DMARC (with SPF and DKIM)

What it is

Email was not designed to check who sent a message, so anyone can put your domain in the “From” line. Three DNS records fix that:

• SPF (Sender Policy Framework) lets you publish which mail servers and services are allowed to send email for your domain.
• DKIM (DomainKeys Identified Mail) lets you sign the email you send, so a receiving server can check it really came from you and wasn’t altered. The NCSC notes it also survives forwarding better than SPF.
• DMARC (Domain-based Message Authentication, Reporting and Conformance) sets a policy for email that fails those checks, and asks receiving servers to send you reports.

A message passes DMARC if SPF or DKIM passes and the domain it checked matches the domain in the From address. DMARC has three policy settings:

• p=none: take no special action, just report. Used for monitoring.
• p=quarantine: accept the message but treat it as suspicious, usually sending it to junk.
• p=reject: reject the message.

Why it matters for a UK small business

Microsoft notes that DMARC helps prevent the spoofed senders used in business email compromise, ransomware and phishing. Without it, a criminal can send a fake invoice to your clients that appears to come from your own domain. The reports also show every service sending mail in your name, which often turns up forgotten ones.

How it works in Microsoft 365

For each custom domain you send from, set up SPF, turn on DKIM signing in the Microsoft Defender portal, then add a DMARC TXT record at your DNS provider. Microsoft recommends a gradual rollout: start at p=none and read the aggregate reports, move to p=quarantine, then to p=reject once all your legitimate email passes, starting with low-volume domains and leaving the main one until last. Domains you own but never send email from should get a p=reject record straight away, as should your .onmicrosoft.com domain if you don’t use it for email.

How &DEV helps: the Microsoft 365 MOT sets up SPF, DKIM and DMARC for your domains and takes DMARC to enforcement without blocking your own email.