What are SPF, DKIM, and DMARC, in plain English? Do we really need all three?

These three acronyms sound like deep networking, but the idea behind them is simple. Anyone on the internet can type your business name and address into an email and hit send. These records are how your domain tells the rest of the world which messages are genuinely yours.

SPF (Sender Policy Framework) is the guest list. It is a record in your domain's DNS that says which mail servers and services are allowed to send email on your behalf: your Microsoft 365 or Google Workspace tenant, your invoicing software, your marketing platform. When a receiving server gets a message claiming to be from you, it checks whether the sending server is on the list.

DKIM (DomainKeys Identified Mail) is the wax seal. Your mail system adds an invisible cryptographic signature to every message you send, and the matching public key sits in your DNS. The receiving server verifies the signature, which proves both that the message really came from your domain and that nobody altered it along the way.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the instruction sheet. It tells receiving systems what to do when a message claiming to be from you fails those checks: let it through, send it to spam, or reject it outright. It also sends you reports showing who is sending mail as your domain, which is how businesses discover impersonation attempts they never would have seen otherwise.

Do you need all three? Yes, for two separate reasons. The first is delivery: Google, Yahoo, and Microsoft have all tightened their rules, and the highest-volume senders are required to have all three. Even well below those thresholds, Google expects at least SPF or DKIM and Yahoo expects both, so anything less than a full setup means gambling with whether your quotes and invoices arrive. The second reason is impersonation. Without DMARC set to actually do something, a scammer can send email that appears to come from your exact domain to your customers, and receiving systems have no instruction to stop it. That is the setup behind a lot of fake invoice fraud.

The practical side is manageable. This is a one-time configuration job, usually an hour or two of work in your DNS and email platform, with a short monitoring period afterward to catch any legitimate service you forgot to authorize. The most common mistake is turning DMARC to its strictest setting before confirming that everything which legitimately sends as your business is properly covered, which can block your own mail. Start in reporting mode, review what shows up, then tighten. Any competent IT provider should be able to set this up and confirm it with you.