Your spam filter does a good job with the obvious junk. What it cannot do on its own is stop someone sending an email that looks exactly like it came from your business. All it takes is your domain name in the From field, and to the person reading it, the message looks legitimate. That is how fake invoices reach your accounts team, how supplier-payment fraud starts, and how your customers end up clicking links in emails your business never sent.
The problem: anyone can send email as you
Email was designed in a simpler time, and by default it trusts the sender. When a mail server receives a message claiming to be from your domain, it has no built-in way to check whether you actually sent it. Spam filters judge the content — the wording, the links, the attachments — but a well-written spoof with a clean link sails through. The damage runs both ways: your staff get tricked, and your domain's reputation takes the hit when fake mail goes out in your name.
SPF: who is allowed to send for your domain
SPF, or Sender Policy Framework, is a simple idea. You publish a list in your domain's DNS records naming the mail servers allowed to send email on your behalf — your mail platform, your CRM, your invoicing system. When a receiving server gets a message from your domain, it checks the sending server against that list. If it is not on the list, the message fails the check. SPF is the foundation, but it only checks the envelope sender — the return address hidden in the technical headers — not the From address your recipient actually sees. That gap is why SPF alone is not enough.
DKIM: proving the message is genuine
DKIM, or DomainKeys Identified Mail, adds a digital signature to every outgoing message. Your mail server signs the message with a private key and publishes the matching public key in DNS. The receiving server verifies the signature: if it matches, the message really came from your systems and was not altered on the way. Where SPF answers "was this sent from an approved server?", DKIM answers "is this message exactly as the sender wrote it?" Most business mail platforms can switch DKIM signing on once the DNS records are in place.
DMARC: the policy that ties it together
DMARC, or Domain-based Message Authentication, Reporting and Conformance, is the policy layer. It tells receiving servers what to do when a message fails SPF and DKIM, and — just as importantly — it asks them to send you reports about it. You start in monitoring mode, which changes nothing for your mail but shows you who is sending as your domain. Then you move to quarantine, where failing messages land in spam, and finally to reject, where they are refused outright. Jumping straight to reject before you have listed every legitimate sender can block your own invoices and CRM mail. DMARC also closes the gap SPF leaves open, because it checks that the domain in the visible From address matches the domain that passed SPF or DKIM.
Why you need all three
Each control covers a weakness in the others. SPF without DKIM can be bypassed by forwarding. DKIM without DMARC has no enforcement — a failed signature is just a note in the headers. DMARC without SPF and DKIM has nothing to enforce. Set up together, they give receiving servers a clear, testable answer to one question: is this email really from this business? That is also why more large mail providers now treat a missing DMARC policy as a reason to distrust a sender.
The mistakes we see most often
- SPF records that break the 10-lookup limit: every "include" in an SPF record triggers a DNS lookup, and the standard allows only ten. Add too many third-party services and the record silently fails.
- Forgetting the services that send as you: your CRM, your website's contact form, your invoicing tool and your marketing platform all send email from your domain. Miss one and its mail starts failing once DMARC enforcement begins.
- DMARC stuck on monitoring forever: a policy of "none" is a good starting point, not a destination. Without moving to quarantine and then reject, spoofed mail still reaches inboxes.
- Nobody reading the reports: DMARC reports show who is sending as your domain and what is failing. Left unread, they are just noise — checked monthly, they are an early warning system.
Getting started
Start with an audit, not with DNS changes. List every system that sends email as your domain — your mail platform, CRM, website forms, invoicing and any marketing tools — then publish an SPF record that covers them all and switch DKIM signing on in each platform. Add a DMARC record in monitoring mode for two to four weeks: the reports will show you what you missed. Fix the gaps, move to quarantine, and once the reports are clean, move to reject. It is one of the cheapest security improvements a business can make.
Request a quote, call us on (04) 359 4874, or message us on WhatsApp at +971 52 562 1946 for a free site survey — we will audit your domain's SPF, DKIM and DMARC setup, fix the gaps, and put your business email on a firm footing, with no obligation.
