DMARC, DKIM, and SPF: Email Authentication Explained

Email spoofing allows attackers to send emails that appear to come from your domain, enabling phishing attacks against your customers and partners. Three DNS-based records prevent this: SPF, DKIM, and DMARC. SPF (Sender Policy Framework): a DNS TXT record listing servers authorized to send email for your domain. Example: v=spf1 include:spf.protection.outlook.com -all. The -all means reject email from unlisted servers. DKIM (DomainKeys Identified Mail): cryptographically signs outgoing emails with a private key. The recipient verifies the signature using a public key published in DNS. This ensures the email wasn't modified in transit. Enable DKIM in the Microsoft 365 admin center under Email authentication settings. DMARC (Domain-based Message Authentication): tells receiving servers what to do with email that fails SPF and DKIM checks: monitor (p=none), quarantine (p=quarantine), or reject (p=reject). Start with p=none and monitor the DMARC reports before enforcing rejection. Use a DMARC reporting service (Dmarcian, EasyDMARC) to visualize reports. Achieving p=reject is the goal — it prevents domain spoofing.