Many fraud attempts start with an email that seems to come from your own management, a supplier or the bank. Without protection anyone can use such a sender address. SPF, DKIM and DMARC make that much harder and belong to every domain’s basic setup.
The three building blocks
SPF (Sender Policy Framework) lists in DNS the servers allowed to send email for the domain. DKIM (DomainKeys Identified Mail) signs outgoing messages so the recipient can verify they were not altered and come from the domain. DMARC (Domain-based Message Authentication, Reporting and Conformance) ties both to the visible sender address and sets a policy.
The policies
With p=none failing emails are only reported, not blocked. With p=quarantine they go to spam, with p=reject they are refused. DMARC reports show which systems send on the domain’s behalf, including forgotten ones such as a newsletter tool or invoicing system.
Rollout without delivery problems
The safe route starts with p=none and analysing reports for a few weeks. Then all legitimate senders are added to SPF and DKIM and the policy is tightened step by step. Since 2024 large mailbox providers such as Google and Yahoo require bulk senders to have SPF, DKIM and a DMARC record; for everyone else it is a matter of protecting their own brand.
Context
Missing or lax DMARC records are among the most common findings in attack surface management. They do not prevent every phishing attempt but stop your own domain from being abused for it. Together with multi-factor authentication, DMARC is among the most effective measures per hour invested.