Why these three settings matter
SPF, DKIM and DMARC are public records on your domain that tell other mail servers which senders are really you. Without them, a scammer can send email that appears to come from your company to your clients, your vendors and your bank.
| Record | What it does |
|---|---|
| SPF | Lists the services allowed to send email as your domain (for example Microsoft 365, your invoicing tool, your newsletter service). |
| DKIM | Adds a digital signature to your outgoing email, so receivers can tell it wasn’t changed and really came from your domain. |
| DMARC | Tells receivers what to do with email that fails those checks: nothing, send it to junk, or reject it. It can also send you reports. |
The quick way
Type your domain into our free email security check. It looks up all three records from public DNS and grades them in a few seconds. It doesn’t log in to anything or read any email.
The manual way
On a Windows computer, open Command Prompt and run these, replacing contoso.com with your domain:
- SPF:
nslookup -type=txt contoso.comand look for a line startingv=spf1. - DMARC:
nslookup -type=txt _dmarc.contoso.comand look for a line startingv=DMARC1. - DKIM on Microsoft 365:
nslookup -type=cname selector1._domainkey.contoso.com(andselector2). On Google Workspace the usual name isgoogle._domainkey.
Reading the results
| Record | Looks good | Needs work |
|---|---|---|
| SPF | Exactly one record starting v=spf1, ending in -all or ~all |
No record, two records (that breaks SPF), or ending in +all |
| DKIM | A key is published and signing is turned on in your email system | No key found, or signing never switched on |
| DMARC | p=quarantine or p=reject, with a reporting address (rua=) |
No record, or p=none for months with nobody reading the reports |
p=none only watches. p=quarantine sends fakes to junk. p=reject blocks them.
Common problems
- A second SPF record. A website or newsletter tool told you to “add this SPF record”, and now there are two. Merge them into one.
- DKIM never turned on. In Microsoft 365, publishing the two DKIM records isn’t enough: signing also has to be enabled in the Microsoft Defender portal (Email & collaboration > Policies & rules > Threat policies > Email authentication settings > DKIM). Copy the exact record values from that page.
- DMARC stuck at
p=none. It was set up years ago as a first step and never moved on, so it doesn’t actually stop anyone. - Too many SPF lookups. SPF allows at most 10 DNS lookups. Each
include:can count several, so long records can quietly break.
Fixing it safely
- Make a list of everything that sends email as your domain: your email provider, invoicing and accounting tools, newsletters, website forms, copiers that scan to email.
- Put all of them in a single SPF record.
- Turn on DKIM signing in Microsoft 365 or Google Workspace, and in any other sending service that supports it.
- Publish DMARC at
p=nonewith a reporting address, and read the reports for a few weeks. - When your real email passes, move to
p=quarantine, then top=reject. Going straight to reject can block real invoices or newsletters. - Re-check whenever you add a new tool that sends email.
Related
- Email security services
- Fake invoices with new bank details: how to stop the scam
- How to spot and report a phishing email in Outlook
More guides
- Microsoft 365 admin: add staff, reset passwords and offboard someone who leaves
- Microsoft 365 Copilot: what it does, where to find it, and how to use it safely
- Set up Microsoft Authenticator and Outlook on your phone (iPhone and Android)
- How to send an encrypted email in Outlook (Microsoft 365)
- What goes in a WISP: a checklist for small tax offices
- Share files with clients securely from OneDrive (expiring links, no attachments)
- Hand over HOA or office email when a board member or manager changes
- How to spot and report a phishing email in Outlook
Microsoft changes its menus from time to time, so a button may have moved. These guides are general information for small businesses; check with your IT provider before changing settings that affect everyone.