If your invoices land in customers' spam folders, or a customer has ever received a fake email that looked like it came from you, the cause is often three small records in your domain's DNS: SPF, DKIM and DMARC. They are free to set up, the major mailbox providers now expect them, and they are one of the most effective ways to stop criminals from impersonating your business.
What each one does
- SPF (Sender Policy Framework) lists the servers and services allowed to send email for your domain, such as Microsoft 365, Google Workspace, your invoicing tool or your newsletter platform.
- DKIM (DomainKeys Identified Mail) adds a digital signature to each message, so the receiving server can confirm it really came from your domain and was not altered on the way.
- DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together. It tells receiving servers what to do with mail that fails the checks (nothing, send it to spam, or reject it) and sends you reports about who is sending email using your name.
Why it matters now
Google and Yahoo began enforcing sender requirements in 2024, and Microsoft followed for Outlook.com, Hotmail and Live addresses in 2025. Domains sending more than about 5,000 messages a day to these services must pass SPF and DKIM and publish a DMARC policy of at least p=none, aligned with the From address. Gmail and Yahoo also expect every sender, large or small, to have SPF or DKIM in place.
Most small businesses send far fewer than 5,000 messages a day, but that does not make this optional in practice. Mailbox providers increasingly treat unauthenticated mail with suspicion, and a domain with no DMARC policy is easy for criminals to spoof in invoice and payment scams. CISA and the FTC both recommend email authentication as a basic protection for businesses.
A safe, step-by-step rollout
- List everything that sends as you. Your email platform, accounting or invoicing software, CRM, website contact forms, online store, newsletter tool and any scanners or copiers that email documents.
- Publish one SPF record that includes all of those services. A domain should have only one SPF record, and it must stay under the limit of 10 DNS lookups, which is easy to exceed when you add many services.
- Turn on DKIM in Microsoft 365, Google Workspace and each third-party sender. Each will give you DNS records to add.
- Start DMARC at p=none with a reporting address. This changes nothing about delivery but shows you who is sending as your domain.
- Read the reports for a few weeks and fix any legitimate service that is failing.
- Tighten the policy to p=quarantine and then p=reject once everything legitimate passes. This is the step that actually stops spoofing.
Common mistakes
- Two separate SPF records, which causes both to fail.
- Ending SPF with +all, which lets anyone send as you.
- Jumping straight to p=reject and blocking your own invoices or newsletters.
- Forgetting domains you own but do not send from. Give them a strict SPF and DMARC record so they cannot be abused.
- Setting up DMARC and never reading the reports.
How we help
Bitnode Technologies sets up and monitors SPF, DKIM and DMARC for US small businesses on Microsoft 365, Google Workspace and the tools that send on your behalf, with remote support nationwide and on-site visits by arrangement. Book a free 30-minute consultation and we will check your domain's current records and give you a plan to reach full protection.
Useful references
- Email sender guidelines, Google
- Outlook's requirements for high-volume senders, Microsoft
- Email authentication, Federal Trade Commission
- Secure Our World, CISA
Cover photo by Mariia Berezovsky on Unsplash.