Email security through SPF, DKIM, and DMARC authentication is the foundation of protecting your domain from spoofing, phishing attacks, and email fraud. These three protocols work together to verify that emails claiming to come from your domain are genuinely authorized, protecting both your brand reputation and your recipients.
What Are SPF, DKIM, and DMARC and Why Do You Need All Three?
Each protocol addresses a different aspect of email authentication:
- SPF (Sender Policy Framework): A DNS TXT record that lists which mail servers are authorized to send email on behalf of your domain. When a receiving server gets an email from your domain, it checks your SPF record to verify the sending server is authorized.
- DKIM (DomainKeys Identified Mail): Adds a cryptographic digital signature to each outgoing email. The receiving server uses a public key published in your DNS to verify the signature, confirming the email was not altered in transit.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance): Ties SPF and DKIM together and tells receiving servers what to do when authentication fails — accept, quarantine, or reject the email. DMARC also sends you reports about authentication results.
Using only one or two of these protocols leaves gaps. SPF alone does not prevent message tampering. DKIM alone does not prevent unauthorized servers from sending. DMARC without SPF and DKIM has nothing to enforce.
How Do You Configure SPF Records Correctly?
An SPF record is a DNS TXT record on your domain. Here is a structured approach:
- Inventory all sending sources: List every service that sends email from your domain — your mail server, transactional email providers (Amazon SES, SendGrid, Mailgun), marketing platforms (Mailchimp, Sendinblue), CRM systems, ticketing systems, and any SMTP relay.
- Build the record: Combine all authorized senders into one SPF record. Example: v=spf1 include:_spf.google.com include:amazonses.com include:sendgrid.net -all
- Use -all (hard fail): This tells receiving servers to reject emails from unauthorized sources. Start with ~all (soft fail) during testing, then switch to -all once confirmed.
- Stay under the 10-lookup limit: SPF allows a maximum of 10 DNS lookups. Each “include” statement counts as one or more lookups. If you exceed this limit, SPF breaks silently. Use SPF flattening tools if needed.
How Do You Set Up DKIM Signing?
DKIM setup involves generating a key pair and publishing the public key in DNS:
- Your email provider generates a DKIM key pair (most hosted providers like Google Workspace, Microsoft 365, or Amazon SES do this automatically).
- Add the public key as a DNS TXT record at a specific selector subdomain, for example: selector1._domainkey.yourdomain.com
- Your mail server signs every outgoing email with the private key.
- Use a key length of at least 2048 bits for security.
For Indian businesses using multiple email services, each service needs its own DKIM selector and key pair. This is normal and supported by the protocol.
How Do You Implement DMARC Step by Step?
DMARC implementation should be gradual:
| Phase | DMARC Policy | Action |
|---|---|---|
| Phase 1: Monitor | p=none | Collect reports; identify all legitimate senders; fix SPF/DKIM issues |
| Phase 2: Quarantine | p=quarantine; pct=10 | Start quarantining a small percentage of failing emails; monitor impact |
| Phase 3: Increase | p=quarantine; pct=50 then 100 | Gradually increase enforcement percentage |
| Phase 4: Reject | p=reject | Full enforcement — unauthorized emails are rejected |
What Anti-Phishing Measures Should Indian Businesses Implement?
Beyond email authentication, these measures protect your organization:
- Employee training: Regular phishing awareness sessions — especially in India where UPI and banking fraud are prevalent.
- Multi-factor authentication (MFA): Enforce MFA on all email accounts to prevent account takeover even if credentials are compromised.
- Email filtering: Use advanced threat protection (available in Google Workspace and Microsoft 365) to scan attachments and URLs.
- Incident response plan: Document what employees should do when they receive or accidentally click a phishing email.
- Domain monitoring: Watch for lookalike domains (e.g., themaad.in, themad.co) that attackers might register for phishing.
What happens if I do not set up DMARC?
Without DMARC, anyone can send emails that appear to come from your domain. This enables phishing attacks against your customers and partners, damages your brand reputation, and can lead to your legitimate emails being flagged as spam by receiving servers.
How do I read DMARC reports?
DMARC sends aggregate (RUA) and forensic (RUF) reports in XML format. Use free tools like DMARC Analyzer, MXToolbox, or Postmark DMARC to parse and visualize these reports. They show which IPs are sending email from your domain and whether authentication passes or fails.
Is email security mandatory under Indian law?
While SPF/DKIM/DMARC are not explicitly mandated by Indian law, the IT Act 2000, DPDP Act 2023, and RBI cybersecurity guidelines for financial institutions require reasonable security measures for electronic communications. CERT-In advisories have recommended DMARC implementation for government and critical sector organizations.
Can small businesses implement these protocols without a technical team?
Yes. If you use Google Workspace or Microsoft 365, both provide step-by-step guides for SPF, DKIM, and DMARC. Your domain registrar’s DNS management panel is where you add the records. For complex setups with multiple sending services, consulting an email deliverability specialist is worthwhile.
