Verify blog · November 12, 2026 · 2 min read
Can someone send email as your business? SPF, DKIM and DMARC, simply
If your business uses its own domain for email, three small records decide whether anyone else can send mail that looks like it came from you. Many small businesses have one or none of them.
The three records
- SPF lists the servers allowed to send email for your domain
- DKIM signs each email you send, so the receiver can tell it wasn't changed and really came from you
- DMARC tells other mail providers what to do with an email that fails those checks: nothing, send it to spam, or refuse it
Why it matters to you
Without DMARC set to quarantine or reject, an email pretending to be from your address can still land in your customers' inboxes. Scammers use that to send fake invoices in your name.
Check yours
Verify looks up all three for your domain, names your email provider, and tells you the exact record to add for anything missing. The records are added where your domain's DNS is managed, often the company you bought the domain from.
Start DMARC with p=none for a couple of weeks if you're unsure, then move to quarantine once your own email passes. Your email provider's instructions come first.