Knowledge base · email security
Check SPF, DKIM and DMARC: protect your email domain
A domain without properly configured email authentication is easier to abuse for spoofing and phishing. SPF, DKIM and DMARC work together but protect different parts of the mail flow. An incorrect record can also block legitimate mail.
Updated: 4 September 2026
What does SPF do?
Sender Policy Framework publishes which sending systems may use a domain in the envelope-from or MAIL FROM identity. The receiving server compares the source with that policy. SPF does not automatically authenticate the visible From address shown in a user's mail client.
A domain should publish one valid SPF record. Multiple records, forgotten sending services and excessive DNS lookups can cause a permanent error. First inventory every system that sends on behalf of the domain, including Microsoft 365, Google Workspace, web forms, CRM platforms and newsletter services.
What does DKIM do?
DomainKeys Identified Mail adds a cryptographic signature to outgoing messages. The receiving server retrieves the public key from a selector below _domainkey in DNS and checks whether signed parts changed in transit and which domain applied the signature.
DKIM does not prove that a message is safe or truthful. It provides domain-linked authentication and can satisfy DMARC when the signing domain aligns with the visible From domain. Manage selectors and keys through the relevant mail provider and rotate keys using its supported procedure.
What does DMARC add?
DMARC connects SPF and DKIM to the domain in the visible From address. A message passes when at least one mechanism passes with sufficient domain alignment. The domain owner also publishes how receivers should handle failures: monitor with p=none, quarantine them or reject them.
Aggregate reports show which sources send on behalf of the domain and why checks pass or fail. DMARC is therefore both an enforcement mechanism and a controlled way to map the real email flow.
A safe deployment order
Start with a complete inventory of legitimate senders. Correct SPF, enable DKIM for every sending service and then publish DMARC initially with p=none and a managed reporting address. Analyse reports, fix missing sources and verify alignment.
Only then move gradually to quarantine and ultimately reject once legitimate mail demonstrably passes. Publishing p=reject without an inventory can block invoices, contact forms, ticket systems or newsletters. Account for forwarding as well: forwarding may break SPF, while an intact DKIM signature can often continue to pass.
Common configuration mistakes
Frequent problems include two SPF records, obsolete include mechanisms, exceeding the SPF DNS lookup limit, missing DKIM on one sending platform and DMARC without a reporting process. A technical pass may still be insufficient when SPF or DKIM is not aligned with the visible From domain.
Do not validate changes only with a syntax checker. Send test messages through every legitimate route, inspect Authentication-Results headers and monitor DMARC reports. Internet.nl's free email test also provides an independent check of relevant standards for the mail domain.
How does JotaSec review email security?
The External Exposure Scan reviews publicly visible email DNS settings, including SPF, DKIM where selectors are known or supplied, and DMARC. It also considers MX configuration, alignment risks and clear errors that affect delivery or protection against abuse.
You receive evidence, impact and concrete remediation steps instead of a generic score without context. Production email changes are made only after coordination so legitimate sending routes are not unexpectedly interrupted.
Technical sources and test
Do you know whether your email domain is protected?
Have DNS, email authentication and other externally visible settings reviewed in a focused assessment.