SPF, DKIM and DMARC: how to stop email spoofing of your company
A practical SPF, DKIM and DMARC guide for small businesses: what each does, Gmail and Outlook sender rules, and how to keep scammers from spoofing your domain.
A tampered invoice "from your supplier", an urgent wire request "from the CEO", a bill "from your company" reaching customers with a different bank account. Business email compromise caused about $3.05 billion in reported losses to the FBI's IC3 in 2025, the second-largest category. Some of these schemes spoof real domains, and three free DNS records make that much harder: SPF, DKIM and DMARC.
What do SPF, DKIM and DMARC do?
| Record | What it does |
|---|---|
| SPF | Lists the IP addresses trusted to send mail for your domain |
| DKIM | Cryptographically signs outgoing mail to prove it came from your domain |
| DMARC | Tells receivers what to do with mail that fails SPF or DKIM, and sends you reports |
Do Gmail and Outlook require DMARC?
For bulk senders, yes. Since February 1, 2024, Google requires all senders to Gmail to use SPF or DKIM; those sending more than 5,000 messages a day need both, plus a DMARC record (policy may be none), From: domain alignment, one-click unsubscribe for marketing mail and a spam rate below 0.3%. Since May 5, 2025, Microsoft requires SPF, DKIM and DMARC from domains sending more than 5,000 messages a day to Outlook.com, Hotmail and Live, initially routing non-compliant mail to Junk with rejection to follow.
How do you set it up?
- List every service that sends mail as your domain: mailbox provider, invoicing, newsletter, CRM, website.
- Publish one SPF record covering them all.
- Enable DKIM in each sending service.
- Publish DMARC with p=none and a reporting address.
- Read reports for a few weeks and fix legitimate senders that fail.
- Move to quarantine and then reject, as the UK NCSC recommends.
- Protect every domain you own, including ones that never send mail.
What about domains that never send email?
Parked and brand-protection domains can be spoofed too. Brazil's registry operator NIC.br, according to Tecnoblog, gave the gov.br domain a null MX record and a null SPF record, which together signal that no one may send mail as @gov.br. The same logic works for any domain you own but do not use for email: an SPF record that authorizes no server and a DMARC policy set to reject. It costs nothing and closes an easy door for scammers.
Does DMARC stop all email fraud?
No. It blocks exact-domain spoofing, not look-alike domains or hijacked real mailboxes. Keep verifying any change in supplier bank details by calling a number you already have, require dual approval for payments and turn on MFA for every mailbox. Learn how BEC and real estate wire fraud work and what the FBI IC3 2025 report shows.
What to do now
- Ask whoever manages your DNS for a status check of SPF, DKIM and DMARC.
- Train finance and customer service to treat urgency plus new bank details as a red flag.
- If you were defrauded, call your bank at once and report to ic3.gov.
来源
- Google – Diretrizes para remetentes de e-mail
- Petri – Microsoft Outlook exige SPF, DKIM e DMARC de grandes remetentes
- NCSC – Email security and anti-spoofing
- HIPAA Journal – Relatório FBI IC3 2025
- Tecnoblog – As configurações feitas em @gov.br para barrar e-mails falsos