What are email authentication protocols?
Email authentication is the use of three DNS-published protocols, SPF, DKIM and DMARC, that let a receiving mail server check whether a message claiming to come from your domain was really sent by you and arrived unaltered. SPF lists approved senders, DKIM signs each message and DMARC tells receivers what to do with failures.
Email Authentication (SPF, DKIM and DMARC) is a set of three DNS-published standards that let a receiving mail server check whether a message claiming to come from your domain was in fact sent by you. SPF lists which servers may send for the domain, DKIM adds a cryptographic signature to each message, and DMARC tells receivers what to do when a message fails both checks and where to send reports.
SPF (Sender Policy Framework) is a DNS text record naming the mail servers authorized to send for the domain, such as Microsoft 365 and a marketing platform. A receiver compares the sending server against the list. DKIM (DomainKeys Identified Mail) has the sending server sign selected headers and the body with a private key; the matching public key sits in DNS, and any alteration in transit breaks the signature. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties them together. It requires that the domain in the visible From address align with the domain that passed SPF or DKIM, and its policy tells receivers to do nothing, quarantine, or reject failures. DMARC also sends aggregate reports showing who is sending mail as your domain, legitimate or otherwise.
For a small or mid-sized business the immediate effects are deliverability and fraud. Major mailbox providers now require authentication from senders, and unauthenticated mail increasingly lands in spam or is rejected outright. A domain without a DMARC reject policy can be impersonated freely, which is the basis of business email compromise scams in which a fake message from the owner asks the bookkeeper to change a vendor's bank details. Getting to a reject policy takes care: every legitimate sender, including the accounting software and the CRM, must be added to SPF or signed with DKIM first, or their mail will be blocked too.
NetSys configures SPF, DKIM, and DMARC for client domains as part of its Microsoft 365 security service. The work starts with an inventory of every third-party system that sends on the domain, then moves the DMARC policy from monitoring to reject in stages while the reports are reviewed. Email encryption for messages that carry sensitive content is handled through a separate email encryption service, since authentication proves origin but does not protect contents.
Why it matters for a small business
Without these records, anyone on the internet can send email that appears to come from your company, and your customers and vendors have no way to tell the difference. That is how a fraudster convinces a client to wire payment to a new account using your name. Authentication also decides whether your own legitimate mail reaches inboxes, since the large providers now treat unauthenticated domains with suspicion. The setup is a few DNS records and some patience with reports. It is among the cheapest protections available and among the most commonly left half-finished, sitting at a monitoring policy that blocks nothing.
Email Authentication (SPF, DKIM and DMARC): FAQs
What is email authentication?
Email authentication is the use of SPF, DKIM, and DMARC records in a domain's DNS so that receiving mail servers can verify a message was sent by an authorized server and was not altered in transit. SPF names the permitted sending servers, DKIM signs messages cryptographically, and DMARC sets the policy for handling failures and returns reports. Together they make it hard for criminals to forge mail from your domain and help your legitimate mail reach inboxes.
What is the difference between SPF, DKIM, and DMARC?
SPF is a list of servers allowed to send email for your domain; receivers check the sending server against it. DKIM is a digital signature added to each message by the sending server and verified using a public key in your DNS; it proves the message was not changed. DMARC is the policy layer: it requires that SPF or DKIM pass and align with the From address, tells receivers whether to quarantine or reject failures, and sends reports on who is using your domain. You need all three.
Do I need DMARC for my business email?
Yes. Major mailbox providers now expect DMARC from senders, and without a DMARC policy at quarantine or reject your domain can be spoofed at will, which feeds business email compromise fraud against your customers and staff. Start with a monitoring policy to see every source sending as your domain, add each legitimate one to SPF or DKIM, then tighten the policy. Many businesses stop at monitoring, which provides reports but no protection. The goal is a reject policy that holds.
Does Gmail require SPF, DKIM and DMARC?
Yes, in part. Google's email sender guidelines, in effect since February 1, 2024, require everyone sending to Gmail accounts to set up SPF or DKIM, and require senders of more than 5,000 messages a day to set up SPF, DKIM and DMARC, with the From domain aligned to the SPF or DKIM domain. A DMARC policy of none satisfies Google, but only a quarantine or reject policy tells receiving servers to stop mail that fakes your domain.
How long does it take to set up DMARC?
Publishing the records is quick; reaching a reject policy safely usually takes several weeks. Start with a policy of none and read the aggregate reports to find every service sending as your domain, such as Microsoft 365, the accounting system, the CRM and the newsletter tool. Add each one to SPF or sign it with DKIM, then move to quarantine and finally reject, checking the reports at each step.
More terms
Discuss dmarc implementation services for your business.
Tell us about your current systems, the result you need and your timeline. We will discuss the work, responsibilities and pricing before you decide on an engagement.