Guide
Email Authentication and DMARC for a Small Organization
Understand what SPF, DKIM, and DMARC each answer, and why a domain should not jump straight to a reject policy.
Attackers can send mail that looks like it came from a company domain. SPF, DKIM, and DMARC are the checks that tell receiving mail systems which servers and signatures are allowed to send as that domain. Tightening them is useful, and doing it in one step can also block legitimate mail.
What each check answers
The three records answer different questions. A domain usually needs all three before a strict policy is meaningful.
- SPF lists the services allowed to send mail for the domain.
- DKIM adds a signature so a message can be tied to the domain even after it is forwarded.
- DMARC tells receivers what to do when a message fails those checks, and where to send reports.
Find every legitimate sender first
Mail often leaves from more than the company inbox. Missing one sender is how a stricter policy breaks password resets, invoices, or a marketing tool.
- List the mailbox host, such as Microsoft 365 or Google Workspace.
- Add billing, newsletter, help-desk, and website forms that send as the same domain.
- Read current DMARC reports, if any, before changing the policy.
Tighten the policy in stages
Start by monitoring failures. Move toward quarantine or reject only after legitimate mail is aligned and the reports no longer show surprises. This guide is general information, not a DNS record to copy.