DMARC, SPF, and DKIM: Email Authentication for Philippine Businesses
Your business email address represents your brand. Without safeguards, criminals can send messages that appear to come from your domain, deceiving clients, employees, and suppliers. Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) are three DNS-based standards that make direct spoofing of your domain harder.
Executive Summary: SPF lists the servers allowed to send for your domain's envelope identity. DKIM signs messages so receivers can detect changes. DMARC passes when at least one passing SPF or DKIM result aligns with your visible From: domain, and it publishes your requested policy for failures. Together they reduce direct spoofing of your exact domain, not lookalike domains, compromised accounts, or other phishing methods.
Quick AnswerSPF, DKIM, and DMARC are DNS records that authenticate business email. DMARC passes when SPF or DKIM passes and aligns with the visible From: domain. Its policy (none, quarantine, or reject) is a request that receivers usually, but not always, honor, and p=none asks for no action. They help against direct spoofing of your exact domain, not every phishing method.
Table of contents
- Why Email Authentication Matters for Philippine Businesses
- The Three Authentication Standards Explained
- How SPF, DKIM, and DMARC Work Together
- Google's 2024 Email Sender Requirements
- How to Check and Set Up Your Records
- Common Mistakes and How to Avoid Them
- Key Takeaways
- Frequently Asked Questions
- Protect Your Business Email with Z.com Unlimited Email Hosting
Why Email Authentication Matters for Philippine Businesses
Email fraud threatens businesses of every size. Criminals impersonate company addresses to trick people into transferring money or sharing data. Without authentication, nothing technically stops someone from sending a message showing yourname@yourbusiness.com in the From: line. Small businesses can be attractive targets when basic protections are missing. Fake invoices, spoofed owner messages, and phishing links under a supplier's name are common. Authentication also affects deliverability. Gmail, Outlook, and Yahoo Mail may filter or reject unauthenticated messages. Since February 2024, Google's sender requirements apply to messages sent to personal Gmail accounts: all senders need SPF or DKIM, and bulk senders must also publish DMARC. Failing these checks can send newsletters, order confirmations, and client emails to spam.The Three Authentication Standards Explained
SPF: Sender Policy Framework
SPF is a DNS TXT record listing the mail servers authorized to send for a domain. Receivers check the envelope sender (the Return-Path or MAIL FROM address, rarely visible to recipients) against that domain's SPF record. This is not the visible From: address, so an SPF pass alone does not prove the From: address is genuine. An illustrative SPF record (use the include value your provider supplies):v=spf1 include:mail.yourhostprovider.com ~all~all produces an SPF SoftFail for unlisted servers, while -all produces an SPF Fail. Neither guarantees rejection, since receivers decide how to act. SPF often breaks when mail is forwarded. Publish only one SPF record per domain, merging all services into it.
DKIM: DomainKeys Identified Mail
DKIM adds a cryptographic signature to the email header. Your mail server signs each outgoing message with a private key. The public key sits in DNS under a selector, a label in the signature that tells receivers which record to look up (selector._domainkey.yourdomain.com). Receivers fetch it and verify the signature.
The signature travels with the message, so DKIM can survive forwarding if the signed content is unchanged. Changes to signed content can invalidate the signature, although DKIM canonicalization tolerates some formatting changes. That may signal tampering, but legitimate changes such as mailing-list footers or gateway rewrites can break it too. Most hosting providers generate DKIM keys automatically; good email deliverability depends on both SPF and DKIM being configured.
DMARC: Domain-Based Message Authentication, Reporting, and Conformance
DMARC is published as a DNS TXT record at_dmarc.yourdomain.com. It adds two things that SPF and DKIM alone cannot provide: an alignment requirement and a policy for non-compliant messages.
DMARC passes when at least one of SPF or DKIM passes and aligns with the domain in your visible From: address. Relaxed alignment (the default) lets subdomains such as mail.yourdomain.com align with yourdomain.com; strict alignment requires an exact match. Without alignment, an attacker could pass SPF or DKIM with their own domain while displaying yours.
A basic DMARC record:
v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com- none — Monitor only. You ask receivers to take no DMARC action, though they may still filter using other signals. Reports still go to your
ruaaddress. - quarantine — You ask receivers to treat failing messages as suspicious, typically delivering them to spam or junk.
- reject — You ask receivers to refuse failing messages; most comply, but handling can vary, for example with forwarding.
How SPF, DKIM, and DMARC Work Together
The three standards form a layered defense: SPF checks the sending server, DKIM verifies integrity, and DMARC checks alignment with the visible sender domain and states your requested policy. One aligned SPF or DKIM pass is enough for DMARC, though configuring both adds resilience. A message with no aligned pass fails DMARC and is subject to your policy, which receivers apply at their discretion. This protects against direct spoofing of your exact domain, not lookalike domains, display-name impersonation, compromised accounts, or phishing from other domains. Aggregate reports (rua) summarize who sends email as your domain, including forgotten third-party services such as a CRM or marketing tool; coverage depends on which receivers send them. Failure reports (ruf) are optional message-level details that many receivers do not send (Gmail does not support ruf) and may contain message content, so consider privacy before enabling them. Review aggregate reports before tightening policy.
Google's 2024 Email Sender Requirements
In February 2024, Google began enforcing sender requirements for email to personal Gmail accounts. This list focuses on authentication; other requirements also apply, including one-click unsubscribe for bulk marketing and subscription messages. Requirements for all senders:- Have SPF or DKIM set up for your sending domain.
- Keep spam complaint rates below 0.10% (recommended) and never reach 0.30%.
- Have both SPF and DKIM configured for your sending domain.
- Publish a DMARC record — a
p=nonepolicy is acceptable. - Ensure the From: domain aligns with the SPF or DKIM domain.
- Support one-click unsubscribe in marketing and subscription messages.
How to Check and Set Up Your Records
Before making DNS changes, check what is already published using a free tool such as MXToolbox. Look up each record separately; DKIM lookups need your provider's selector.-
Check your existing records Look up your current SPF, DKIM, and DMARC records and note which mail services are already listed.
-
Set up SPF In your DNS manager, create or update one TXT record for your root domain (
@). Publish only one SPF record, merging every authorized sending service with the values each provider supplies. If you use Z.com Unlimited Email Hosting, follow the DNS records setup guide. -
Set up DKIM Many providers generate a DKIM key pair for you. In your email admin area (for example, cPanel, where offered), copy the public key TXT record provided into your DNS. The record name follows
selector._domainkey.yourdomain.com, using the selector your provider assigns. -
Publish a DMARC record Create a TXT record named
_dmarc.yourdomain.comwith this value to start in monitoring mode:Replace thev=DMARC1; p=none; rua=mailto:youremail@yourdomain.comruaaddress with a mailbox you actively monitor for aggregate reports. -
Test, review reports, and tighten your policy Send test messages from every legitimate service (mailboxes, website forms, CRM, newsletter tools) and verify DMARC passes with aligned SPF or DKIM before tightening policy. Review aggregate reports across your full sending cycle. When all legitimate sources align, move to
p=quarantine, thenp=rejectif appropriate, and keep monitoring.
Common Mistakes and How to Avoid Them
Setting p=reject too soon
Moving to reject before verifying all legitimate sending sources can block valid email. Stay on
p=none until reports covering every sending cycle show each legitimate source passing with alignment, then tighten gradually.Publishing SPF with too many DNS lookups
SPF allows ten DNS lookups; exceeding that causes a permanent error. Remove unused services and keep one merged record. If you need more, prefer provider-assisted or maintained options, such as a consolidated include supplied by your provider or a maintained SPF-management service, over a static flattened list that goes stale.
Forgetting third-party senders
Any service that sends email on your domain's behalf — a CRM, e-commerce platform, or marketing tool — must be authenticated. Check each provider's documentation for required SPF includes or DKIM key setup instructions.
Using a weak DKIM key
Google recommends at least 2048-bit DKIM keys. A 1024-bit key meets the minimum requirement but is considered less secure by current standards. Confirm with your email hosting provider which key length they generate for new accounts.
Key Takeaways
- SPF, DKIM, and DMARC authenticate your email and reduce direct spoofing of your exact domain, not lookalike domains or other phishing.
- DMARC passes when at least one of SPF or DKIM passes and aligns with your visible From: domain, and it states your requested policy.
- For personal Gmail, Google requires SPF or DKIM from all senders, and SPF, DKIM, and DMARC from bulk senders (more than 5,000 messages per day), plus other conditions.
- Use one merged SPF record, start with
p=none, test every legitimate sender, and tighten only once reports show mail aligning. - Keep monitoring aggregate reports after any policy change.
Frequently Asked Questions
Do I need all three — SPF, DKIM, and DMARC?
For basic deliverability, you need at least SPF or DKIM, and DMARC needs one passing, aligned result to pass. For the strongest protection against direct domain spoofing, and to meet Google's bulk-sender requirements, all three are recommended. If you send any transactional or marketing email, set up all three regardless of volume.Will setting up DMARC break my existing email?
Starting withp=none asks receivers to take no DMARC action on failing messages, so DMARC alone should not cause legitimate email to be blocked, though receivers may still filter mail on other signals. Move to quarantine or reject only after reviewing reports and confirming all valid sources pass with alignment.
How long do DNS changes take to apply?
Most DNS TXT record changes propagate within one to four hours, though propagation can take up to 48 hours in some cases. You can monitor propagation using tools such as MXToolbox or Google Admin Toolbox.Can I set up DMARC if my email is hosted externally?
Yes. DMARC is a DNS record published for your domain, separate from where your mailboxes are hosted. For it to pass, your provider's mail must carry an aligned SPF or DKIM result, so check its documentation for DKIM signing and its SPF include value.