbox SuperTool (mxtoolbox.com) — enter your domain to check SPF, DKIM and DMARC records
• Google Admin Toolbox Check MX — tests your domain’s email configuration
• dmarcian.com — provides a free DMARC record checker and setup wizard

If any of the three records are missing or misconfigured, you have a gap that attackers can exploit.

Step-by-Step Setup Overview

1. Inventory your email senders. List every service that sends email from your domain: your email provider, CRM, accounting software, marketing platform, website forms.
2. Configure SPF. Create a single TXT record that includes all authorised senders. Your email provider’s documentation will tell you exactly what to add.
3. Enable DKIM. Follow your email provider’s instructions to generate DKIM keys and publish the public key DNS records. Repeat for each third-party sender.
4. Publish a DMARC record. Start with p=none and a reporting address. Monitor reports for 2–4 weeks.
5. Tighten your DMARC policy. Once reports confirm all legitimate email is passing, move to p=quarantine, then p=reject.

Common Mistakes to Avoid

• Multiple SPF records: Having more than one SPF TXT record on your domain invalidates all of them. Combine everything into a single record.
• Forgetting third-party senders: If Xero sends invoices from your domain but is not in your SPF record, those invoices may land in spam once you enforce DMARC.
• Jumping straight to p=reject: Always start with monitoring. A misconfigured reject policy can block your own legitimate emails.
• Not monitoring DMARC reports: The reports tell you exactly what is passing and failing. Ignoring them means flying blind.
• Leaving subdomains unprotected: If you set DMARC on yourbusiness.com.au but not on subdomains, attackers can spoof accounts.yourbusiness.com.au. Use the sp=reject tag to cover subdomains.

“Email authentication is not optional. If you do not have SPF, DKIM and DMARC configured, anyone in the world can send emails that look like they come from your business.”

The Link to Broader Cyber Security

Email authentication is one of the controls covered in the ASD Essential Eight mitigation strategies. It also directly reduces your exposure to BEC attacks, which remain the most financially damaging threat to Australian SMEs.

Within the IDIA framework, SPF, DKIM and DMARC sit squarely in the Infrastructure pillar, which covers endpoints, networks, patching and email security. IDIA organises every cybersecurity control into four pillars — Identity, Data, Infrastructure and Assurance — and maps to ISO 27001, NIST CSF, the Essential Eight, CIS Controls and SMB1001 without locking you into any single standard. Getting email authentication right strengthens your Infrastructure pillar and directly reduces risk across the other three, because compromised email is often the entry point for identity theft, data breaches and compliance failures.

Check Your Email Authentication in Minutes

Not sure if your domain has SPF, DKIM and DMARC properly configured? Platforms like How’s My Cyber use the IDIA framework (Identity, Data, Infrastructure, Assurance) to organise every control into a clear operating model that works alongside any standard. Start with the free CYBER9 assessment to benchmark your business across nine critical security domains in under 10 minutes — including an email security evaluation that checks your domain’s authentication records and flags gaps. No technical knowledge required — just clear next steps to lock down your email security and strengthen your overall posture.