Explore this guidance in context: Email security. Each topic includes an overview, related guides and a working template.

In this article

01Three controls with different jobs

SPF identifies servers authorised to send mail for the domain used in the message’s envelope. DKIM adds a signature that a receiving system can verify using a public key in DNS. DMARC relates those checks to the domain people see in the From address and publishes a policy for messages that fail.

DMARC needs a successful, aligned SPF result or a successful, aligned DKIM result. Alignment means the authenticated domain matches the visible From domain according to the policy’s relaxed or strict rules. Simply finding three DNS records does not prove that your real messages pass.

02Find every legitimate sender

Your normal mailbox provider may be only one source. Include invoices, booking systems, newsletters, customer support, website forms and outsourced campaigns. Ask each provider how to authenticate mail using your domain, then test a real message and inspect the receiving system’s authentication results.

DKIM records use selectors. A checker that does not know the correct selector cannot reliably establish that DKIM is absent. Obtain selectors from your provider or a signed message before investigating a missing-record observation.

03Move from visibility to enforcement

  1. Create a sender inventory with an owner for every service.
  2. Correct SPF and DKIM for legitimate senders before tightening DMARC.
  3. Use DMARC aggregate reporting to investigate unexpected or failing sources. A monitoring policy helps you observe mail; it does not ask receivers to quarantine or reject failures.
  4. Introduce enforcement only after reviewing the evidence and testing important mail flows. Keep a rollback plan and continue monitoring after the change.

04Know the remaining scope

Email authentication helps receiving services assess messages claiming your domain. It does not stop every lookalike domain, compromised mailbox or malicious attachment, and it does not by itself encrypt a message in transit. Protect accounts and review transport security separately.

Sources & further reading

NCSC: Email security and anti-spoofing (opens in a new tab)NCSC: Recommended implementation plan (opens in a new tab)NCSC: Create and manage a DKIM record (opens in a new tab)NCSC: Create and iterate an SPF record (opens in a new tab)

Use the linked primary sources for current technical details. Guidance reflects the scope and dates described in this article.

TURN READING INTO ACTION

Put the guidance to work.

Choose a check with the right scope, inspect its observations and follow up with the person who can make the change.

Choose a security check More practical resources