SPF, DKIM and DMARC explained for non-technical founders

SPF identifies authorized sending infrastructure

SPF is a DNS-based declaration of which systems may send for a domain used in the SMTP envelope. That domain can differ from the From address the recipient sees, so an SPF pass alone does not establish that the visible sender is aligned.

Give your administrator a complete inventory of your mailbox provider, outreach software and other sending services. Ask them to maintain a single valid SPF policy for each relevant domain and review lookup limits rather than copying multiple independent records into DNS.

DKIM adds a verifiable signature

DKIM lets a receiving system verify a cryptographic signature attached to the message using a public key published in DNS. It helps establish that signed content has not changed in ways that invalidate the signature and identifies the signing domain.

Enable DKIM in each sending service and publish the records that service supplies. Test an actual message from each service because enabling signing in one system does not automatically authenticate another system using your company name.

DMARC connects authentication to the visible identity

DMARC checks whether a passing SPF or DKIM identity aligns with the domain in the visible From address. A DMARC policy also tells receivers how the domain owner wants authentication failures handled, while reporting can help reveal legitimate and unauthorized sending sources.

An administrator may begin with a monitoring policy while identifying legitimate senders, then consider stronger enforcement once those sources are correctly configured. Do not switch to rejection without assessing invoices, support messages and other operational email that could be affected.

• List all legitimate sending systems.
• Verify SPF for the relevant envelope domain.
• Enable and test DKIM signing.
• Inspect visible From domain alignment.
• Review DMARC reports before tightening policy.

Request evidence rather than a configuration screenshot

Ask for a test message's authentication results and a plain-language explanation of which domain passed each check. Keep a record of who owns DNS, who owns each sending account and who investigates authentication changes.

Authentication does not establish recipient permission, guarantee inbox placement or make a weak offer relevant. Continue checking list quality, complaints and provider policies after the technical setup passes.