Here’s a scenario that happens to UK small businesses every week: a scammer sends an email to your clients, suppliers, or employees that appears to come from your domain — your actual email address, your actual company name. The email asks them to transfer money, click a link, or hand over credentials. They do, because why wouldn’t they trust an email from you?

This attack is called email spoofing, and the frustrating thing is that it’s largely preventable with three DNS records that most small businesses haven’t set up. They’re called SPF, DKIM, and DMARC, and together they tell the world’s email servers whether messages claiming to be from you are legitimate.

What Each Record Does

Think of these as three layers of protection that work together.

SPF (Sender Policy Framework) is a list you publish in DNS of all the mail servers authorised to send email from your domain. When someone receives an email claiming to be from yourcompany.co.uk, their mail server checks your SPF record to see if the sending server is on the list. If it isn’t, the email fails SPF.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to every outgoing email. The signature is generated using a private key on your mail server, and the public key is published in your DNS records. When a receiving mail server checks the signature, it can confirm that the email genuinely came from an authorised sender and hasn’t been tampered with in transit.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy that ties the other two together and tells receiving servers what to do when an email fails SPF or DKIM checks — nothing, quarantine it, or reject it outright. It also sends you reports so you can see who’s sending email from your domain.

Without DMARC, even if you have SPF and DKIM in place, spoofed emails can still get through because there’s no instruction on what to do when authentication fails.

Does Your Domain Need This?

Yes, almost certainly. If you have a domain (yourcompany.co.uk, yourcompany.com) and you send email from it — whether through Gmail, Outlook 365, or a hosted email service — you need these records.

The NCSC’s “Cyber Essentials” certification (which is increasingly required for UK government contracts) includes email authentication as part of its requirements. And from 2024 onwards, major providers like Google and Microsoft have tightened their filtering for emails from domains without proper DMARC records — meaning your legitimate emails may start landing in spam if you haven’t set this up.

Setting Up SPF

Log in to wherever you manage your domain’s DNS records — this is usually your domain registrar (GoDaddy, Namecheap, 123-reg) or your hosting provider’s control panel.

Add a TXT record with the name @ (or your domain) and a value like:

v=spf1 include:_spf.google.com ~all

Replace include:_spf.google.com with the appropriate value for your email provider:

  • Google Workspace: include:_spf.google.com
  • Microsoft 365: include:spf.protection.outlook.com
  • Zoho Mail: include:zoho.com

The ~all at the end means “soft fail” — emails from unlisted servers get a warning rather than a hard rejection. Once you’re confident everything is working, you can change this to -all for a hard fail.

If you send email from multiple services (your main email plus a marketing platform like Mailchimp), you need to include all of them:

v=spf1 include:_spf.google.com include:servers.mcsv.net ~all

Setting Up DKIM

DKIM setup varies by email provider, but the general process is:

  1. Generate a DKIM key pair in your email provider’s settings (look for “DKIM” or “email authentication” in the admin panel)
  2. Your provider gives you a DNS TXT record to add — it looks something like google._domainkey.yourcompany.co.uk with a long value starting with v=DKIM1
  3. Add that record to your DNS

For Google Workspace: Admin Console → Apps → Google Workspace → Gmail → Authenticate Email. For Microsoft 365: Admin Center → Settings → Domains → your domain → DNS records (DKIM is usually added automatically).

Once you’ve added the record, go back to your email provider and click “Verify” or “Authenticate” — they’ll confirm the DNS record is live.

Setting Up DMARC

After SPF and DKIM are in place, add a DMARC record. Add a TXT record with the name _dmarc and start with a monitoring-only policy:

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourcompany.co.uk

p=none means “monitor but don’t take any action yet.” The rua= address is where you’ll receive daily aggregate reports showing which servers are sending email from your domain and whether they’re passing authentication.

After a couple of weeks of reviewing reports and confirming all your legitimate email is passing correctly, tighten the policy:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourcompany.co.uk

Then eventually:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@yourcompany.co.uk

p=reject is the goal — it tells receiving servers to reject emails that fail authentication entirely, which effectively stops spoofed emails from reaching anyone.

Checking Your Current Status

Before you start, check what you have (or don’t have) with these free tools:

  • MXToolbox (mxtoolbox.com) — paste your domain and run the Email Health check
  • DMARC Analyser (dmarcanalyser.com) — shows your current DMARC record and its implications
  • Google Admin Toolbox (toolbox.googleapps.com) — check dig/MX/SPF from Google’s perspective

If you see “No DMARC record found” or “No SPF record found,” those are gaps to close today. The setup takes about 30–60 minutes for most small businesses, the records are free, and the protection against your domain being used in fraud is significant. It’s one of the highest-return security improvements you can make.