{"id":3324,"date":"2025-09-24T21:53:44","date_gmt":"2025-09-24T21:53:44","guid":{"rendered":"https:\/\/acatechsolutions.co.uk\/blog\/?p=3324"},"modified":"2026-08-18T05:24:57","modified_gmt":"2026-08-18T05:24:57","slug":"the-email-security-trio","status":"publish","type":"post","link":"https:\/\/acatechsolutions.co.uk\/blog\/the-email-security-trio\/","title":{"rendered":"SPF, DKIM and DMARC Explained for UK Businesses"},"content":{"rendered":"

Reviewed 18 August 2026.<\/em><\/p>\n

SPF, DKIM and DMARC are DNS-based email controls that work together to make it harder for criminals to impersonate your domain.<\/strong> SPF identifies permitted sending systems, DKIM attaches a verifiable signature to messages, and DMARC checks that the visible From address aligns with those results before telling receiving services what to do.<\/p>\n

They reduce domain spoofing and improve accountability, but they are not a complete email-security product. They do not stop every phishing message, clean an infected device or guarantee that legitimate mail is safe.<\/p>\n

SPF, DKIM and DMARC at a glance<\/h2>\n
\n\n\n\n\n\n\n\n
Control<\/th>\nQuestion it answers<\/th>\nWhere it is configured<\/th>\nMain limitation<\/th>\n<\/tr>\n<\/thead>\n
SPF<\/strong><\/td>\nIs this sending server authorised for the envelope domain?<\/td>\nA TXT record in DNS<\/td>\nForwarding can break SPF, and the visible From address may be different<\/td>\n<\/tr>\n
DKIM<\/strong><\/td>\nDoes this message have a valid signature from the signing domain?<\/td>\nA public key in DNS; private key held by the sender<\/td>\nA valid signature does not by itself prove the visible From domain is aligned<\/td>\n<\/tr>\n
DMARC<\/strong><\/td>\nDoes SPF or DKIM pass in alignment with the visible From domain?<\/td>\nA TXT record at _dmarc.yourdomain<\/code><\/td>\nPoor discovery can cause legitimate mail to fail when enforcement begins<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

How SPF works<\/h2>\n

Sender Policy Framework (SPF) publishes the systems allowed to send mail for a domain. A typical record might authorise Microsoft 365 plus a marketing platform. Receiving mail systems compare the connecting server with that policy.<\/p>\n

A domain should have one valid SPF record. Multiple separate SPF records can cause a permanent error. SPF also has a limit on DNS-based lookups, so repeatedly adding suppliers without removing old ones can make the record fail. Maintain an inventory of every legitimate sender instead of treating the record as an append-only list.<\/p>\n

SPF evaluates the envelope sender used during delivery. That can differ from the address a person sees in the From field, which is why SPF alone does not adequately prevent visible-domain impersonation.<\/p>\n

How DKIM works<\/h2>\n

DomainKeys Identified Mail (DKIM) adds a cryptographic signature to selected message headers and content. The sending platform holds a private key; receiving services retrieve the matching public key from your DNS and verify that the signed content has not been altered.<\/p>\n

DKIM records use a selector, allowing a domain to have different keys for Microsoft 365, Google Workspace, a newsletter service and other senders. Rotate keys where the platform supports it, and remove selectors that are no longer used.<\/p>\n

A DKIM pass confirms that the message was signed by the stated signing domain and survived verification. DMARC adds the crucial check that this domain aligns with the visible From address.<\/p>\n

How DMARC brings them together<\/h2>\n

Domain-based Message Authentication, Reporting and Conformance (DMARC) requires either aligned SPF or aligned DKIM to pass. Alignment means the authenticated domain matches, or is an allowed organisational-domain relation to, the address the recipient sees.<\/p>\n

A DMARC record also publishes a policy:<\/p>\n