What is Email Authentication?
Email Authentication (SPF, DKIM and DMARC) is a set of three DNS-published standards that let a receiving mail server check whether a message claiming to come from your domain was in fact sent by you. SPF lists which servers may send for the domain, DKIM adds a cryptographic signature to each message, and DMARC tells receivers what to do when a message fails both checks and where to send reports.
SPF (Sender Policy Framework) is a DNS text record naming the mail servers authorized to send for the domain, such as Microsoft 365 and a marketing platform. A receiver compares the sending server against the list. DKIM (DomainKeys Identified Mail) has the sending server sign selected headers and the body with a private key; the matching public key sits in DNS, and any alteration in transit breaks the signature. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties them together. It requires that the domain in the visible From address align with the domain that passed SPF or DKIM, and its policy tells receivers to do nothing, quarantine, or reject failures. DMARC also sends aggregate reports showing who is sending mail as your domain, legitimate or otherwise.
For a small or mid-sized business the immediate effects are deliverability and fraud. Major mailbox providers now require authentication from senders, and unauthenticated mail increasingly lands in spam or is rejected outright. A domain without a DMARC reject policy can be impersonated freely, which is the basis of business email compromise scams in which a fake message from the owner asks the bookkeeper to change a vendor's bank details. Getting to a reject policy takes care: every legitimate sender, including the accounting software and the CRM, must be added to SPF or signed with DKIM first, or their mail will be blocked too.
NetSys configures SPF, DKIM, and DMARC for client domains as part of its Microsoft 365 security service. The work starts with an inventory of every third-party system that sends on the domain, then moves the DMARC policy from monitoring to reject in stages while the reports are reviewed. Email encryption for messages that carry sensitive content is handled through a separate email encryption service, since authentication proves origin but does not protect contents.
Why it matters for a small business
Without these records, anyone on the internet can send email that appears to come from your company, and your customers and vendors have no way to tell the difference. That is how a fraudster convinces a client to wire payment to a new account using your name. Authentication also decides whether your own legitimate mail reaches inboxes, since the large providers now treat unauthenticated domains with suspicion. The setup is a few DNS records and some patience with reports. It is among the cheapest protections available and among the most commonly left half-finished, sitting at a monitoring policy that blocks nothing.
Email Authentication (SPF, DKIM and DMARC): FAQs
What is email authentication?
Email authentication is the use of SPF, DKIM, and DMARC records in a domain's DNS so that receiving mail servers can verify a message was sent by an authorized server and was not altered in transit. SPF names the permitted sending servers, DKIM signs messages cryptographically, and DMARC sets the policy for handling failures and returns reports. Together they make it hard for criminals to forge mail from your domain and help your legitimate mail reach inboxes.
What is the difference between SPF, DKIM, and DMARC?
SPF is a list of servers allowed to send email for your domain; receivers check the sending server against it. DKIM is a digital signature added to each message by the sending server and verified using a public key in your DNS; it proves the message was not changed. DMARC is the policy layer: it requires that SPF or DKIM pass and align with the From address, tells receivers whether to quarantine or reject failures, and sends reports on who is using your domain. You need all three.
Do I need DMARC for my business email?
Yes. Major mailbox providers now expect DMARC from senders, and without a DMARC policy at quarantine or reject your domain can be spoofed at will, which feeds business email compromise fraud against your customers and staff. Start with a monitoring policy to see every source sending as your domain, add each legitimate one to SPF or DKIM, then tighten the policy. Many businesses stop at monitoring, which provides reports but no protection. The goal is a reject policy that holds.
More terms
Endpoint Detection and Response (EDR)
Endpoint detection and response (EDR) is software that records activity on computers and servers, detects attacker behavior and isolates a device remotely.
Electronic Protected Health Information (ePHI)
ePHI is individually identifiable health information that a HIPAA-covered organization or its vendor creates, stores, sends or receives in electronic form.
Extended Detection and Response (XDR)
Extended detection and response (XDR) correlates signals from endpoints, email, identities and cloud apps into single incidents with a coordinated response.
DNS Filtering
DNS filtering is a security control that checks each domain a device tries to reach against threat lists and refuses to resolve dangerous or banned sites.
Get the controls, not just the definition.
A NetSys engineer can tell you in fifteen minutes whether you have this covered, and what it would take if you do not. Month to month, no long-term contract.