Quick answer
SPF, DKIM and DMARC are three settings on your domain that tell other email systems which emails really come from you. SPF lists who may send for your domain, DKIM adds a digital signature, and DMARC tells receivers what to do with emails that fail. Together they make it much harder for criminals to send fake emails in your business's name.
Why should a trades business care about email spoofing?
Trades businesses send invoices and take deposits by bank transfer. That makes them a target for payment diversion fraud: a criminal sends your customer an email that looks like yours, saying your bank details have changed. The customer pays the criminal instead of you.
Spoofing means sending an email that pretends to come from your domain. The UK's National Cyber Security Centre (NCSC) recommends SPF, DKIM and DMARC to make spoofing your domain difficult. Without them, a criminal can often put your email address in the "From" line and many receiving systems have no reliable way to tell it's fake.
What is SPF?
SPF (Sender Policy Framework) is a short text record on your domain that lists the services allowed to send email for you, for example Microsoft 365, Google Workspace or your invoicing software. When an email arrives claiming to be from you, the receiving system can check whether it came from one of those services.
What is DKIM?
DKIM (DomainKeys Identified Mail) adds a hidden digital signature to every email you send. The receiving system checks the signature against a key published on your domain. If the email was faked or changed on the way, the check fails. The NCSC describes DKIM as a stronger check than SPF, and it still works when an email passes through a relay on the way.
What is DMARC?
DMARC ties SPF and DKIM together. It is a record that tells receiving systems what to do with emails that fail the checks: do nothing yet (p=none), treat them as spam (p=quarantine) or reject them (p=reject). It also sends you reports showing who is sending email using your domain.
DMARC only starts stopping fake emails once it is set to quarantine or reject. A policy of "none" is a safe first step for monitoring, but on its own it doesn't stop spoofed emails.
How do you set them up, step by step?
This follows the order in the NCSC's guidance. Most of it is done in the DNS settings where your domain is registered.
- List every service that sends email using your domain: your mailbox provider, invoicing or accounting software, website contact form, booking system.
- Add a DMARC record with a policy of none and an address for reports. This blocks nothing; it shows you who is sending email using your domain.
- Create one SPF record that includes all your legitimate senders. You can only have one SPF record per domain.
- Turn on DKIM in each of those services. Most give you a record to copy into your DNS.
- Read the reports for a few weeks. Fix any genuine service that is failing.
- Move the DMARC policy to quarantine, then to reject once you are confident your real emails pass.
- Check again whenever you add a new service that sends email for you.
What about domains you don't send email from?
If you own extra domains (an old business name, a .com you never use), criminals can spoof those too. For domains that never send email, you can publish records that say so: an SPF record that allows no senders and a DMARC policy of reject.
Does it affect whether my emails arrive?
Yes, usually for the better. Gmail requires anyone sending to personal Gmail accounts to set up SPF or DKIM, and bulk senders (more than 5,000 messages a day to Gmail) must have SPF, DKIM and DMARC. Even for small senders, properly authenticated email is less likely to land in spam.
Be careful with the order, though. Jumping straight to p=reject before every genuine service is set up can block your own invoices. That's why the monitoring step matters.
What else protects you from invoice fraud?
- Tell customers on your invoices and quotes that you will never change bank details by email.
- Ask customers to confirm bank details by phone on a number they already have.
- Watch for look-alike domains. SPF, DKIM and DMARC protect your exact domain, not a similar one such as yourroofing-ltd.co.uk instead of yourroofingltd.co.uk. Ask customers to check the sender's address carefully and to call you before paying new bank details.
- Turn on two-step verification (2FA) on your email account. Many spoofing attacks start with a hacked mailbox, which SPF, DKIM and DMARC don't prevent.
- If you think fraud has happened, contact your bank straight away and report it. In England, Wales and Northern Ireland, Report Fraud (which replaced Action Fraud) takes reports online or on 0300 123 2040. In Scotland, call Police Scotland on 101.
How do you check your domain today?
You can check your domain's SPF, DMARC and a few other public settings with our free security check. It only uses public information and doesn't scan or test your systems. If something needs fixing, our email and domain protection service can set it up and monitor the reports for you.