Email remains one of the most critical tools for any business. It is used to send quotes, invoices, orders, internal communications, legal documents and commercial messages. But it is also one of the most commonly attacked channels.
Many organisations invest in antivirus, firewalls, backups or multi-factor authentication, but they do not always check whether their email domain is properly protected. That is where a common problem appears: legitimate emails ending up in spam, messages being rejected by important recipients, or attackers attempting to spoof the company’s name.
SPF, DKIM and DMARC are three technical mechanisms that help protect the identity of an email domain. They do not replace an antispam solution or eliminate every risk, but they are an essential foundation for improving security, deliverability and trust in corporate communications.
In this article, we explain what they are, why they matter and which mistakes many companies make when configuring them.
Why corporate email needs authentication
Sending an email may seem simple, but behind the scenes there are servers, cloud providers, DNS records, marketing platforms, invoicing tools, CRMs and external services involved. Each of them may send messages on behalf of the business.
The problem appears when the servers receiving those emails cannot reliably verify whether the message truly comes from an authorised source. In that case, they may mark it as spam, reject it or accept it with a lower level of trust.
Business email authentication helps answer three key questions:
- Is this server authorised to send emails using this domain?
- Has the message been correctly signed and left unaltered?
- What should the recipient do if the email fails the checks?
These questions are important both to protect the business and to protect its customers, suppliers and employees from phishing or spoofing attempts.
What SPF is and which problem it solves
SPF stands for Sender Policy Framework. It is a DNS record that indicates which servers are authorised to send emails on behalf of a domain.
For example, if a company uses Microsoft 365, an email marketing platform and an invoicing tool that sends automated emails, all those services should be correctly included in the SPF record.
When a server receives an email, it can check the domain’s SPF record and verify whether the IP address sending the message is authorised. If it is not, the message may be considered suspicious.
Common SPF mistakes
SPF is relatively easy to understand, but incorrect configurations are very common. Sometimes new providers are added without removing old ones, records are duplicated, or configurations are too permissive.
The most common mistakes are:
- Having more than one SPF record published for the same domain.
- Forgetting external platforms that send legitimate emails.
- Keeping old providers that should no longer send email.
- Using overly open mechanisms that reduce real protection.
- Exceeding the DNS lookup limit allowed by SPF.
A poorly configured SPF record can cause two opposite problems: blocking legitimate emails or allowing too many systems to send messages on behalf of the domain.
What DKIM is and why it improves message trust
DKIM stands for DomainKeys Identified Mail. Unlike SPF, which validates whether a server is authorised, DKIM adds a cryptographic signature to the message.
This signature makes it possible to check that the email has not been altered since it left the authorised server. It also helps the receiving server associate the message with the domain that signs it.
In practice, DKIM adds an extra layer of trust. If a message passes DKIM, the receiving server has more signals to consider the email legitimate.
Why DKIM is often left pending
Many businesses assume that having Microsoft 365, Google Workspace or another email provider means everything is already solved. However, in some cases DKIM needs to be activated, validated or reviewed manually.
External services may also require their own DKIM records. This applies to email marketing platforms, ERPs, CRMs, ticketing tools, invoicing systems or SaaS applications that send automated emails.
If DKIM is not properly configured, messages may still be sent, but with a weaker reputation and a higher risk of ending up in spam.
What DMARC is and why it is the piece many businesses forget
DMARC stands for Domain-based Message Authentication, Reporting and Conformance. It is the mechanism that connects SPF and DKIM with a clear policy for the domain.
With DMARC, the business can indicate what the receiving server should do if an email fails the checks: do nothing special, place it in quarantine or reject it.
DMARC also allows the organisation to receive reports about who is sending emails on behalf of the domain. This is especially useful for discovering forgotten services, incorrect configurations or possible spoofing attempts.
DMARC.org defines it as an authentication, policy and reporting protocol based on SPF and DKIM to improve domain protection against fraudulent emails. You can read the official explanation at DMARC.org.
The problem with leaving DMARC in “none” mode forever
Many businesses publish a DMARC record with the p=none policy. This allows them to collect information without affecting email delivery, which is appropriate during an initial phase.
The problem appears when that configuration is left unchanged indefinitely. In “none” mode, DMARC observes, but it does not block or quarantine messages that fail.
The recommended approach is to move forward in a controlled way:
- Start with a monitoring policy.
- Analyse the reports and identify legitimate senders.
- Correct SPF, DKIM and external provider configurations.
- Gradually move towards stricter policies.
This process must be handled carefully to avoid interrupting legitimate business communications.
Why SPF, DKIM and DMARC matter more than ever
Major email providers have tightened their requirements to reduce spam, phishing and spoofing. This especially affects companies that send campaigns, recurring communications or high volumes of email.
Google states in its sender guidelines that all senders must configure SPF or DKIM, and that bulk senders must use SPF, DKIM and DMARC. It also notes that authenticated messages help protect against spoofing and phishing, and are less likely to be rejected or marked as spam. You can read the official guide at Google Workspace Admin Help.
Yahoo also includes email authentication among its requirements and best practices for senders, together with other aspects such as keeping spam complaint rates low.
This means that domain authentication is no longer just a technical recommendation. It is becoming a practical condition for corporate email to work properly.
What risks does a business face if it does not review this?
Incorrectly configuring SPF, DKIM and DMARC does not always cause an immediate visible failure. Email may continue to work, but with accumulated risks affecting security and domain reputation.
The main risks are:
- Legitimate emails ending up in the spam folder.
- Messages being rejected by customers, suppliers or external platforms.
- A higher risk of domain spoofing attempts.
- Phishing campaigns using an apparently corporate identity.
- Loss of trust in commercial or administrative communications.
- Difficulty knowing which services are sending emails on behalf of the business.
In companies with several providers, departments or SaaS tools, this problem becomes more common. Marketing may use one platform, administration another, support another and management a different one. If no one centralises the review, the domain ends up accumulating scattered configurations.
Common examples in businesses
Email authentication does not only affect the main mailbox. It also plays a role in many communications that often go unnoticed until something fails.
Some common examples are:
- An invoicing tool that sends invoices from the corporate domain.
- A CRM that sends commercial emails on behalf of users.
- A newsletter platform that uses the company domain.
- A ticketing system that automatically replies to customers.
- A web application that sends alerts, forms or confirmations.
- An external provider that sends communications using a corporate address.
All these systems must be identified and properly configured. Otherwise, they can cause deliverability problems or open the door to abuse.
How to review SPF, DKIM and DMARC without breaking email
The review must be carried out in an organised way. Changing DNS records without analysing the environment can cause certain emails to stop being delivered.
A proper review should include these steps:
- Identify all domains and subdomains used by the business.
- List every provider that sends email on behalf of those domains.
- Review existing SPF records and remove obsolete entries.
- Enable or validate DKIM in the main email provider.
- Check DKIM in external platforms that send messages.
- Publish DMARC in monitoring mode if it does not already exist.
- Analyse reports before applying stricter policies.
- Document the configuration and assign responsibilities.
This approach reduces the risk of interruptions and allows the business to move towards a more secure email policy.
Relationship with cybersecurity and IT maintenance
SPF, DKIM and DMARC are part of a wider security strategy. They do not replace a firewall, an antispam solution or user awareness training, but they strengthen a critical layer: the identity of corporate email.
That is why they should be integrated into a broader security and systems review. At Inmove IT, we can help review domain configuration, email providers and the measures needed to reduce spoofing risks.
This type of review fits especially well with services such as antivirus, antispam and cybersecurity for businesses, IT audits to review system security and IT maintenance for businesses.
Signs that your business should review email authentication
There is no need to wait for an incident. There are clear signs that indicate it is time to review the corporate email configuration.
- Customers or suppliers say your emails are arriving in spam.
- Several external platforms are used to send messages.
- The domain’s DNS records have not been reviewed for years.
- Email has recently been migrated to Microsoft 365, Google Workspace or another provider.
- Newsletters, invoices or automated communications are sent.
- Spoofing warnings or suspicious emails using company names have been received.
- There is no clear documentation about who can send email using the corporate domain.
If one or more of these points apply, it is advisable to review SPF, DKIM and DMARC before the issue affects customers, suppliers or internal processes.
A correct configuration also improves the company’s image
Email security is not only a technical matter. It also affects the trust that the organisation conveys.
When emails arrive correctly, no strange warnings appear and recipients can trust the sender, business communication works better. This is important in sales processes, customer service, administration, recruitment and communication with suppliers.
On the other hand, if messages end up in spam or someone manages to spoof the company’s identity, the impact can be reputational, financial and operational.
That is why SPF, DKIM and DMARC should be part of any serious review of corporate email and cybersecurity.
Protecting the domain also means protecting the business
Email remains a critical entry point for attacks, errors and reputation problems. SPF, DKIM and DMARC help protect the corporate domain, improve deliverability and reduce the risk of spoofing.
It is not just about publishing three DNS records. The key is to understand which services send email, validate that they are all properly authenticated and apply a progressive policy that does not interrupt business activity.
If your business has not recently reviewed its email authentication, this is a good time to do so. Especially if you use several providers, send automated communications or have detected spam issues, message rejections or suspected spoofing.
At Inmove IT, we help businesses review, protect and maintain their email systems as part of a global cybersecurity and IT support strategy. You can learn more about our perimeter security solutions to protect business networks or contact our team to assess the best way to strengthen your environment.
Frequently asked questions about SPF, DKIM and DMARC
These are some common questions that arise when a business starts reviewing the security and deliverability of its corporate email.
Do SPF, DKIM and DMARC prevent all fraudulent emails?
No. They help protect the domain against spoofing and improve email authentication, but they do not replace an antispam solution, user training or other cybersecurity measures.
Can a poor configuration stop my emails from arriving?
Yes. An incorrect configuration can cause rejections, emails landing in spam or failures in external services that send messages on behalf of the company. That is why the configuration should be reviewed before applying strict policies.
Is having SPF configured enough?
Not ideally. SPF is important, but DKIM and DMARC add extra layers of validation, signing and policy. The combination of all three provides much more complete protection.
What does it mean to have DMARC in “none” mode?
It means the domain is collecting information, but it is not instructing the recipient to block or quarantine messages that fail. It is useful as a starting point, but it should not remain the final permanent state.
How often should email configuration be reviewed?
It should be reviewed whenever a provider that sends emails is added or removed, when corporate email is migrated or as part of a regular IT security review.
Does this only affect companies that send newsletters?
No. It affects any company that uses corporate email. Newsletters increase the need for proper configuration, but invoices, automated alerts, CRMs, support tickets and internal communications are also involved.
