Why SPF, DKIM and DMARC aren't optional anymore

Anyone can send an email that says it's from you. The field that shows the sender in an inbox, "From", is fundamentally just text the sender types in. Nothing checks it against anything else, unless your domain has told the recipient's server to.

That's the whole threat in one sentence: email was built for a time without this problem, and the protocol has never been forced away from that.

What an unprotected domain actually lets happen

A forged sender address that looks exactly like your own, [email protected] for example, gets used to order goods, request a changed bank account on a real supplier invoice, or ask an employee to buy gift cards for "the boss" who happens to be in a meeting right then. The recipient has nothing to go on except that the address looks right, because it is right, letter for letter. No firewall or antivirus stops this, there's no malicious code to find. It's just text that looks credible, sent from somewhere else.

It doesn't matter how secure your own infrastructure is if the domain itself is left unlocked.

The three layers, and why all three matter

SPF decides which servers are allowed to send email from the domain. It stops the sloppiest attempts, a server not on the list gets rejected outright by the recipient. But SPF only checks which server sent the message, not whether the content was tampered with, and it breaks down as soon as a message gets forwarded through another system.

DKIM solves what SPF misses. A cryptographic signature travels with the message itself, not just the transport, so the recipient can tell if the content changed after it left your server. The signature survives forwarding in a way SPF doesn't.

DMARC is the one that actually decides the outcome. Without DMARC, the recipient's server checks SPF and DKIM but decides on its own, differently from provider to provider, what a failed result should mean. DMARC takes that decision out of the guesswork and states it plainly: approve, send to spam, or reject.

Having just one of the three covers part of the hole. All three together, with DMARC actually set to reject, is what makes someone trying to send email as you fail every time, not just sometimes.

Why it usually doesn't get done

It's three DNS records. None of them cost money, none require new hardware, and the technical bar is low. Yet most smaller companies' domains sit fully or partly unprotected. The reason is rarely technical, it's that it never makes it to the top of anyone's list until something has already happened.

The DMARC reports are also uncomfortable to read the first time. Hits show up from systems you'd forgotten existed: an old newsletter tool, an invoicing service, an employee's personal Gmail sending on the company's behalf. That's exactly why the policy should start at monitor, not reject, so those systems get found before they get accidentally cut off.

What it actually takes

No server needs replacing, no subscription needs buying. What it takes is access to the domain's DNS management and an afternoon, split into three steps: SPF first, then DKIM, then DMARC set to monitor for a few weeks before the policy tightens. The walkthrough for each step is in the guides.

A domain without these three records isn't a future risk. It's already open today, to anyone who knows it.