What do SPF, DKIM, and DMARC do?

SPF lists the services allowed to send email for your domain, DKIM signs outgoing messages so inboxes can verify them, and DMARC tells inboxes what to do when those checks fail.

Will SPF, DKIM, and DMARC stop all phishing?

No. They reduce domain spoofing and improve email trust, but they should be paired with MFA, mailbox monitoring, anti-phishing policies, and user verification habits.

When should a business recheck these records?

Recheck SPF, DKIM, and DMARC whenever you add or change Microsoft 365, Google Workspace, a CRM, billing platform, marketing tool, website form, or any system that sends email for your domain.

Wisdom Byte · Email Security

SPF, DKIM, and DMARC Explained for Business Owners

Q: Why not set DMARC to reject immediately?

If legitimate tools are not included yet, an aggressive DMARC policy can block real email. Many businesses should start with monitoring, verify all senders, then move toward stronger enforcement.

If clients cannot tell your email is really yours, trust gets expensive fast.

AMP IT · Charlotte, NCJuly 8, 20266 min read

Authenticated mail path

YOUR DOMAINapproved sender

SPF

DKIM

DMARC applies the policy

INBOX

verified path

The business risk

Email is where invoices, contracts, intake forms, approvals, and account resets move. If your domain is easy to spoof, a criminal can pretend to be your company and borrow the trust you worked to build.

The deliverability problem

Even real messages can land in spam when your domain does not prove who is allowed to send for it. That creates missed opportunities, client confusion, and support headaches.

What these terms mean in plain English

You do not need to become an email engineer. The simple version is this: SPF, DKIM, and DMARC help prove that email using your domain is legitimate.

SPF is the approved sender list. It tells the internet which mail services are allowed to send email for your domain, such as Microsoft 365, Google Workspace, your CRM, billing platform, or website form.
DKIM is the tamper-evident seal. It adds a digital signature to outgoing email so receiving inboxes can verify the message came from an approved system and was not changed along the way.
DMARC is the rulebook. It tells receiving mail servers what to do when a message fails those checks: monitor it, send it to spam, or reject it before it reaches someone.

How they work together

SPF and DKIM are the proof. DMARC is the policy. Together they help inboxes answer a basic trust question: “Is this message really allowed to come from this business?”

They do not stop every phishing email. A scammer can still send from a lookalike domain or a compromised mailbox. But they make it harder to abuse your real domain, improve trust with mail providers, and give you a safer foundation for Microsoft 365, Google Workspace, and other sending tools.

What to check before changing anything

Confirm there is only one SPF record and that it includes every legitimate sending service.
Verify DKIM is turned on for Microsoft 365, Google Workspace, and any other platforms that send email as your domain.
Start DMARC with monitoring so you can see who is sending before you enforce stricter rules.
Review the reports before moving toward quarantine or reject.
Re-check records whenever you add a CRM, billing system, marketing platform, website form, or vendor tool.

Free Tool

Want to check your own domain?

Run a free public DNS scan for SPF, DKIM, and DMARC. If something is missing or misconfigured, AMP IT can help fix it.

Scan My Domain

Frequently Asked Questions

Will this stop all phishing?

No. SPF, DKIM, and DMARC reduce domain spoofing and improve email trust, but they should be paired with MFA, anti-phishing policies, mailbox-rule monitoring, and clear verification habits.

Why not set DMARC to reject immediately?

If legitimate tools are missing from your records, strict enforcement can block real email. It is usually safer to monitor first, identify all senders, then tighten the policy.

What if the scan does not find DKIM?

DKIM can use different selectors, so a public scan may only show “no common selector found.” That means the next step is a deeper review of Microsoft 365, Google Workspace, DNS, and sending platforms.

When should we recheck this?

Recheck whenever you add or change a system that sends email for your domain: CRM, billing, marketing, website forms, helpdesk, Microsoft 365, Google Workspace, or a vendor platform.

Where AMP IT fits: AMP IT can check the public records, review the sending tools behind them, and help clean up SPF, DKIM, and DMARC without guessing. Start with the free email trust check.