Here’s an unsettling fact about email’s original design: it has no built-in proof of sender. Anyone, anywhere, can put your company’s domain in the From line — and for decades, that’s exactly what criminals did to impersonate businesses to their own clients and vendors. SPF, DKIM, and DMARC are the three-part fix, and while the acronyms are ugly, the ideas are simple. More importantly: if your domain doesn’t have all three configured, criminals can send email as you — and increasingly, real mail from you gets treated with suspicion. Here’s the plain-English version, and the safe rollout order.

The three parts, translated

SPF — the list of approved senders. A public record on your domain declaring which mail servers are allowed to send as you: Microsoft 365, your newsletter platform, the invoicing system. A receiving server checks the list; mail from anywhere else fails the check. Think of it as the club’s guest list.

DKIM — the tamper-proof signature. Your mail servers cryptographically sign each outgoing message; recipients verify the signature against a public key on your domain. It proves two things at once: the message really came from your systems, and nobody altered it in transit. The wax seal to SPF’s guest list.

DMARC — the enforcement policy. Here’s the part almost everyone misses: SPF and DKIM alone check things but enforce nothing. A message can fail both and still land in the inbox, because without instructions, receivers just shrug. DMARC is the instruction: a record saying “if a message claiming to be from us fails these checks, do this” — nothing (p=none), quarantine it to spam (p=quarantine), or reject it outright (p=reject) — plus, brilliantly, “and send me reports about what you’re seeing.” A domain with SPF and DKIM but no DMARC has installed the locks and left the door open.

Why this made the security list (and the deliverability list)

Two attacks die when DMARC is enforcing. Exact-domain spoofing — the executive-impersonation email sent literally from owner@yourcompany.com, and the fraud emails sent as your company to the clients and vendors who trust you — the variant of payment fraud where your customers are the victims and your name is the weapon. It also protects your own inbox’s judgment: your filtering trusts these checks when evaluating inbound mail, so the whole ecosystem works better when everyone enforces.

And there’s a carrot alongside the stick: Google and Yahoo now require authentication (DMARC included, for bulk senders) for reliable delivery, and Microsoft weights it heavily. Businesses discover this backwards — “our quotes keep landing in customers’ spam” — and the fix is this article. Proper authentication is now simply the price of your legitimate email arriving.

Honest scope note: DMARC stops exact-domain impersonation. Lookalike domains (yourcompany-inc.com) and display-name tricks are different attacks, handled by filtering and trained eyes. You need both layers; this one’s the foundation.

The rollout: patient, in this order

The danger in email authentication isn’t configuring it — it’s configuring it wrong and blocking your own legitimate mail. The safe sequence, honed by everyone who’s done it the painful way:

  1. Inventory everything that sends as your domain. Microsoft 365, yes — but also the newsletter tool, the CRM, the accounting system’s invoices, the scanner, the website’s contact form. The SaaS inventory already has most of this list. The senders you forget are the mail you’ll break.
  2. Publish SPF covering all of them, and enable DKIM everywhere it’s offered — Microsoft 365 makes its own straightforward; third-party senders each have a setup page for signing as your domain.
  3. Turn on DMARC in monitor-only mode (p=none) with reporting. Nothing changes for delivery; you start receiving reports of everything claiming to be you. Run a report tool over them for a few weeks — this is where the forgotten invoice system reveals itself, and where you may get your first look at who’s already spoofing you.
  4. Tighten to quarantine, then reject, once the reports run clean. Weeks, not days, between steps. p=reject is the destination — that’s the setting where spoofing your domain actually stops working — but arriving there patiently is what makes the trip invisible to your real mail.

This is squarely a have-your-IT-handle-it project (it’s standard work in a managed relationship — and a check we run in every security review, because the insurance questionnaires ask and the answer is usually “half-configured”). The owner-level takeaway is the question to ask: “Are we at DMARC reject, and if not, where are we in the rollout?”

The bottom line

SPF lists your senders, DKIM signs your mail, DMARC enforces the rules and reports the attempts — and together they take “send email as this company” off the criminal menu while keeping your own mail out of spam folders. It’s a few DNS records and a patient month, protecting the most impersonated asset you own: your name in an inbox.