SPF, DKIM and DMARC: email authentication for small businesses

If your invoices, quotes or booking confirmations keep landing in spam, or a customer tells you they received an email "from you" that you never sent, the cause is often the same: your domain has no proper email authentication. It is a quick fix for most small businesses, and it costs nothing beyond an hour of your time or your web provider's.

The three acronyms, in plain English

The National Cyber Security Centre (NCSC) publishes guidance on email security and anti-spoofing. It describes the three controls like this:

• SPF (Sender Policy Framework) lets you publish the IP addresses that should be trusted to send email for your domain.
• DKIM (Domain Keys Identified Mail) lets you cryptographically sign the email you send, to show it really is from your domain. The NCSC notes it is not as widely supported as SPF, but it has the advantage of supporting forwarded email.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) lets you set a policy for how receiving mail servers should treat email that fails both SPF and DKIM checks. It also generates reports you can use to see how your email is being handled.

Think of it as three layers. SPF says who may send, DKIM signs the message to show it came from your domain, and DMARC tells the receiving server what to do when the first two fail, and sends you a report so you can see what is going on.

Why it matters even if you only send a few emails

There are two reasons: protection and delivery.

On protection, the NCSC says these controls help protect the people and organisations you do business with, and reduce fraud-related costs. Without them, it is easier for someone to send a convincing fake email that appears to come from your domain, for example a fake invoice with changed bank details sent to your customers.

On delivery, Google has published sender requirements for Gmail. Since 1 February 2024, every sender must set up SPF or DKIM for their sending domains, use a TLS connection, and keep spam rates below 0.3%, which Google measures through its Postmaster Tools. Google says senders who send 5,000 or more messages a day to Gmail accounts, the bulk senders, must also set up DMARC, make sure the domain in the From address aligns with the SPF or DKIM domain, and support one-click unsubscribe for marketing and subscribed messages.

Most small businesses are nowhere near 5,000 emails a day. But the same page applies the SPF or DKIM requirement to every sender, and setting up all three is the simplest way to avoid your genuine mail being treated with suspicion. If you send a monthly newsletter through a mailing platform, a booking system or an online shop, those tools are sending on your behalf, which is exactly the situation these records are designed to cover.

A calm, step-by-step rollout

The biggest mistake is switching on a strict DMARC policy on day one. If you forget one service that sends email for you, such as your accounting package, your website contact form or your newsletter tool, those legitimate messages could be rejected. Google's guidance for setting up DMARC recommends a gradual approach, and it is a sensible one:

• Start with p=none. Google describes this as taking no action on the message and delivering it to the intended recipient, while logging messages in a daily report.
• Move to p=quarantine once you are confident. Messages that fail are marked as spam, so recipients can still review them.
• Finish at p=reject when you are sure all your legitimate mail authenticates. The receiving server rejects unauthenticated messages, typically sending a bounce notification.

Google also describes a pct setting, which controls the percentage of unauthenticated messages the policy applies to. Its example is to start with a lower figure, such as 10 to 25 per cent, and increase it as you verify that authentication works across your mail streams.

What to do this week

You do not need to be technical to make progress. Work through this list, and hand the DNS changes to whoever manages your domain if you would rather not touch them.

• List everything that sends email as your business. Your main mailbox provider, your website forms, your newsletter tool, your invoicing or accounting software, your booking or ordering system and any customer service tool.
• Check who controls your domain's DNS. This is usually your domain registrar or web host. Authentication records are published there.
• Turn on SPF and DKIM. Most business email and newsletter providers give step-by-step instructions and the exact records to copy.
• Wait before adding DMARC. Google advises allowing 48 hours after setting up SPF and/or DKIM before you enable DMARC.
• Publish DMARC with p=none and a reporting address. Google suggests setting up a dedicated group or mailbox to receive reports using the rua tag, rather than using your own inbox. Reports arrive daily, and the volume depends on how much email you send.
• Read the reports and tighten up. Once every legitimate sender shows as passing, move towards quarantine and then reject.

Checking your setup

The NCSC's guidance points to its email security check service, which tests whether an email domain is configured in line with the standards in its guidance. One change to be aware of: the NCSC's Mail Check page states that Mail Check and Web Check were retired on 31 March 2026. It recommends that organisations use commercial external attack surface management products and subscribe to the NCSC's "Check your cyber security" service instead. If you followed older advice that tells you to sign up to Mail Check, it is no longer available.

Common questions

Is p=none enough? It is a safe starting point and gets you the reports, but it does not stop anyone spoofing your domain. The aim is to move towards a stricter policy once you understand your own mail. The NCSC guidance says untrusted email should be discarded, which is where a reject policy ends up.

What if I use Microsoft 365 or Google Workspace? The NCSC says to secure all your domains, including those using cloud providers such as Google Workspace and Microsoft 365. The records themselves are published in your own domain's DNS.

What if several tools send email for me? Each one needs to be covered by SPF or DKIM. This is exactly what the reports from your p=none stage are for: they show you which sources are sending as your domain, so you can add the ones you recognise.

Where we can help

If your email, website and booking tools are spread across several suppliers, getting them all to authenticate correctly can be fiddly. Our cloud and security team can help you review what is sending email as your business and set things up safely, one step at a time.

The short version

SPF, DKIM and DMARC are not a luxury for large companies. They protect your customers from fake emails in your name and help your real emails arrive. Start with SPF and DKIM, add DMARC at p=none, read the reports for a while, then tighten the policy gradually. Do it this week, and you will have removed one of the easiest routes for fraudsters to impersonate your business.