SPF, DKIM and DMARC Explained: A Practical Guide for Businesses
Have you ever received an email that appeared to come from a company you trust, only to discover that it was fake?
Email impersonation is a common technique used in phishing and business email compromise attacks. Attackers may attempt to send messages that appear to come from your business domain.
If your organization uses a custom email domain, there are three important email authentication technologies you should understand:
- SPF (Sender Policy Framework)
- DKIM (DomainKeys Identified Mail)
- DMARC (Domain-based Message Authentication, Reporting and Conformance)
Together, these technologies help receiving email systems verify whether messages are authorized to use your domain.
1. What is SPF?
SPF tells receiving mail servers which systems are authorized to send email on behalf of your domain.
For example, if your business uses yourcompany.ca, your SPF DNS record identifies the authorized email sending infrastructure.
When another server receives a message claiming to come from your domain, it can check the SPF record to see whether the sending server is authorized.
If the server is not authorized, the message may fail SPF validation.
Think of SPF as an approved-sender list for your domain.
2. What is DKIM?
DKIM adds a digital signature to outgoing email.
The sending mail server signs a message using a private cryptographic key. The receiving server can retrieve the corresponding public key from DNS and verify the signature.
This helps establish that the message was signed by an authorized domain and that signed portions of the message have not been altered in transit.
Think of DKIM as a digital signature attached to your email.
3. What is DMARC?
DMARC builds on SPF and DKIM.
It allows a domain owner to publish a policy that tells receiving systems how to handle messages that fail DMARC authentication.
It also supports reporting, which can help domain owners understand how their domain is being used.
DMARC has three commonly used policies:
| Policy | Meaning |
|---|---|
p=none |
Monitor authentication results without requesting a special handling action |
p=quarantine |
Ask receiving systems to treat failing messages as suspicious |
p=reject |
Ask receiving systems to reject failing messages |
DMARC checks whether SPF or DKIM passes and whether the authenticated domain aligns with the domain shown in the message’s From address.
Think of DMARC as the policy that tells receiving systems what to do when authentication checks fail.
Why do businesses need all three?
Each technology has a different role:
- SPF identifies authorized sending servers.
- DKIM verifies a cryptographic signature.
- DMARC applies an authentication policy and provides reporting.
Using all three provides a stronger defence against email domain spoofing and impersonation.
The Canadian Centre for Cyber Security recommends configuring SPF, DKIM and DMARC to help protect organizational email domains.
Read its guidance: Quick Guide to Email Configuration.
Does email authentication guarantee that your business is protected?
No. SPF, DKIM and DMARC are important protections, but they do not prevent every phishing attack or guarantee that every email is legitimate.
They do not replace:
- Strong mailbox passwords
- Multi-factor authentication
- Spam and malware filtering
- Employee security awareness
- Secure email server configuration
- Regular monitoring of authentication reports
Email security works best when several protections work together.
What should you check with your email provider?
If you use a custom domain for business email, ask your provider:
- Does the service support SPF configuration?
- Is DKIM signing configured for my domain?
- Can I publish and manage a DMARC policy?
- Can I receive or review DMARC reports?
- Is email traffic protected using TLS where supported?
You should also verify your DNS configuration after making changes. Incorrect records can affect legitimate email delivery.
For more detailed technical instructions, consult the Canadian Centre for Cyber Security’s Implementation Guidance: Email Domain Protection.
Secure your business email domain
Email authentication is not just an IT concern. Your domain represents your business, and protecting it helps protect your customers, employees and business reputation.
TinyMail supports custom-domain business email with SPF, DKIM and DMARC configuration, alongside webmail, IMAP/SMTP access, calendar, contacts and spam and malware filtering.
A professional email domain deserves professional protection.