Could someone send an email that looks like it came from your domain? Without three DNS records, they probably can. SPF, DKIM and DMARC stop scammers sending fake invoices “from” your company to your customers, and they help your genuine emails reach the inbox.
The three records in plain English
- SPF: a published list of the servers allowed to send email for your domain.
- DKIM: a digital signature on each email, proving it came from you and wasn’t changed on the way.
- DMARC: your instruction to receiving mail servers about what to do with emails that fail those checks (monitor, send to spam, or reject), plus reports on who is sending as you.
Why it matters now
- It stops domain spoofing. Without DMARC, a scammer can send a fake invoice that appears to come from your exact email address.
- It protects delivery. Gmail, Yahoo and Outlook.com now expect these records from bulk senders, and missing them hurts delivery.
The safe path to DMARC
- Start at p=none to collect reports without affecting any email.
- Find every genuine sender in the reports: Microsoft 365, your CRM, billing system, website forms and marketing tools.
- Fix the ones that fail, by adding them to SPF or setting up DKIM signing.
- Move to quarantine, then finally reject, once genuine email passes.
Rushing straight to reject can block your own invoices or website enquiries, so take it in steps.
Don’t forget your website
Website contact forms often send email “from” your domain through a different server. If that server isn’t covered by SPF or DKIM, a strict DMARC policy will block your own enquiries. A dedicated sending service that signs mail for your domain solves this.
How Pentacle IT Solutions can help
Pentacle IT Solutions sets up SPF, DKIM, DMARC and email protection in Microsoft 365 for businesses in Lucknow and across Uttar Pradesh.
