SPF and DMARC for a small business, explained simply
SPF is a DNS record listing the servers allowed to send email for your domain. DMARC is a DNS record that tells inboxes what to do with email that fails those checks, and sends you reports. Together with DKIM they stop scammers from sending invoices or 'change of bank details' emails that appear to come from you, and they help your real emails avoid spam folders.
Why a small business should care
Without them, anyone can send an email that shows your address in the From line. Fake invoices to your customers, fake payment-detail changes to your suppliers: these start with a domain that has no SPF or DMARC. And since February 2024, Google and Yahoo require SPF, DKIM and DMARC from anyone sending in bulk to their users. Smaller senders without them see more mail filtered too.
SPF
A TXT record on your domain listing who can send for you. If you use Google Workspace:
v=spf1 include:_spf.google.com ~allMicrosoft 365 uses include:spf.protection.outlook.com. If you also send through a newsletter tool or booking system, add its include too. Only one SPF record per domain: combine them into one line.
DKIM
A digital signature your email provider adds. Turn it on in your provider's admin console (Google Workspace: Apps › Gmail › Authenticate email) and add the DNS record it gives you.
DMARC
A TXT record at _dmarc.yourdomain.com. Start in monitoring mode:
v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.comWatch the reports for a few weeks to make sure every service that sends as you passes. Then tighten to p=quarantine, and later p=reject, which tells inboxes to refuse forged mail outright.
How to check yours
Your domain registrar or DNS host shows your TXT records. Free lookup tools will read them for you. The free Check-Up checks your domain's SPF and DMARC records as part of the website section.
Check this on your own business
The free 60-second Check-Up reads your website and Google profile and shows where you stand on this: Email spoofing protection. Public data only, no login, no card.
Run the free Check-Up →Or we run it for you
We check and monitor SPF and DMARC on your domain as part of every plan, alongside SSL and uptime. Month to month, a new website included, plans from $199 a month.
See how it works →Questions
Do I need DMARC if I only send a few emails a day?
Yes. DMARC mainly protects your customers from forged emails in your name, whatever your volume.
Will DMARC break my email?
Not in monitoring mode (p=none). Tighten the policy only after reports show all your real senders pass.
Where do I add these records?
In the DNS settings where your domain is managed: your registrar, your host, or a DNS service like Cloudflare.