What is SPF, DKIM, and DMARC? Three DNS records that prove your email is really from you, not someone pretending to be you. Of the 847 businesses that email from their own domain in my check of 1,527 Southwest Michigan businesses, 79.2 percent have no DMARC enforcement at all. If your Battle Creek or Kalamazoo business has never touched these settings, this guide explains what each record does and walks through setup in six steps.
What is SPF and what does it do?
SPF is your domain's approved sender list.
Think of it like a staff directory a mail server checks before it lets a delivery in. Your SPF record lives in your DNS. It lists every service allowed to send email as your domain: your email provider, your CRM, your invoicing tool, your contact form. When a message arrives claiming to be from you, the receiving server looks up that list. If the sending server isn't on it, SPF fails, and a strict server can refuse the message outright. Microsoft 365 reports that refusal as a 550 5.7.23 bounce.
SPF is fast to set up and it catches a lot of obvious spoofing. But it has a real weak spot. It breaks when an email gets forwarded, because the forwarding server isn't on your list either. That's exactly what DKIM is for.
What is DKIM and how does it sign your email?
DKIM is a digital seal attached to every message you send.
Each outbound email gets signed with a private key only your mail server holds. The receiving server checks that signature against a public key sitting in your DNS. If the message was changed in transit, even by one character, the signature breaks and the check fails. If it matches, the receiving server knows the email is untouched and really came from your systems.
Unlike SPF, DKIM survives forwarding. The signature travels with the message, not with the server that delivered it. That's why a real setup needs both.
What is DMARC and how does it use SPF and DKIM together?
DMARC is the rule that tells receiving servers what to do when SPF or DKIM fails.
Without DMARC, every mail server makes its own call on a failed message. Some quarantine it. Some deliver it anyway. Some reject it. DMARC removes the guesswork with a policy you set yourself, and it comes in three levels. "None" means monitor and report, but deliver anyway. "Quarantine" sends failures to spam. "Reject" blocks them outright. DMARC also sends you reports, so you can see every server that's been sending mail as your domain.
Why do you need all three, not just one?
Because each one closes a different gap, and a spoofer only needs the one you left open.
SPF alone still lets someone spoof your "From" address through a server your SPF record allows for something else. DKIM alone proves a message wasn't changed, but it doesn't tell anyone what to do when a message shows up with no valid signature. DMARC alone has nothing to enforce. It needs SPF and DKIM results to work with. Run all three together and each one backs up the others.
What happens to Michigan businesses without DMARC?
The gap is bigger than most owners assume, and it's not hypothetical.
That 79.2 percent of 847 businesses that email from their own domain (1,527 checked) means about 79 of every 100 of them have no policy telling Gmail or Outlook to block a message that fails. Some have no DMARC record at all. Others publish p=none, which monitors but blocks nothing. The full breakdown by county and provider is in the Southwest Michigan Email Security Report linked above.
The state is paying attention too. The Michigan State Police Cyber Command Center tells businesses to implement SPF, DKIM, and DMARC, and to make sure those policies are configured and enforced. Business email compromise cost just over 3 billion dollars nationally in 2025, the second-costliest crime type by losses, according to the FBI's 2025 Internet Crime Report. An unenforced domain is an open door. Someone could send a fake invoice under your business name today and you'd have no way to stop it.
How do you set up DMARC for a small business, step by step?
Six steps, in this order: check what you have, fix SPF, turn on DKIM, publish DMARC at p=none, read the reports, then tighten. Most single-provider setups take under an hour of hands-on work. The careful part is the waiting.
- Check what you have. The free email security check reads your public SPF and DMARC records in a few seconds. Start there so you know what you're fixing.
- Fix SPF. Your domain gets one SPF record, and only one. It lists every service that sends as you. Your email provider publishes the exact value to add. Add your CRM, invoicing tool, and contact form if they send as your domain.
- Turn on DKIM. You switch on signing in your email provider's admin console, then publish the DNS record it gives you. If you're on Microsoft 365, it lives in the Defender portal, and my Microsoft 365 DMARC setup guide walks through it screen by screen.
- Add the DMARC record. It's one TXT record named
_dmarc, added wherever your DNS lives. That's usually GoDaddy, your registrar, or your web host, not your email provider. Start withp=noneand anrua=address for reports. Google's DMARC setup guide recommends starting at none and letting SPF and DKIM run for 48 hours first. - Read the reports. Pick one mailbox for them, not your personal inbox. Each report lists who sent mail as your domain and whether it passed. Give it a few weeks so the monthly senders show up too, like your invoicing tool.
- Tighten. Once every real sender passes, move to
p=quarantine. Watch the reports again. Then move top=reject.
Order matters. A DMARC record in front of a broken SPF record just sends your own mail to spam.
If you'd rather not touch DNS at all, my DMARC audit service checks your current setup, tells you exactly what's missing, and makes the changes in the right order. The monitoring behind it is MailGuard Monitor.
How long does it take, and is DMARC actually required?
The hands-on setup is under an hour for most single-provider offices. Getting to full enforcement safely takes a few weeks of reading reports.
As for required, it depends on volume. Since February 1, 2024, Google's sender guidelines ask every sender to Gmail for SPF or DKIM. Once a domain sends more than 5,000 messages a day to Gmail addresses, Google also wants SPF and DKIM both, plus DMARC. A p=none policy is enough to meet that. Microsoft applies its own 5,000-a-day rule to its personal Outlook.com, Hotmail, and Live addresses, and bounces failures with a 550 5.7.515 error. No law requires DMARC.
A typical Battle Creek office sends nowhere near 5,000 messages a day. So the big providers' rules aren't really the reason to publish DMARC. The reason is that without enforcement, anyone can send mail that looks like yours, and your customers can't tell the difference.
If you run a business in Battle Creek, Kalamazoo, or anywhere in Southwest Michigan and want someone else to handle the DNS changes, call me at (269) 460-1772 and I'll start with the free domain check.
Frequently asked questions
How long should a small business stay at p=none before enforcing DMARC?
Stay at p=none until every service that sends as your domain shows up passing in the reports. That usually takes a few weeks. Then move to quarantine, watch the reports again, and move to reject. Google's own advice is to start at none and tighten over time.
Does Google Workspace set up DMARC for you?
No. Google says you don't do anything in the Admin console for DMARC. You add one TXT record named _dmarc at your domain host, and Google asks you to let SPF and DKIM run for 48 hours first.
Do you need a paid service to read DMARC reports?
No. The reports are free and arrive as XML files in the mailbox you name in your record. Reading them by hand gets tedious once several services send for you, which is when a monitoring tool or service starts to earn its keep.
Do parked or unused domains need DMARC?
Yes. A domain that never sends email can go straight to p=reject, with an SPF record that allows no senders, because nothing real should ever send as it. That stops anyone from using a spare domain to send mail in your name.