Most small businesses do not need a deep email-authentication lecture.

They need a sensible path to stop other people pretending to send email as their business.

That is what SPF, DKIM and DMARC are really about. Not DNS trivia. Brand protection, trust protection and reducing the chance that customers, staff or suppliers receive fake messages that appear to come from you.

What spoofing is and why businesses should care

Spoofing is when someone sends an email that looks like it came from your domain, even though it did not.

That matters because customers do not always distinguish between a fake email and your real business. If your domain is easy to spoof, your reputation takes the hit first.

SPF, DKIM and DMARC in business language

SPF

SPF is the published list of systems allowed to send email for your domain.

DKIM

DKIM helps receiving systems verify that a message really came from an approved sender and was not altered in transit.

DMARC

DMARC ties the checks together and tells receiving systems what to do when a message fails them.

That could mean do nothing at first, send it to spam, or reject it entirely.

The sensible rollout order

Most SMEs should think about rollout in stages.

Stage 1: Visibility

Start by identifying all legitimate senders and publishing the basic records carefully.

Stage 2: Monitoring

Use DMARC in monitoring mode first so you can see what is really sending mail from your domain.

Stage 3: Tightening

Once the legitimate senders are understood, move towards stronger enforcement.

Stage 4: Enforcement

When you are confident the sender inventory is accurate, move to quarantine or reject as appropriate.

Common break points

This is where things usually go wrong:

• a forgotten third-party sender

• a marketing platform that was never documented

• a parked domain nobody reviews

• records added once and never revisited

That is why anti-spoofing is not a one-time DNS chore. It is a small operational discipline.

What “done properly” looks like

For an SME, done properly usually means:

• a known inventory of systems that send email on your behalf

• SPF configured and maintained

• DKIM enabled where your sending platforms support it

• DMARC in place and reviewed during rollout

• a clear owner for domain and DNS changes

The goal is not perfection on day one. The goal is controlled progress from visibility to confidence.

Final thought

SPF, DKIM and DMARC are best understood as a trust-control stack for your domain.

Most SMEs do not need to make it complicated. They need to know who sends email for the business, publish the right controls, review what the reports show, and move towards stronger enforcement without breaking legitimate mail.

That is how you reduce spoofing without turning it into a science project.

Book a Security Triage Call

FAQs

What are SPF, DKIM, and DMARC?

SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting & Conformance) are email authentication protocols that prevent your domain from being used for spam and phishing.

Why do SMEs need SPF, DKIM, and DMARC?

Without these protocols, attackers can send emails appearing to come from your domain, damaging your reputation and potentially compromising your customers. Email security is one of the five Cyber Essentials controls.

How do you configure SPF, DKIM, and DMARC for Microsoft 365?

Configure these through your Microsoft 365 admin centre: SPF records in your DNS, DKIM signing in the Security & Compliance Centre, and DMARC policies to specify how receiving servers should handle authentication failures.

Learn about the Security Baseline Review