Five checks that stop spoofed email from your domain

Email was designed without sender checks. Any server can put your address in the From line. SPF, DKIM and DMARC were added later as DNS records that receiving servers check before they trust a message.

The big mailbox providers now insist on them. Since 1 February 2024, Google requires senders of more than 5,000 messages a day to Gmail accounts to use SPF, DKIM and DMARC, and Yahoo has similar rules. Microsoft has applied the same thresholds to Outlook.com since 5 May 2025. Even below those volumes, a domain without the three records is easier to spoof and more likely to land in spam.

These records work the same whether your mail runs on Zoho Workplace, Microsoft 365 or Google Workspace. Only the values change.

SPF is a TXT record that names the servers and services allowed to send mail as your domain: your mailbox provider, plus the ERP that emails invoices, the CRM, the marketing platform and the website form.

What done looks like:

• Exactly one SPF record per domain. Microsoft's documentation is direct: two SPF records for the same domain make SPF fail with a permanent error.
• No more than 10 DNS lookups. Every include: costs lookups. Go over 10 and SPF fails, so remove services you no longer use.
• Ends in -all. Microsoft recommends the hard fail -all when DKIM and DMARC are also in place.

DKIM adds a digital signature to each message, and receivers check it against a public key in your DNS. In Microsoft 365 that key is published as two CNAME records (selectors); Google Workspace gives you a TXT record to publish.

What done looks like:

• DKIM is on in your mailbox provider, not just available. It often has to be switched on after the DNS records are published.
• Every third-party sender signs with your domain, not its own. This is the step most often missed, and the one that breaks DMARC later.
• Strong keys. Google asks for at least 1,024 bits and recommends 2,048.

DMARC tells receivers what to do with mail that claims to be from you but fails SPF and DKIM alignment, and asks them to send you daily reports.

• p=none: deliver as normal and send reports. It meets the bulk-sender minimum, but it does not stop spoofing.
• p=quarantine: failing mail goes to spam or junk.
• p=reject: failing mail is refused. This is the goal.

A DMARC record is a single TXT record published at _dmarc on your domain, so for example.com the name is _dmarc.example.com. Publish one DMARC record per domain. It is a short list of tags separated by semicolons. Four tags cover most companies:

Then change the record in stages as the reports come in. Only the policy and pct change; the reporting address stays.

Move to the next stage only when the reports show every legitimate sender passing. If a stage blocks real mail, step back, fix that sender's SPF or DKIM, and try again.

• Monitor: v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com. Nothing is blocked; you learn who sends as you.
• Quarantine a sample: v=DMARC1; p=quarantine; pct=25; rua=mailto:dmarc-reports@example.com. A quarter of failing mail goes to spam, so a forgotten sender shows up without stopping all its mail.
• Quarantine everything: v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com. With pct left out, the policy applies to all failing mail.
• Reject: v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com. Spoofed mail is refused.

Attackers like domains that send no mail: an old brand name, a country domain you bought to protect your name, a test domain. With no records, nothing tells receivers that mail from them is fake.

For each unused domain, Microsoft's guidance is two records: SPF v=spf1 -all (no server may send) and DMARC v=DMARC1; p=reject. In Microsoft 365 that includes the .onmicrosoft.com domain if you do not send from it. It takes a few minutes per domain and closes an easy route for impersonation.

BIMI does not block anything on its own. It rewards a domain that already passes the first three checks by showing your logo next to your messages in Gmail and other supporting mailboxes.

To show the blue verified checkmark in Gmail you need DMARC at quarantine or reject, a logo registered as a trademark and a Verified Mark Certificate (VMC). A Common Mark Certificate shows the logo without the checkmark. Trademark registration can take months, so start it early. Our knowledge-base guide walks through getting the Gmail blue checkmark with BIMI.

Work through them in this order. BIMI comes last because it depends on DMARC being enforced.

SPF, DKIM and DMARC are part of every mailbox deployment we do, and our DMARC service takes existing domains from p=none to p=reject while watching the reports, so legitimate invoices and website mail keep arriving. If you are not sure where you stand, start with our free security assessment, which ends in a short report.