Email was invented at a time when everyone on the internet trusted each other. As a result, the basic system has no built-in way to check that an email really came from the person it claims to be from. Anyone can type any address into the "From" line.
That's how invoice fraud works. A criminal sends an email that appears to come from your business, telling your client that "our bank details have changed". The client pays the next invoice into the criminal's account. By the time anyone notices, the money is gone.
Three settings, known as SPF, DKIM and DMARC, make this far harder. They're free to set up, they don't change anything your staff see, and they also help your genuine emails stay out of spam folders. Here's what each one does, in plain English.
The short version
Think of your email domain (the part after the @) as your company's letterhead.
- SPF is a public list of who is allowed to post letters on your letterhead.
- DKIM is a tamper-proof seal on every letter, proving it came from you and wasn't changed on the way.
- DMARC is your instruction to the post office about what to do with letters that fail those checks, plus a weekly report on who's been using your letterhead.
You need all three. Each one covers a gap the others leave open.
SPF: who is allowed to send your email
SPF (Sender Policy Framework) is a short line of text published in your domain's public settings, known as DNS. It lists the services allowed to send email using your domain: for example, Microsoft 365, your accounting software, your newsletter tool and your website's contact form.
When a receiving mail server gets an email claiming to be from you, it checks your SPF record. If the email came from a service on the list, it passes. If not, it fails.
Common SPF mistakes:
- Forgetting a sender. If your invoicing software sends email "from" your domain but isn't in your SPF record, your own invoices can fail the check and land in spam.
- Having two SPF records. A domain can only have one. Two records usually means both are ignored.
- Too many lookups. SPF has a limit of 10 lookups. Businesses that add every service they've ever used can go over it without realising, and the whole record stops working.
- Ending the record with "+all". This tells the world that anyone can send as you, which defeats the point.
DKIM: a digital signature on every email
DKIM (DomainKeys Identified Mail) adds an invisible digital signature to every email you send. The receiving server checks that signature against a public key published in your DNS.
If the signature matches, the receiver knows two things: the email really came from a system you control, and it wasn't changed along the way.
Common DKIM mistakes:
- Never switching it on. Microsoft 365 and most other email platforms support DKIM, but on many setups it has to be enabled and the matching DNS records added. It's surprisingly often skipped.
- Third-party senders not signing. Each service that sends email as you, such as a newsletter platform or CRM, needs its own DKIM set up.
DMARC: what happens to fake emails
SPF and DKIM on their own only produce a pass or fail. Neither tells the receiving server what to do with an email that fails. That's DMARC's job.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is another short DNS record. It does two things:
- It sets a policy for emails that fail the checks:
- p=none: deliver them anyway, but report them to me. This is the monitoring stage.
- p=quarantine: send them to the spam or junk folder.
- p=reject: block them completely.
- It sends you reports showing every service that has sent email using your domain, and whether it passed or failed.
DMARC also checks something called alignment: that the domain in the visible "From" address matches the domain that passed SPF or DKIM. This is what stops a criminal passing the checks with their own domain while displaying yours.
The most common DMARC mistake is setting it to p=none and leaving it there forever. A p=none policy collects reports but doesn't stop a single fake email. It's a starting point, not the finish line.
Why this matters more now
For years these settings were "good practice". They're now becoming a requirement.
Since February 2024, Google and Yahoo have required businesses sending large volumes of email to their users to have SPF, DKIM and DMARC in place. Microsoft introduced similar rules for high-volume senders to Outlook.com addresses in 2025. Even if you don't send in bulk, mail providers increasingly treat domains without these settings as less trustworthy, which means more of your genuine emails land in spam.
Cyber insurers also ask about email security, and a missing DMARC record is one of the easiest things for anyone to check from the outside.
How to set them up safely
Getting this wrong can stop your own emails being delivered, so it's worth taking it step by step:
- List everything that sends email as you. Microsoft 365, your accounting or invoicing software, your CRM, newsletter tool, website forms, scanners, phone system and any booking or payment platform.
- Create or fix a single SPF record that includes them all, and check it's under the lookup limit.
- Turn on DKIM in Microsoft 365 and in each third-party service that sends as you.
- Publish a DMARC record at p=none with an address to receive reports.
- Read the reports for a few weeks. They'll show any legitimate sender you've forgotten. Fix those first.
- Move to p=quarantine, and then to p=reject once you're confident all your genuine email passes.
- Keep monitoring. Every time you add a new service that sends email, it needs to be added to SPF and DKIM.
Most businesses can get from nothing to full protection within a few weeks. The time is mainly spent watching the reports, not doing technical work.
How CastCom helps
Setting up SPF, DKIM and DMARC is part of our email domain protection service. We find every service that sends email as you, set up all three records, move your policy safely to full protection and keep monitoring the reports, so a new piece of software doesn't quietly break your email or open a gap.
The bottom line
If your domain doesn't have SPF, DKIM and DMARC set up properly, anyone can send email that looks like it came from you. Fixing it is inexpensive, invisible to your staff and one of the most effective ways to protect your clients from invoice fraud in your name.
Is your domain protected? Run our free email spoofing check. Type your domain and see in seconds whether your SPF, DKIM and DMARC are set up, plus a plain-English report on what to fix.