Email Security: SPF, DKIM & DMARC

Why your domain may still be spoofable today

Many companies think their email is secure once their mailbox sits with Microsoft 365 or Google Workspace.
The reality? In quite a few scans we see that the DNS settings that are supposed to protect your domain are completely wrong.

And you usually only notice that when it is too late.
When customers report that "you" are sending phishing mails, when you are not.

The foundation of email security lies not only in your mailbox, but also in your DNS records.
That is the public place anyone can look at. Attackers too.

The four DNS records that determine whether your domain can be abused

SPF: who may send mail on behalf of your domain?

SPF determines which mail servers are allowed to send emails with your domain in the sender address.

Common problems:

• Too many allowed senders ("everything goes")
• Historical tools that still have access
• SPF records that technically fail due to limits
• Use of ~all instead of -all

If SPF fails, it is often child's play for an attacker to impersonate your domain.

DKIM: the digital signature of your email

DKIM ensures that an email is cryptographically signed.

The recipient can then verify that the mail was not modified in transit and was genuinely sent by your system.

What we often see:

• DKIM not activated in marketing or invoicing tools
• Outdated keys
• No rotation of DKIM keys
• Wrong or missing DNS records

Without DKIM, a mail looks technically "suspicious", even if it is legitimate.

DMARC: the control room

DMARC determines what receiving mail servers must do if SPF and DKIM fail.

Key concept: alignment
SPF or DKIM must match the domain in the sender address.
Without alignment, DMARC fails, even if SPF or DKIM are "green" on their own.

DMARC policy:

• p=none → only report (no protection)
• p=quarantine → treat as suspicious
• p=reject → refuse

Many organisations stay on p=none for years.
That means: your domain remains fully spoofable.

MX: where does email come in?

MX records determine which servers receive email for your domain.

Old or wrong MX records:

• increase the attack surface
• cause unexpected deliverability problems
• sometimes point to systems that have not been used for years

The 7 minimum checks every domain must pass

A correctly secured domain at least meets this baseline:

• SPF present, valid and under 10 DNS lookups
• SPF ends with -all
• DKIM active with modern keys
• At least one active DKIM selector
• DMARC present with valid reporting
• DMARC at least on quarantine, ideally reject
• MX records correct and cleaned up

Does one of these points fail?
Then your domain can be abused for phishing or fraud.

Multiple tools, one domain: where it often goes wrong

Most organisations use more than one system to send mail:

• marketing tools
• webshops
• invoicing tools
• CRM systems
• forms on the website
• HR software

Each of those systems must be correctly included in SPF, DKIM and DMARC.
Without an overview, chaos ensues, and you only notice it when mails disappear or get blocked.

How we approach this

We always work in a controlled way and without risk:

1. First full insight through reporting
2. Only then cleaning up and aligning
3. Tightening to quarantine in a controlled way
4. And finally safely to p=reject

That way your mail keeps working, while spoofing is effectively stopped.

But... this is only the tip of the iceberg

DNS records are the first line of defence.
Real email security goes much further.

Think of:

• protection against phishing campaigns
• analysis of suspicious attachments
• detection of spoofing within your organisation
• protection against zero-day attacks
• fine-tuned filtering and thresholds
• monitoring and recommendations according to Microsoft best practices

That requires additional security measures within Microsoft 365.

We can support you there too, from advice to full configuration and follow-up.

Want to know how your domain is doing?

Use our free email security scanner and see within seconds:

• whether your domain is spoofable
• whether SPF, DKIM and DMARC work correctly
• where the biggest risks sit
• which steps have the most impact

Validate your domain and get immediate clarity.
Want to look beyond email alone?

Plan a Security Audit and get a complete picture of your Microsoft 365 security.