You can check your own domain right now with our free email security checker — it takes a few seconds and tells you which of the records below you have, and what is wrong with them.
Why these records exist
Email was designed in an era of trust: the “From” address on a message is just text, and nothing in the original protocol stops anyone typing your address into it. SPF, DKIM and DMARC were added on top to let receiving servers check whether a message really came from the domain it claims to. Each one is a record you publish in your domain’s DNS.
SPF: who is allowed to send
An SPF record is a single TXT record on your domain listing the servers allowed to send email as you. A typical one looks like this:
v=spf1 include:spf.yourprovider.example include:servers.mcsv.net -all
- Each
include:authorises a service — your email provider, your marketing platform, your accounts software. - The ending says what to do with everyone else:
-all(fail them) or~all(soft fail, usually junk). Never+all, which authorises the entire internet.
The three SPF mistakes we see most:
- Two SPF records. You may only have one. Two means SPF is treated as broken for every message.
- More than 10 DNS lookups. Each include can contain more includes. Go over 10 in total and SPF fails outright.
- A forgotten sender. The CRM, the invoicing system or the website contact form sending as your domain, but missing from the record.
Our SPF checker catches the first two, counting lookups through every include.
DKIM: proving the message is genuine
DKIM adds a cryptographic signature to every message you send. Your email provider holds the private key; you publish
the matching public key in DNS under a “selector”, such as selector1._domainkey.yourcompany.co.uk.
Receivers use it to check that the message genuinely came from a server holding your key, and that nobody altered it
on the way.
DKIM is switched on in your email provider’s settings, which then gives you the DNS record or records to publish. Each service that sends as you — email platform, marketing tool, helpdesk — should be set up to sign with your domain. Use 2048-bit keys where the provider offers them. Check a key is published with the DKIM checker, using the selector your provider gives you.
DMARC: what to do when checks fail
DMARC is the record that makes the other two count. Published at _dmarc.yourcompany.co.uk, it does two
things: it tells receivers what to do with mail that fails, and it asks them to send you reports about who is sending
as your domain.
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourcompany.co.uk
p=none— monitor only. Failing mail is still delivered.p=quarantine— failing mail goes to junk.p=reject— failing mail is refused. The strongest protection against spoofing.
For a message to pass DMARC, it must pass SPF or DKIM and that pass must align with the domain in the visible From address. That alignment is what stops a fraudster passing SPF with their own domain while showing yours.
See what your own policy does with the DMARC checker.
Setting them up in the right order
- List every service that sends email as your domain. Mail platform, marketing, invoicing, CRM, website, helpdesk, scanners.
- Publish one SPF record covering them all, ending in
~all, and check it stays under 10 lookups. - Turn on DKIM for each service and publish its keys.
- Publish DMARC at
p=nonewith a reporting address, and read the reports for two to four weeks. - Fix anything the reports show failing — usually a sender you forgot in step one.
- Move to
p=quarantine, thenp=reject. Optionally tighten SPF to-all.
The commonest mistake is jumping straight to p=reject before step five, and then wondering why the
invoicing system’s emails have stopped arriving.
Why it matters more every year
Most small businesses have not finished the job: when we checked 256 UK small businesses in October 2026, 42% had no DMARC record and only 25% enforced one (the full research).
Since February 2024, Google and Yahoo have required anyone sending bulk email to their users to authenticate with SPF and DKIM and publish a DMARC policy. Microsoft introduced similar requirements for Outlook.com and Hotmail in 2025. Even if you are not a bulk sender, mail providers increasingly treat unauthenticated mail with suspicion, which is why quotes and invoices from small businesses without these records drift into junk folders.
The other reason is fraud. Without DMARC, a criminal can send a perfectly convincing email from your exact address to
your clients asking them to pay a new bank account. DMARC at p=reject shuts that door — though it cannot
stop lookalike domains, which is why staff training still matters.
How we handle it
Every MyExchangeServer customer has SPF, DKIM and DMARC set up as part of the migration, with DMARC reports monitored so we can tighten the policy safely. If you would like us to look at your current records first, run the checker and send us the results.