What DMARC, DKIM and SPF actually do

Email remains the primary vehicle for communication, collaboration, and commerce for UK SMEs. Its utility is undeniable. However, the underlying technology of email, developed decades ago, was never designed with security as a primary concern. This inherent weakness is precisely what cybercriminals exploit through domain spoofing and phishing attacks. For UK businesses, the threat is not theoretical; it is a daily reality. When an attacker successfully spoofs your company’s domain, they aren't merely sending a fake email; they are eroding your brand reputation, risking your compliance status with the Information Commissioner’s Office (ICO), and potentially tricking your employees or clients into wiring funds to fraudulent accounts.

To defend against these threats, you must implement a "triple-threat" of email authentication protocols: SPF, DKIM, and DMARC. While these acronyms are often thrown around by IT departments, understanding how they function—and why they must work in harmony—is essential for any business leader concerned with cyber security. This guide breaks down these protocols, explains why they are the standard for UK businesses, and provides a roadmap for securing your digital identity.

What DMARC, DKIM and SPF actually mean

At their core, SPF, DKIM, and DMARC are technical standards that allow email recipients to verify that an incoming message genuinely originated from the domain it claims to be from, and that its content has not been tampered with. Think of them as a layered security system for your domain's email identity. SPF (Sender Policy Framework) defines which servers are authorised to send email on your behalf. DKIM (DomainKeys Identified Mail) provides a cryptographic signature, confirming the message's integrity and authenticity. DMARC (Domain-based Message Authentication, Reporting, and Conformance) then unifies these two checks, providing a policy for handling unauthenticated emails and offering crucial reporting capabilities. Together, they create a robust defence against impersonation.

Why it matters for UK SMEs

For UK SMEs, implementing these protocols is no longer optional; it is a fundamental requirement for operational resilience, regulatory compliance, and maintaining commercial trust.

Compliance and GDPR

Under the UK GDPR, businesses are required to implement appropriate technical and organisational measures to protect personal data. A successful phishing attack resulting from domain spoofing can lead directly to a data breach, exposing sensitive client or employee information. If the ICO investigates and determines that your organisation failed to implement basic, widely recognised security standards—like DMARC at an enforcement policy—to prevent such an attack, you could face significant fines, mandatory reporting obligations, and severe reputational damage. It is a demonstrable failure to protect data that could have been avoided with standard email security measures.

Cyber Essentials Alignment and NCSC Guidance

The UK government-backed Cyber Essentials scheme is the widely accepted baseline for SME cyber security. While Cyber Essentials focuses on five key technical controls (firewalls, secure configuration, user access control, malware protection, and patch management), email authentication is consistently cited as a "best practice" requirement for maintaining a secure boundary and protecting against phishing. The National Cyber Security Centre (NCSC), which developed Cyber Essentials, explicitly recommends implementing these protocols to protect against email spoofing. By implementing SPF, DKIM, and DMARC, you are not just meeting a technical requirement; you are demonstrating to clients, partners, and insurers that your business takes data protection and cyber defence seriously. This can be crucial for tendering for contracts or securing favourable insurance premiums.

Protecting Your Brand Equity

In the UK, business trust is paramount. If a client receives a fraudulent invoice or a malicious link that appears to originate from your domain, their trust in your systems, and by extension, your brand, will be severely damaged. Rebuilding that trust is an expensive and time-consuming exercise. By locking down your domain with strict DMARC policies, you are effectively "signing" your communications, providing recipients with verifiable proof that an email is genuinely from you. This prevents your brand from being weaponised against your own customers, suppliers, or even your internal staff. The cost of a successful impersonation attack, from financial loss to reputational harm and incident response, invariably far outweighs the effort of implementing these protocols correctly.

How to implement robust email authentication

Implementing SPF, DKIM, and DMARC requires a methodical, phased approach. Rushing this process can lead to legitimate emails being blocked, causing significant business disruption.

1. Understanding SPF (Sender Policy Framework): Defining the "Who"

At its simplest level, SPF is a DNS (Domain Name System) record that acts as a guest list for your domain. It tells the rest of the world, "These are the only IP addresses and services authorised to send email on behalf of my company."

How it works: When you send an email, the receiving mail server checks your domain’s SPF record. If the email originates from a server listed in your record (such as Microsoft 365, Google Workspace, or your marketing platform), it passes the check. If it comes from an unknown, unauthorised server—like one used by a scammer in a different country—the check fails.

The limitations of SPF: SPF is a vital first step, but it has significant limitations. It does not handle email forwarding well; when an email is forwarded, the "envelope" information changes, which can cause the SPF check to fail even for legitimate messages. Furthermore, SPF does not provide any instructions to the receiving server on what to do if the check fails. It merely says, "This isn't on the list," but it doesn't explicitly command the receiver to discard the message. You can only have one SPF record per domain, which must be carefully constructed to include all legitimate sending services. Exceeding the 10 DNS lookup limit within an SPF record will cause it to fail.

2. Implementing DKIM (DomainKeys Identified Mail): Providing the Digital Seal

If SPF is the guest list, DKIM is the tamper-evident seal on a package. It ensures that the content of your email hasn't been altered in transit and provides a verifiable signature from your domain.

How it works: DKIM adds a digital signature to your emails. This signature is created using a private key that only your mail server or sending service possesses. When the receiving server gets your email, it uses a public key—which you publish as a TXT record in your DNS—to verify the signature. This cryptographic process confirms the email's origin and integrity.

Why DKIM is essential:

• Integrity: It proves that the message body and headers haven't been tampered with between your outbox and the recipient’s inbox.
• Authentication: It confirms that the email actually originated from your organisation, even if it has been routed through multiple servers or forwarded.
• Improved Deliverability: Major email providers like Gmail and Microsoft Outlook are more likely to deliver emails that are cryptographically signed with DKIM, as it signals that you are a legitimate sender.

3. Deploying DMARC (Domain-based Message Authentication, Reporting, and Conformance): The Master Controller

DMARC is the protocol that brings SPF and DKIM together. Without DMARC, SPF and DKIM are essentially "silent" protocols—they might tell a receiving server that a message is suspicious, but they don't tell the server what to do about it. DMARC provides the policy instructions and, crucially, feedback.

The three pillars of DMARC:

1. Alignment: DMARC ensures that the "From" address shown to the user matches the domain verified by SPF and DKIM. This prevents attackers from using their own valid SPF/DKIM records to bypass security while still spoofing your visible sender name.
2. Policy: You can instruct receiving servers to either p=none (monitor only), p=quarantine (send to junk), or p=reject (block entirely) any emails that fail authentication.
3. Reporting: This is the most powerful feature for IT managers. DMARC provides you with a feedback loop, sending you aggregate and forensic reports detailing who is sending mail on your behalf. This allows you to identify legitimate services you may have forgotten about or, more importantly, malicious actors attempting to impersonate you.

Practical Implementation Steps:

1. Audit your current state: Before making any changes, use online tools (e.g., DMARC Analyser, MXToolbox) to check if you have existing SPF, DKIM, or DMARC records published for your domain. Identify all services that send email on behalf of your domain (e.g., Microsoft 365, Google Workspace, CRM systems, marketing platforms, HR portals, accounting software, website contact forms).
2. Configure SPF correctly: Create or update your SPF TXT record to include all authorised sending IP addresses and hostnames. Remember, you can only have one SPF record per domain. Consolidate entries carefully.
3. Set up DKIM for all senders: For each service that sends email on your behalf, follow their specific instructions to generate and publish DKIM DNS records (typically CNAMEs or TXT records). This often involves creating a unique public/private key pair.
4. Start with DMARC p=none: Publish a DMARC TXT record with a policy of p=none. This is the "monitoring" phase. It allows you to receive reports on who is sending mail as you without actually blocking anything. Use this time, typically a few weeks to a month, to analyse the DMARC reports. These reports will highlight legitimate senders that are failing SPF or DKIM, allowing you to adjust your records accordingly. On a recent DMARC implementation for a 50-user manufacturing firm in Manchester, we identified 7 different third-party services (e.g., CRM, marketing platform, HR portal) that were sending emails on their behalf, none of which had been correctly authorised in their SPF or DKIM records. This monitoring phase is critical for preventing disruption.
5. Transition to p=quarantine: Once you are confident that no legitimate mail is failing authentication based on your DMARC reports, move to a p=quarantine policy. This instructs receiving mail servers to send suspicious mail to the recipient's junk or spam folder rather than blocking it entirely. Continue to monitor your DMARC reports closely during this phase.
6. Enforce p=reject: This is the ultimate goal. Once you are absolutely certain that all legitimate emails are correctly authenticating, switch your DMARC policy to p=reject. This tells the world to drop any email claiming to be from your domain that fails authentication. This provides the highest level of protection against spoofing and impersonation.

Common mistakes we see

Even with the best intentions, several common errors can undermine email authentication efforts for UK SMEs.

1. Incomplete Sender Lists: Often, businesses overlook third-party services (like survey tools, event management platforms, or HR systems) that send emails on their behalf, leading to legitimate messages failing authentication.
2. Rushing to p=reject: Implementing a DMARC p=reject policy without a thorough monitoring phase (p=none and p=quarantine) is a recipe for disaster, inevitably blocking legitimate business communications.
3. Ignoring DMARC Reports: The reporting feature is the most powerful aspect of DMARC. Failing to regularly review and act on these reports means missing critical insights into both legitimate and malicious email traffic. Frankly, ignoring them is akin to having a security camera system and never reviewing the footage.
4. SPF Record Overload: Attempting to include too many sending services in a single SPF record can exceed the 10 DNS lookup limit, causing the entire SPF record to fail silently.
5. Lack of DKIM for all senders: While SPF is a good start, relying solely on it leaves an avenue for attack. Ensuring all significant email senders have DKIM configured provides a stronger, more resilient authentication layer.

Key Takeaways

• SPF acts as an authorised guest list for your domain's sending IP addresses.
• DKIM provides a cryptographic seal to prove an email hasn't been altered and originated from your domain.
• DMARC ties SPF and DKIM together, providing clear instructions to receiving servers on how to handle failed authentication attempts and offering invaluable reporting.
• Visibility is key: DMARC reporting allows you to see exactly who is sending mail on your behalf, exposing potential threats and misconfigurations in real-time.
• Phased deployment is critical: Never jump straight to a "reject" policy without first monitoring your email traffic to avoid blocking legitimate business communications.
• Compliance: Implementing these protocols supports your obligations under UK GDPR and aligns your business with the UK government’s Cyber Essentials framework.

When to call in help

Securing your email is an ongoing process of monitoring and refinement. While the initial setup can seem daunting, particularly for those without deep technical expertise in DNS management and email flow, the protection it offers against impersonation and phishing is one of the highest-return investments an SME can make in its digital infrastructure. Getting it wrong can lead to significant business disruption.

To take the next step

Book a Discovery Call