SPF vs DKIM vs DMARC: Email Authentication FAQ for SMBs

SPF vs DKIM vs DMARC is not a choice between three options: SPF lists the servers allowed to send mail for your domain, DKIM signs each message so receivers can tell it came from you unaltered, and DMARC checks that one of them matches the From address people see, then tells receivers what to do when neither does. Put simply, in DKIM vs DMARC, DKIM is the signature and DMARC is the rule that makes the signature count. As of October 2026, Google, Yahoo and Microsoft all require SPF, DKIM and DMARC from bulk senders, and Gmail and Yahoo require at least SPF or DKIM from every sender.

Below: how the three compare, which records your setup needs, the rollout order that avoids blocking your own invoices, what it costs, and the questions small business owners actually ask, answered plainly.

SPF vs DKIM vs DMARC: how do they compare?

All three are small records you publish in your domain's DNS (our email authentication glossary entry has the short definition), and each checks something different:

	SPF	DKIM	DMARC
What it checks	Whether the sending server is on your list of approved senders	Whether the message carries a valid signature from your domain, made with a private key that matches a public key in your DNS	Whether SPF or DKIM passed for the same domain shown in the From address (called alignment)
What it protects	Stops servers you never authorized from passing as you	Shows the message was not altered in transit and came from a system holding your key	Stops strangers using your exact domain in the From line, once the policy is quarantine or reject
Gap on its own	Checks the hidden envelope sender, not the From address people see; often fails when mail is forwarded; limited to 10 DNS lookups	Does not tell receivers what to do with unsigned or failing mail	Does nothing without SPF or DKIM, and p=none only collects reports
Where it lives	One TXT record on your domain, such as v=spf1 include:spf.protection.outlook.com -all	A public key at a selector under _domainkey (Microsoft 365 uses two CNAME records)	One TXT record at _dmarc, such as v=DMARC1; p=none; rua=mailto:reports@yourdomain.com
Standard	RFC 7208	RFC 6376	RFC 9989 (May 2026), which replaced RFC 7489

DKIM vs DMARC and DMARC vs SPF: do you need all three?

Yes, because each covers a gap in the others. SPF and DKIM authenticate a sending domain, but neither requires that domain to match the From address your customer reads, so a forger can pass SPF with a domain they own while showing yours. DMARC closes that gap: per Google's email sender guidelines, a message passes DMARC only when SPF or DKIM authenticates the same domain that appears in the From header.

DMARC needs only one of the two to pass and align, so why publish both? Redundancy. SPF usually fails when a message is forwarded, because the forwarding server is not on your list, while a DKIM signature usually survives forwarding unless the message is changed on the way, as mailing lists often do. If a vendor misconfigures one, the other keeps your legitimate mail passing. And the bulk sender rules at Gmail, Yahoo and Outlook.com require both anyway.

Which records does your setup need?

Your situation	What to set up	What to watch
All mail goes through Microsoft 365	SPF with include:spf.protection.outlook.com; DKIM for your own domain (two CNAME records, then turn on signing in the Defender portal); DMARC starting at p=none	Copiers, scanners and website forms that send as your domain without going through Microsoft 365
All mail goes through Google Workspace	SPF with include:_spf.google.com; a DKIM key generated in the Google Admin console, 2048-bit where your DNS host supports it; DMARC starting at p=none	The same forgotten senders, plus anything still relaying through an old mail host
You also send from a CRM, invoicing or marketing platform	DKIM signing with your domain at each platform, or a subdomain such as mail.yourdomain.com for bulk tools you do not control	SPF's 10-lookup limit: every include adds lookups, and a record over the limit fails
You send more than 5,000 messages a day to Gmail or Outlook.com addresses	All three, aligned, plus one-click unsubscribe on marketing mail to Gmail and a spam complaint rate under 0.3%	Rejections: Gmail can reject with a 5.7.26 error and Outlook.com with 550 5.7.515
Domains you own but never send from	SPF v=spf1 -all and DMARC v=DMARC1; p=reject, with no DKIM records	Old company names and lookalike domains: protect every domain you registered

How do you roll out SPF, DKIM and DMARC without blocking your own mail?

The safe order, following Microsoft's DMARC setup guide:

1. List every sender. Your mail platform, plus every app that sends as your domain: invoicing, payroll, CRM, newsletters, the website and the copier.
2. Publish one SPF record. A domain can have only one; two records make SPF fail. Microsoft's SPF guide recommends ending it with -all, while Google recommends ~all. Keep it under 10 DNS lookups.
3. Turn on DKIM everywhere. Each service should sign with your domain, not its own, so the signature aligns with your From address.
4. Publish DMARC at p=none with a reporting address. Send the aggregate reports, compressed XML files that receivers typically send daily, to a shared mailbox or a report service rather than one person's inbox.
5. Read the reports. Microsoft suggests weekly reviews during rollout and monthly once stable. Fix each legitimate sender that fails.
6. Tighten in stages. Move to p=quarantine, then p=reject, starting with low-volume domains or subdomains and leaving the main domain for last.

What does it cost to set up SPF, DKIM and DMARC?

The records cost nothing: they are DNS entries at your registrar or DNS host, and Microsoft 365 and Google Workspace include DKIM signing. The cost is time and attention, and four things set it:

• Number of senders. A business that sends only from Microsoft 365 is a short job. Each extra platform needs its own DKIM setup, and some need a support ticket with the vendor.
• Number of domains. Every domain you own needs records, including the parked ones.
• Report reading. Most businesses use a report service, free or paid, to turn the XML reports into a readable list of senders.
• Who does the work. An owner can publish the basic records. A managed provider or a fixed-scope project costs more, but includes the testing, the staged enforcement and someone watching for breakage.

Frequently asked questions

What are SPF, DKIM, and DMARC in plain English?

They're three small records you publish in your domain's DNS. SPF lists which servers are allowed to send mail as you. DKIM adds a tamper-proof signature that proves a message wasn't altered. DMARC ties the two together and tells receiving servers what to do with mail that fails: ignore it, quarantine it, or reject it outright.

What is the difference between DKIM and DMARC?

DKIM is a signature: your mail system signs each message with a private key, and receivers check it against the public key in your DNS. DMARC is a policy: it checks that a passing SPF or DKIM result belongs to the domain in the From address, tells receivers whether to deliver, quarantine or reject mail that fails, and sends you reports. DKIM without DMARC proves who signed a message but gives receivers no instruction; DMARC without DKIM leans entirely on SPF, which fails when mail is forwarded.

Is DMARC better than SPF?

They do different jobs, so neither replaces the other. SPF says which servers may send for your domain; DMARC uses that result, or DKIM's, and adds the From address check, the policy and the reporting. A DMARC record with no SPF or DKIM behind it fails all of your mail, and SPF with no DMARC leaves your visible From address open to spoofing.

Why do I suddenly have to care about this?

Because the big mailbox providers now enforce it. Google and Yahoo began requiring SPF, DKIM and DMARC from bulk senders in February 2024. On May 5, 2025, Microsoft started rejecting mail to Outlook.com, Hotmail and Live addresses from domains that send more than 5,000 messages a day and fail these checks, with the error 550 5.7.515, according to its announcement of the Outlook.com sender requirements. Miss them and your legitimate email lands in spam or gets rejected. Deliverability, not just security, is now on the line.

Does this apply to a small business, or just big senders?

The strict mandates target bulk senders, defined as more than 5,000 messages a day at Gmail and Outlook.com. But Gmail and Yahoo's sender requirements already ask every sender, whatever its size, to set up SPF or DKIM, and Microsoft says all senders benefit from the same practices. Setting up all three now protects your delivery and closes a spoofing gap before a stricter threshold or a partner's requirement forces your hand.

What happens if I do nothing?

Two things, both bad. Your real invoices and quotes start landing in customers' junk folders, quietly costing you business. And without DMARC set to reject, anyone can spoof your domain to send convincing fraud in your name. That impersonation is the engine behind business email compromise, where a faked message reroutes a payment.

Is email authentication actually a compliance issue now?

Increasingly, yes. For businesses that take card payments, PCI DSS version 4 requirement 5.4.1 has been mandatory since March 31, 2025: it calls for processes and automated mechanisms that detect and protect staff against phishing attacks. The requirement does not name SPF, DKIM or DMARC, so ask your assessor or acquirer how they want it evidenced. Our PCI DSS compliance service covers the rest of the standard.

How long does setup take?

The records themselves take an afternoon. Doing it safely takes longer, because publishing DMARC at full enforcement too early can block your own newsletters, invoicing tools, and CRM. The right sequence is to start in monitoring mode, watch the reports to catch every legitimate sender, then tighten to reject. Rushing that step is how businesses accidentally block themselves.

Can I set this up myself?

A tech-comfortable owner can publish basic SPF and DKIM. DMARC is where most people get stuck, because reading the reports and moving safely to enforcement takes some know-how. If your mail touches a payroll tool, a marketing platform, and an accounting app, having someone who does this regularly handle the rollout saves a painful week of misdelivered mail.

Which option fits a small team?

All three, because they work as a set rather than as alternatives. For a team of 5 to 50 on Microsoft 365 or Google Workspace with one or two other sending apps, the work is mostly configuration: one SPF record, DKIM turned on in each service, and DMARC moved from p=none to reject once the reports show only unauthorized mail failing. A team with many sending platforms or several domains benefits from someone who does this regularly.

What affects the cost, implementation and support of email authentication?

Cost follows the number of sending services and domains, since the records themselves are free. Implementation time depends on how many senders need DKIM set up and how quickly their vendors respond. Support is the ongoing part: someone has to read the DMARC reports, approve new senders before they start using your domain, and fix failures when a vendor changes its servers.

What changed in DMARC in 2026?

In May 2026 the IETF published RFC 9989, which replaces the original DMARC specification (RFC 7489) and puts DMARC on the internet standards track. For a small business the practical changes are small: the pct tag, which applied a policy to a percentage of failing mail, is gone, replaced by a t=y test flag, and a new np tag sets the policy for subdomains that do not exist. Alignment works the same way as before, so a correctly aligned setup does not need rebuilding.

How does this fit with the rest of my email security?

It's the foundation, not the whole house. Authentication stops others from forging your domain, but it doesn't encrypt what's inside a message (that's email encryption for small business), and it won't stop a stolen password from being used or a lookalike domain from fooling staff. Pair it with phishing-resistant sign-in, like passkeys over basic MFA, inbound filtering from an email security service, and staff awareness for a layered defense.

By Joel Baum for The NetSys Group, which has delivered managed IT, cybersecurity, and cloud services since 1998. Our engineers hold degrees in electrical and computer engineering and are certified Microsoft and Cisco instructors, serving businesses across NY, NJ, CT, PA, and Southwest Florida.

Not sure whether your domain is authenticated or wide open to spoofing? Our DMARC implementation service starts with an inventory of every service that sends as your domain, aligns SPF and DKIM for each one, and moves DMARC to enforcement in stages, with the reports reviewed at every step. Book a call to scope it.

Sources and further reading

• Google's email sender guidelines: the Gmail requirements for all senders and for bulk senders.
• Yahoo's sender requirements: SPF or DKIM for all senders, and SPF, DKIM and DMARC for bulk senders.
• Microsoft Learn: set up SPF and set up DMARC, including records for parked domains.
• RFC 9989: the DMARC standard published in May 2026.