SPF, DKIM and DMARC for business email

Three checks, different purposes

SPF checks whether a source may send for the envelope domain. DKIM verifies the signature attached by a sending system. DMARC requires a passing SPF or DKIM result aligned with the visible From domain. A passing result for an unrelated provider domain does not establish DMARC alignment.

Inventory senders before editing DNS

List employee email, CRM, website forms, billing systems and newsletters. Record the owner and From domain of each source. Keep one SPF policy per DNS name and examine nested lookup mechanisms. Obtain DKIM selectors and keys from each provider rather than inventing them.

Google SPF setup describes the provider configuration.

Verify a real message from every source

Inspect published DNS, then send a message from each legitimate source to an external account. Compare Authentication-Results, the DKIM signing domain and the visible From address. Test any forwarding or mailing-list workflow actually used by the business. A DNS record alone does not establish successful signing or inbox placement.

Move from reporting to enforcement

A none policy monitors; it does not request rejection. Check reports across the normal business cycle, including infrequent billing messages, before moving to quarantine or reject. Save the previous policy and define the evidence that would trigger a rollback.

Google DMARC setup provides reporting guidance. Request an email security assessment for the complete sender inventory.