SPF, DKIM and DMARC — protect your email against fraud
Have you ever received an email that looked as if it came from your own company — but didn't? That is called email spoofing, and it is one of the most widespread attacks against Danish businesses. SPF, DKIM and DMARC are three standards that together prevent others from sending email on your behalf.
SPF — who may send email from your domain?
SPF (Sender Policy Framework) is a DNS record that tells the recipient's mail server which servers are allowed to send email from your domain. When you create an SPF record, you are effectively saying: "Only these servers send email on behalf of our-domain.dk — reject everything else." An SPF record typically looks like this: `v=spf1 include:spf.protection.outlook.com -all` — this allows only Microsoft's mail servers to send from your domain.
DKIM — a digital signature on your emails
DKIM (DomainKeys Identified Mail) adds an invisible digital signature to every email you send. The recipient's server can verify that the email really came from you and that the content has not been altered along the way. It requires two things: a private key on your mail server (which we set up for you) and a public key in your DNS (a TXT record).
DMARC — the rules for what happens to suspicious email
DMARC (Domain-based Message Authentication, Reporting & Conformance) builds on top of SPF and DKIM. It is your policy for what should happen when an email fails the SPF or DKIM check. You can choose: "none" (just report), "quarantine" (send to spam) or "reject" (reject completely). We recommend starting with "none" to review the reports, and then switching to "reject" once you are certain that all your legitimate senders are covered.
Why does it matter for your business?
Without SPF, DKIM and DMARC, anyone can send emails that appear to come from your domain. This is used for phishing attacks against your customers, suppliers and employees. Beyond the security aspect, major mail providers such as Google and Microsoft now require senders to have SPF and DKIM set up correctly — otherwise your emails risk ending up in spam.
What should you do?
Contact us and we will set it all up for you. It requires access to your DNS settings (typically 3 TXT records) and usually takes less than an hour to implement. Once it is in place, you receive ongoing DMARC reports showing whether anyone is trying to abuse your domain.
Already have SPF set up, but not DKIM and DMARC? Then you only have half the protection. Contact us for a free email security check — we review your setup in 15 minutes.
We review our guides at least every six months to make sure the content is up to date. If you spot anything outdated or missing, please write to us — we would love to hear from you.
Frequently asked questions
What are SPF, DKIM and DMARC?
Why do our emails end up in spam?
Do you need all three?
What do p=none, p=quarantine and p=reject mean in DMARC?
More about security
What is IT equipment as a service?
Want to optimise your company's IT budget? Learn the benefits of IT equipment as a service and how hardware leasing can simplify your day-to-day IT operations.
Microsoft 365 backup: protect your business data
Missing a backup of your Microsoft 365 data? Read our guide to where Microsoft's own responsibility ends, and how to secure your business-critical data.
Help with Microsoft 365 for your business
Does your business need help with Microsoft 365? Get a practical guide to setting up, troubleshooting and optimising your M365 environment here.