CMMC

SPF, DKIM and DMARC in Plain English: Email Security Beyond the Spam Filter

A spam filter protects your inbox. SPF, DKIM and DMARC protect your name, because they decide whether someone else can send email that convincingly claims to come from your domain. Most small firms have a decent filter and only part of the second job done, and the gap is the part that hits customers, vendors and your own accounts payable team.

Published 2026-10-17 · Reviewed 2026-10-17

Capital Cyber. Sources are listed at the end of the article.

Why Isn't a Good Spam Filter Enough to Stop Email Fraud?

None of this is new or exotic. These three records are free-standing internet standards published years ago, and they cost nothing to publish. Where firms run into trouble is in the details: records that are half finished, policies left in monitoring mode for good, and the belief that once the records exist, impersonation is solved. It is not, and the rest of this post explains why.

A spam filter looks at messages arriving at your organization and tries to catch the bad ones. It does nothing about a criminal who sends mail to your clients or your bank pretending to be you. The receiving side decides whether to trust that message, and it makes that call partly from records you publish in your own DNS. If those records are missing or weak, the receiving side has very little to go on.

The more damaging attacks also tend to carry no malware at all. Business email compromise is usually just a believable request: change the bank details on this invoice, buy these gift cards, send me the W-2 file. Microsoft's threat intelligence team recently published guidance on protecting organizations from AI-assisted executive impersonation and invoice fraud, which is a reasonable signal of where this is going. Well-written, well-timed fraud messages are getting easier to produce, so the technical checks that confirm who actually sent a message matter more, not less.

What Does SPF Actually Do?

SPF, short for Sender Policy Framework, is a DNS record that lists the servers allowed to send email for your domain. When a message arrives claiming to be from your domain, the receiving server checks whether the sending server is on your list. If it is, SPF passes. If not, the message fails, and your record can tell receivers how seriously to take that failure.

SPF has two limits worth knowing. First, it checks the technical return address used during delivery, not the From address a person sees in their mail client, so on its own it does not stop someone from showing your name in the visible From line. Second, the standard caps how many DNS lookups an SPF record can trigger at ten. Firms that add every marketing platform, billing system and help desk tool they have ever used can quietly exceed that cap, and then SPF breaks for everyone. Forwarded mail also tends to fail SPF, because the forwarding server is not on your list.

What Does DKIM Add on Top of SPF?

DKIM, short for DomainKeys Identified Mail, attaches a cryptographic signature to each outgoing message. You publish a public key in DNS, your mail system signs messages with the matching private key, and the receiving server uses your public key to confirm two things: that the message was signed by someone holding your key, and that the signed parts were not changed in transit.

Because the signature travels with the message, DKIM usually survives ordinary forwarding where SPF does not. It is not perfect. Some mailing lists and security gateways change messages in ways that break the signature. And like SPF, a DKIM pass on its own does not prove that the domain in the visible From line is the one that signed. Microsoft 365 and Google Workspace both support DKIM signing for custom domains, but in many setups someone has to turn it on and publish the keys. Do not assume it is already running.

How Does DMARC Tie SPF and DKIM Together?

DMARC, short for Domain-based Message Authentication, Reporting and Conformance, closes the gap the other two leave open. It requires that the domain in the visible From address line up with a domain that passed SPF or DKIM. That alignment check is what finally connects the authentication to the name your recipient actually reads.

DMARC also lets you tell receivers what to do when a message fails. A policy of none means monitor only and deliver as usual. Quarantine means treat it as suspicious, which usually means the spam folder. Reject means refuse it outright. DMARC can also ask receivers to send you aggregate reports showing who is sending mail under your domain and whether it passes, which is how you find the forgotten systems before you tighten the policy.

The direction of travel is clear. CISA's Binding Operational Directive 18-01 required federal civilian agencies to publish DMARC with a reject policy. Google and Yahoo now require authentication from senders, with stricter requirements for high-volume senders, including a published DMARC record. A domain sitting at none forever is doing the reporting half of the job and skipping the protection half.

What Can't SPF, DKIM and DMARC Stop?

These records protect your exact domain. They do nothing about a lookalike domain registered by a criminal, one that swaps a letter or adds a word, because that domain can pass all three checks on its own terms. They do not stop display name tricks, where the sender's name reads as your CEO but the address underneath is a random free mailbox. And they do not help when an attacker logs into a real mailbox, yours or a vendor's, because mail sent from a compromised account is authentic in every technical sense.

That is why email security has to reach past the message itself. Phishing-resistant multifactor authentication makes account takeover much harder. Alerts on new inbox forwarding rules and unusual sign-ins catch takeovers that still happen. External sender banners help staff notice when a message claiming to be internal is not. And the most dependable control is procedural: any change to payment details gets confirmed by phone at a number you already have on file, never one supplied in the email. For government contractors, email protections also sit inside broader compliance obligations such as CMMC, which deserve their own deep dive elsewhere. The basics here apply whatever framework you answer to.

How Should a Small Firm Roll Out DMARC Without Breaking Its Own Email?

Start with an inventory of everything that sends mail as your domain. The obvious one is Microsoft 365 or Google Workspace. The less obvious ones cause the trouble: the accounting or invoicing platform, the CRM, the newsletter tool, the website contact form, the practice management software, and the scanner that emails documents. Each one needs to be covered by SPF, signed with DKIM, or both.

Next, publish or clean up your SPF record, turn on DKIM signing in your main mail platform and in every third-party sender that supports it, and publish a DMARC record at a policy of none with reporting turned on. Then read the reports. They are machine formatted and tedious to read raw, which is why most firms use a reporting tool or a provider to turn them into something readable. Once legitimate mail is consistently passing and aligned, move to quarantine, watch for problems, and then move to reject. Depending on how many systems send on your behalf, that can take a few weeks or a few months. Rushing it is how firms end up blocking their own invoices.

Do not forget the domains you own but never send from, such as old brand names or defensive registrations. Those are easy targets for spoofing because nobody is watching them. An SPF record that authorizes no senders and a DMARC record set to reject tells the world that any mail claiming to be from those domains is fake.

Frequently Asked Questions

6 QUESTIONS

Do I need SPF, DKIM and DMARC, or is one enough?

You need all three, because each covers a different gap. SPF lists your approved sending servers, DKIM proves a message was signed by your domain and not altered, and DMARC checks that those results match the From address people actually see. Without DMARC, SPF and DKIM can pass while the visible sender is still spoofed.

Will setting DMARC to reject block my legitimate email?

It can if you skip the monitoring phase. Any system that sends as your domain without being covered by SPF or DKIM will have its mail refused once the policy is reject. Starting at none, reading the aggregate reports and fixing every legitimate sender before tightening the policy prevents that.

Does DMARC stop business email compromise?

DMARC stops criminals from sending mail that uses your exact domain in the From address. It does not stop lookalike domains, display name spoofing or mail sent from a real account that has been compromised. Business email compromise defense also needs strong multifactor authentication, sign-in monitoring and a phone verification rule for payment changes.

How long does it take to reach a DMARC reject policy?

For a small firm with few sending systems, it can take a few weeks. Firms with many third-party platforms sending on their behalf often need a few months to find and fix every source. Your aggregate reports set the pace, not a calendar.

Do domains that never send email need these records?

Yes. Unused domains are attractive for spoofing because nobody watches them. Publishing an SPF record that authorizes no senders and a DMARC record with a reject policy tells receiving servers to refuse any mail claiming to come from that domain.

Is email authentication a one-time setup?

No. Every new platform that sends email as your domain has to be added, and retired platforms should be removed so your SPF record stays under its lookup limit. Reviewing DMARC reports on a regular schedule is how you catch changes before they turn into delivery failures or spoofing gaps.

Sources

READ 2026-10-17

This article explains the regulations and is not legal advice.

Next Steps

Managed Security at Capital Cyber

Talk to Capital Cyber

Talk it through in 30 minutes.

A call is a conversation, not a pitch. Tell us how your business runs and we will tell you what we would manage.

Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.

Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.

Book a 30-Minute Call