Quick answer: SPF, DKIM and DMARC are three email authentication records that prevent fake email from being sent in your domain's name, and they work together. SPF defines which servers can send email on your behalf. DKIM adds a cryptographic signature to outgoing emails so it can be verified the content was not changed. DMARC tells the receiving server what to do (ignore, quarantine, reject) when SPF and DKIM fail, and sends you reports. Setting up all three correctly largely stops fraudsters from sending phishing email in your brand's name. The most common mistake in setup is never adding DMARC or configuring SPF/DKIM incompletely; until these three are complete, your domain is an open target.

A fraudster sending a fake email to your customers or employees in your company's name is far easier than you think. The email protocol, by design, does not verify the sender address; that is, someone can write your domain as the sender. SPF, DKIM and DMARC exist to close exactly this gap. This article explains what these three records do and how to set them up in the right order.

Why it is needed

Email has a fundamental weakness: the sender address can easily be faked. An attacker can use your domain to send fake invoices to your customers and fake executive instructions to your employees; this is the basis of email fraud and CEO fraud. SPF, DKIM and DMARC give receiving servers the ability to reliably answer the question did this email really come from this domain. Without these records, sending fake email in your domain's name is easy.

What the three do

Record Its job The question it answers
SPF Lists authorized sender servers Is this server authorized to send?
DKIM Adds a cryptographic signature to email Was the content unaltered?
DMARC Says what to do on failure What if SPF/DKIM does not pass?

The three form a chain. SPF and DKIM do the verification; DMARC tells the recipient what to do when this verification fails and reports to you what is happening.

The correct setup order

Setup has an order and following it matters. Set up SPF and DKIM first, because DMARC relies on them. For SPF, you list all legitimate servers that send email in your domain's name (your own mail server, the marketing tools you use, your cloud email service) in a TXT record. For DKIM, you add the signing key your email provider gives you to DNS. After both work, you add DMARC.

DMARC: gradual tightening

Turning DMARC directly to the strictest setting is risky; your legitimate emails can be accidentally blocked. The correct approach is gradual:

Stage Policy Purpose
1 p=none Only monitor and report, no blocking
2 p=quarantine Send suspicious email to spam
3 p=reject Fully reject unverified email

Start in monitoring mode (p=none) first; DMARC reports show who is sending email in your domain's name. After making sure all your legitimate senders pass correctly, you gradually rise to the quarantine and reject levels. This patience provides full protection without losing your legitimate emails.

Why to start with an audit

Before setting up these records, you need to know your current state: which records exist, which are missing or wrong. Many organizations have SPF but no DMARC at all; this is like locking half the door. An external security assessment reveals these gaps; we covered why email security is the first step of every audit and the typical gaps within a penetration test and security assessment framework.

The KAOS and DSET approach

DSET helps organizations set up their email authentication infrastructure correctly. Our local AI engine KAOS scans a domain's SPF, DKIM and DMARC records to detect missing or wrong configurations and reports every finding with a working proof. An important honesty note: a missing DMARC is a weakness but does not alone mean spoofing is possible; the real risk is verified with a deliverability test. The goal is to genuinely make it hard to send fake email in your domain's name.

Frequently asked questions

I have an SPF record, is this enough? No. SPF is an important first step but incomplete alone. SPF only defines which servers can send; it does not cover that the content is unaltered (DKIM) and what to do when verification fails (DMARC). The three work together. Especially without DMARC, when SPF and DKIM fail the receiving server does not know what to do; protection stays half done.

Can I set DMARC directly to reject mode? You should not. Setting DMARC directly to the strictest setting (p=reject) can cause your legitimate emails to be accidentally blocked. The correct path is gradual: first see who is sending email with monitoring (p=none), make sure all legitimate senders pass, then gradually rise to quarantine and reject. This patience prevents email loss.

Does the absence of DMARC mean my domain can be spoofed? Saying so directly is not accurate. A missing DMARC is a weakness and increases risk, but whether an email can actually be delivered depends on other factors too. The real risk is verified with a deliverability test. Still, the right approach is to set up SPF, DKIM and DMARC fully without waiting; because incomplete configuration is a gap in any case.

Sources

To set up your domain's email authentication correctly, contact DSET. We provide email security consulting from our Ankara Hacettepe Teknokent laboratory.