Guide
SPF, DKIM and DMARC: protecting an SME's email
SPF, DKIM and DMARC stop people sending fake emails in your name and help your genuine messages get through. Google, Yahoo and Microsoft already require them from bulk senders. Here is what they do, in plain terms, and how to set them up without blocking your own invoices.
Updated on 18 October 2026 · Figures are sourced at the bottom of the page; opinions are those of IT CyberWall.
Why it is your business
Anyone can send an email that appears to come from your domain: a fake invoice to your clients, a fake transfer order to your accountant. Three settings, published in the DNS of your domain name, allow your recipients’ email systems to recognise your genuine messages. They protect your email and your reputation, not your data: they are not a backup.
SPF, DKIM and DMARC in plain terms
| Setting | What it says | Analogy |
|---|---|---|
| SPF | The list of servers authorised to send messages on behalf of your domain[1]. | The list of authorised postmen. |
| DKIM | A digital signature added to each message, which links the message to your domain[2]. | The company stamp on the envelope. |
| DMARC | Your instruction to recipients when a message fails the checks (do nothing, send to spam, reject), plus the sending of reports[3]. | The instruction left at reception. |
ANSSI devotes part of its recommendations on connecting an information system to the internet to these three mechanisms[4].
What Google, Yahoo and Microsoft require
- Google, since 1 February 2024: SPF or DKIM for all senders; SPF, DKIM and DMARC for those sending more than 5,000 messages a day to Gmail[5].
- Yahoo: SPF or DKIM for everyone; SPF, DKIM and DMARC for bulk sending[6].
- Microsoft Outlook.com, since 5 May 2025: SPF, DKIM and DMARC for domains sending more than 5,000 messages a day; otherwise, messages go to spam and are then rejected[7].
Even an SME that sends few messages should publish all three: its invoices and quotes are delivered more reliably, and its name is harder to spoof.
Setting it up, step by step
- List everything that sends messages in your name: email, invoicing software, CRM, website, emailing tool, printer that sends scans.
- Publish an SPF record listing these senders, without leaving any out.
- Enable DKIM for every service that supports it.
- Publish a DMARC record in monitoring mode (« none » policy) and receive the reports.
- Read the reports for a few weeks: they reveal forgotten senders and spoofing attempts.
- Tighten gradually: send to spam (« quarantine »), then reject (« reject »), which Microsoft recommends[7].
What IT CyberWall does
We list all your email senders, publish and test the SPF, DKIM and DMARC records, read the reports with you and tighten the policy when it is safe to do so. It is a short job that fits into our cybersecurity services.
Your emails landing in spam, or your name being spoofed?
We check your records and set up SPF, DKIM and DMARC.
Sources
Sources consulted on 18 October 2026. Supplier prices are shown excluding tax, in the currency and region of the published price list, and may change: always check the official page before deciding.
- IETF – RFC 7208, Sender Policy Framework (SPF), April 2014 — www.rfc-editor.org/rfc/rfc7208
- IETF – RFC 6376, DomainKeys Identified Mail (DKIM) Signatures, September 2011 — www.rfc-editor.org/rfc/rfc6376
- IETF – RFC 9989, DMARC (May 2026, replaces RFC 7489) — www.rfc-editor.org/rfc/rfc9989
- ANSSI – Recommandations relatives à l’interconnexion d’un système d’information à internet, v3.0 (19 June 2020), § 5.4 — messervices.cyber.gouv.fr/guides/recommandations-relatives-linterconnexion-dun-si-internet
- Google – Consignes pour les expéditeurs de messages — support.google.com/a/answer/81126?hl=fr
- Yahoo – Sender Best Practices — senders.yahooinc.com/best-practices/
- Microsoft – Outlook.com Policies, Practices, and Guidelines — substrate.office.com/ip-domain-management-snds/Postmaster/Policies