If you own a domain, like yourbusiness.ie, anyone in the world can try to send an email that says it’s from you. Three records on your domain decide whether Gmail, Outlook and everyone else believe them.
SPF: the guest list
SPF is a list of the services allowed to send email for your domain, for example Microsoft 365, your website and your invoicing software. If an email comes from somewhere not on the list, it fails SPF.
DKIM: the signature
DKIM adds an invisible digital signature to every email you send. The receiver checks it against a key published on your domain. If the email was faked or changed on the way, the signature doesn’t match.
DMARC: the instruction
DMARC tells receivers what to do when an email fails: deliver it anyway (p=none), put it in spam (p=quarantine) or block it (p=reject). It also sends you reports showing who is sending as you.
Why it matters for a small business
- It stops fake invoices sent “from you” to your customers.
- Your genuine emails are less likely to land in spam.
- It’s part of what the .IE Digital Trust Mark assessment checks.
Doing it safely
Jumping straight to p=reject can block your own invoices if a sender was missed. We start in monitor mode, read the reports and tighten it in stages. See how we set it up.