Your company domain is part of your identity. When criminals impersonate it, customers, suppliers and employees can receive fraudulent messages that appear to come from your business.
SPF, DKIM and DMARC help receiving mail systems determine whether a message is authorized and what to do when authentication fails. DMARC also provides reporting that can reveal which services are sending mail for your domain.
Stage 1: Build the sending inventory
List every legitimate service that sends email using your domain: Microsoft 365 or Google Workspace, marketing platforms, CRM systems, invoicing tools, support systems, website forms, payroll systems and specialist vendors. Include rarely used services and subdomains.
Do not move to enforcement until the inventory is credible. A forgotten sender can become a legitimate message that gets quarantined or rejected.
Stage 2: Confirm SPF and DKIM
SPF identifies servers authorized to send on behalf of a domain. DKIM adds a cryptographic signature that allows the recipient to validate the message and detect certain changes. DMARC requires alignment: at least one passing SPF or DKIM result must align with the domain visible in the From address.
Keep SPF maintainable. Excessive third-party inclusions and outdated services create fragility. Enable DKIM for each supported sender and confirm that the signing domain aligns correctly.
Stage 3: Begin with reporting
A monitoring policy — commonly p=none — asks receivers to send reports without instructing them to block failing mail. Use those reports to identify legitimate senders, unauthorized sources and alignment failures.
Monitoring is an observation stage, not the final protection state. Assign an owner to review reports and resolve findings. A record that nobody reviews provides limited operational value.
Stage 4: Move through quarantine
After legitimate senders authenticate correctly, introduce enforcement gradually. A quarantine policy tells receivers to treat failing messages with suspicion, often directing them toward spam or quarantine.
Use the percentage control where appropriate to limit initial exposure, observe results and expand deliberately. Monitor complaints, delivery failures and critical workflows throughout the change.
Stage 5: Enforce rejection
At p=reject, receiving systems are instructed to reject messages that fail DMARC. The Canadian Centre for Cyber Security's Cross-Sector Cyber Security Readiness Goals recommend enabling DMARC and setting it to reject on corporate email infrastructure.
Enforcement is not a one-time configuration. New vendors, new campaigns and new systems can change the authorized-sender inventory. Review reports and DNS records continuously, and apply an appropriate policy to subdomains.
What DMARC does not solve
DMARC cannot prevent an attacker from compromising a real mailbox, registering a lookalike domain or persuading an employee to act on a fraudulent request. Pair domain protection with MFA, mailbox monitoring, employee awareness and independent verification for payment changes.