Why SPF, DKIM and DMARC matter

SPF lists the servers allowed to send email for your domain. DKIM adds a cryptographic signature so recipients can tell a message was not altered. DMARC tells receiving servers what to do when those checks fail, and sends you reports.

Without them, criminals can send email that looks like it comes from you, and legitimate email is more likely to land in spam.

A sensible order

• Publish one SPF record that covers every service sending for you.
• Turn on DKIM signing in Microsoft 365.
• Start DMARC in monitoring mode, review reports, then tighten the policy.

Need help? See email and domain setup.