Before you start: find every sender
List everything that sends mail as the domain. Ask the customer, and check the last few months of mail they received from themselves. Usual suspects:
- The mailbox provider (Microsoft 365, Google Workspace).
- Marketing and newsletter tools, CRM and helpdesk systems.
- Accounting, invoicing and payroll systems.
- Website contact forms and online shops.
- Copiers and scanners that scan to email, and line-of-business apps on site.
Step 1: one SPF record
SPF lists the servers allowed to send for the domain. There must be exactly one record starting v=spf1; two records count as an error. Add each sender's include, and end with ~all or -all, for example:
v=spf1 include:spf.protection.outlook.com include:_spf.example-sender.com -all
SPF allows at most 10 DNS lookups in total, includes within includes counted. Senders you cannot fit can still pass DMARC through DKIM.
Step 2: turn on DKIM for each sender
DKIM signs each message with a key published in DNS. Turn it on in every sender's settings and publish the records they give you. Microsoft 365 uses two CNAME records (selector1 and selector2) and a switch in the Defender portal; Google Workspace generates a TXT record at google._domainkey.
DKIM matters more than SPF for DMARC, because it survives forwarding.
Step 3: publish DMARC at p=none
Start in monitoring mode, with an address for the daily aggregate reports:
v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com
Mail is delivered as before, but receivers such as Google, Yahoo and Microsoft send reports listing every server that sent as the domain and whether it passed. If the report address is on another domain, that domain must publish a record allowing it to receive them.
Step 4: read the reports and fix the gaps
Reports arrive as XML attachments, so use a DMARC report service or tool to read them. For each source:
- A known sender that fails: fix its SPF include or DKIM signing.
- A known sender that passes SPF or DKIM, but for a different domain: that is an alignment failure. DMARC needs the domain in the visible From address to match the one SPF or DKIM checked, so set up DKIM with the customer's own domain in that sender.
- An unknown source: usually spoofing or forwarding, which is what DMARC is for.
Wait until every legitimate sender passes. Include a month-end, so monthly invoices and statements show up in the reports.
Step 5: quarantine, then reject
Move to p=quarantine, which sends failing mail to junk. You can phase it in with pct=25 and raise it. Keep reading reports; when nothing legitimate fails, move to p=reject, which refuses spoofed mail outright. Add sp=reject so subdomains are covered too.
Domains that send no mail
Parked and unused domains are spoofed too. Protect them straight away with v=spf1 -all, a DMARC record with p=reject, and optionally a null MX record (0 .).
Check your work
The free email security checker reads a domain's MX, SPF, DKIM and DMARC records and explains what to fix. TechSavve RMM keeps checking customers' DNS and mail for you from one place.