Guide · Email security

Stop Email Spoofing: SPF, DKIM and DMARC for Small Businesses

By Christopher Smith, penetration tester·Published October 14, 2026·Updated October 15, 2026·6 min read

Anyone on the internet can send an email that claims to be from your domain. Without three DNS records, called SPF, DKIM, and DMARC, receiving mail servers have no reliable way to tell your real invoices from a criminal’s fake ones. With them, you tell the world which servers may send as you and what to do with mail that fails the check.

This guide explains the three records in plain English, then walks through setup for Google Workspace and Microsoft 365, with links to each vendor’s own instructions. Budget about an hour of hands-on time, then a few weeks of watching reports before you tighten anything.

Quick verdict

• Publish SPF, DKIM, and a monitoring DMARC policy first so you can see who sends as your domain without breaking mail.
• Move DMARC to enforcement (quarantine/reject) only after your source list is clean and legitimate mail is aligned.
• Protect domains that never send mail with a denying SPF and a reject DMARC so spoofers cannot use them.
• Do not jump straight to reject on a domain with many SaaS senders you have not inventoried — that is how you brick invoices and password resets.

What SPF, DKIM and DMARC do (plain English)

• SPF (Sender Policy Framework) is a published list of the servers allowed to send mail for your domain. A receiving server checks whether the message came from one of them.
• DKIM (DomainKeys Identified Mail) adds a digital signature to each message. The receiving server checks it against a public key in your DNS, which proves the message really came from your mail system and was not altered on the way.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) ties the two together. It tells receivers what to do when a message claiming to be from you fails SPF and DKIM (nothing, send to spam, or reject), and it asks them to send you reports about who is sending as your domain.

SPF and DKIM on their own do not stop someone from forging the “From” address your customers actually see. DMARC is the piece that does, which is why you need all three.

Step 0: List everything that sends email as you

The most common way to break your own email is to publish strict records and forget a service. Before touching DNS, write down every system that sends mail using your domain:

• Your mailbox provider (Google Workspace or Microsoft 365)
• Newsletter and marketing tools (Mailchimp, Constant Contact, and so on)
• Invoicing, accounting, and CRM tools that email customers “from” you
• Your website’s contact form, store, or booking system
• Printers or scanners that send email, and any help-desk tool

Each third-party sender has its own SPF and DKIM instructions. Look up “[service name] SPF DKIM” in its help center and add those as you go.

Google Workspace setup

Google’s own overview is Google Workspace: help prevent spoofing, phishing and spam.

1. SPF

In your DNS host, add a TXT record on your root domain (often shown as @). If you only send through Google, Google’s documented value is:

v=spf1 include:_spf.google.com ~all

If other services also send as you, add their include: entries to the same record. A domain must have only one SPF record. Two records count as an error. See Google: set up SPF.

2. DKIM

1. In the Google Admin console, go to Apps → Google Workspace → Gmail → Authenticate email.
2. Select your domain and generate a new record (choose the 2048-bit key if your DNS host supports it).
3. Copy the TXT record Google shows you (the host name is usually google._domainkey) and add it at your DNS host.
4. Back in the Admin console, click Start authentication. DNS changes can take a while to spread, so if it fails, wait and try again.

Full steps: Google: set up DKIM.

3. DMARC

Add a TXT record with the host name _dmarc. Start in monitor-only mode:

v=DMARC1; p=none; rua=mailto:[email protected]

Use a mailbox (or a free or paid DMARC report service) that you will actually check. See Google: set up DMARC. If your business sends a lot of email to Gmail users, read Google’s email sender guidelines: Google requires authentication from all senders, and DMARC from bulk senders.

Microsoft 365 setup

Microsoft’s overview is Email authentication in Microsoft 365.

1. SPF

Add a TXT record on your root domain. If Microsoft 365 is your only sender, Microsoft documents this value:

v=spf1 include:spf.protection.outlook.com -all

Add any other services’ include: entries to that same single record. SPF has a limit of 10 DNS lookups, so a long list of includes can break it. Microsoft’s page explains how to stay under it: Microsoft: set up SPF.

2. DKIM

1. Open the Microsoft Defender portal and go to Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM.
2. Select your custom domain. Microsoft shows two CNAME records to publish.
3. Add both CNAME records at your DNS host exactly as shown.
4. Return to the DKIM page and turn on Sign messages for this domain with DKIM signatures.

Microsoft 365 signs mail with your onmicrosoft.com domain by default, which does not help DMARC on your own domain. This step fixes that. Full steps: Microsoft: set up DKIM.

3. DMARC

Add the same _dmarc TXT record shown in the Google section, starting with p=none. Microsoft’s walkthrough, including how to move to stricter policies, is Microsoft: set up DMARC.

Who should choose which

Choose monitoring (p=none) if…

• You just listed your senders and need reports before changing delivery.
• You still have unknown SaaS tools sending as your domain.

Choose enforcement (quarantine/reject) if…

• DMARC reports show only senders you expect, with aligned SPF/DKIM.
• You are ready to treat unauthenticated mail using your domain as hostile.

From monitoring to enforcement

p=none protects nothing yet. It only collects data. The point is to find every legitimate sender before you start blocking. A sensible path:

1. Weeks 1–4, p=none: read the reports. Every legitimate service should show as passing. Fix any that fail by adding its SPF include or DKIM record.
2. Next, p=quarantine: failing mail goes to spam. You can roll it out gradually with the pct= tag, for example pct=25.
3. Finally, p=reject: receivers refuse forged mail outright. This is the goal for most businesses once reports are clean.

Raw DMARC reports are XML files that are hard to read. Many services turn them into simple dashboards. Some have free tiers for small domains, so compare a few before you pay.

Don’t forget domains that never send email

If you own extra domains that never send mail (old brand names, typo domains), lock them down so nobody can spoof them either:

SPF (TXT on @):     v=spf1 -all
DMARC (TXT on _dmarc): v=DMARC1; p=reject

Common mistakes

• Two SPF records. Merge them into one.
• Jumping straight to p=reject before checking reports, and silently losing invoices sent from your accounting tool.
• Forgetting DKIM for third-party senders. SPF alone often fails DMARC when a service sends on your behalf.
• Sending reports to an inbox nobody reads.

Bottom line

List your senders, publish one SPF record, turn on DKIM in Google Workspace or Microsoft 365, and add a DMARC record at p=none. Read the reports for a few weeks, then move to quarantine and reject. After that, a criminal sending “pay this invoice” emails as your domain gets blocked or sent to spam instead of landing in your customers’ inboxes. DMARC protects your domain, not your inbox, so keep phishing-resistant sign-in for your own accounts too (see our Microsoft 365 MFA guide).