TOOLBOX · DOWNLOAD
SPF, DKIM, DMARCin fivesteps.
With SPF, DKIM and DMARC, you prove that emails using your domain really come from you and tell recipients how to handle forgeries. This plan takes you in five steps from the inventory to the p=reject policy, with sample DNS entries and the pitfalls described in the standards. It takes into account the DMARC standard RFC 9989 published in May 2026.
Free PDF · Guide
Email Security: SPF, DKIM and DMARC in Five Steps
- Format
- PDF, A4
- Length
- 7 pages
- Size
- 107 KB
- Updated
- Oct 22, 2026
- Sources
- 11
- Usage
- Redistribution in unchanged form permitted
WHO IT IS FOR
Who This
Is for.
Rollout plan from the inventory to p=reject, based on RFC 7208, RFC 6376 and the DMARC standard RFC 9989.
- IT managers and administrators of mail servers and Microsoft 365
- Companies whose domain is or could be misused for phishing
- Anyone who sends newsletters, invoices or tickets through external services
7 SECTIONS
What Is
Inside.
- 01
What checks what
SPF, DKIM and DMARC in one table: what is checked, where the entry is located, which standard applies.
- 02
Step 1: Record all senders
Every service that sends with your domain needs matching SPF or DKIM, otherwise it will later fail DMARC.
- 03
Step 2: Publish SPF
One entry per domain, no more than ten DNS lookups, ending with -all or ~all.
- 04
Step 3: DKIM for every sender
Sign with rsa-sha256 and a 2048-bit key; the public key is in the DNS under the selector.
- 05
Step 4: DMARC in monitoring mode
Publish p=none with a report address, evaluate reports automatically, close gaps.
- 06
Step 5: Via quarantine to reject
At least one month of p=none, just as long with p=quarantine, then p=reject, with an eye on mailing lists.
- 07
At a glance
The seven points to check off, from the sender inventory to the secured secondary domain.
EXCERPT
Step 5: Via quarantine to reject
- p=none
Monitor
v=DMARC1; p=none; rua=mailto:…– At least one month. - p=quarantine
Quarantine
v=DMARC1; p=quarantine; rua=mailto:…– Just as long; compare the results with the monitoring phase. - p=reject
Reject
v=DMARC1; p=reject; rua=mailto:…– Permanently, once all legitimate senders pass.
t=ymarks a policy in testing: recipients apply one level less, so forp=rejectonly quarantine (RFC 9989, tag t). The formerpcttag no longer exists since RFC 9989; older guides, including Microsoft’s, still mention it.- Subdomains:
spapplies to existing subdomains,npto non-existent ones; if both are missing,papplies (RFC 9989, tags sp and np). - Mailing lists: according to RFC 9989, domains whose users post to mailing lists on the internet should not publish p=reject; anyone who does so anyway should inform users that participation in mailing lists may be impaired (Section 7.4).
parked.example.com. IN TXT "v=spf1 -all"
_dmarc.parked.example.com. IN TXT "v=DMARC1; p=reject;"
parked.example.com. IN MX 0 .The null MX entry MX 0 . states that the domain does not accept email; there must be no other MX entry alongside it, and domains used as senders should not publish it (RFC 7505). For unused domains, Microsoft recommends DMARC entries stating that no email may ever come from them, and no DKIM entries.
SOURCES
Supported
by Sources.
- RFC 7208: Sender Policy Framework (SPF) (opens in a new tab)Sections 2.6, 3.3, 4.5, 4.6.4, 5.5, 8.5, 10.1.2, 11.2
- RFC 6376: DomainKeys Identified Mail (DKIM) Signatures (opens in a new tab)Sections 3.5, 3.6.1, 3.6.2.1
- RFC 8301: Cryptographic Algorithm and Key Usage Update to DKIM (opens in a new tab)Sections 3.1 and 3.2
- RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) (opens in a new tab)Standards Track, May 2026, obsoletes RFC 7489
- RFC 9990: DMARC Aggregate Reporting (opens in a new tab)
- RFC 9991: DMARC Failure Reporting (opens in a new tab)
- RFC 7489: DMARC (previous version, Informational, March 2015) (opens in a new tab)
- RFC 7505: A "Null MX" No Service Resource Record (opens in a new tab)
- Microsoft Learn: Set up DKIM for Microsoft 365 (opens in a new tab)
- Microsoft Learn: Set up DMARC for Microsoft 365 (opens in a new tab)
- Microsoft Learn: Set up SPF for Microsoft 365 (opens in a new tab)
The DNS entries are examples using reserved example domains. Only adopt values after the inventory: a p=reject policy set too early can cause legitimate emails to be rejected.
TOOLBOX
Explore
Further.
- Kostenlos
Email security check (German)
Check SPF, DKIM, DMARC
Check Now - Kostenlos
DNS security check (German)
DNSSEC, CAA and name servers
Check Now Business email compromise
How attackers use forged or compromised mailboxes to redirect payments.
Learn MorePhishing
How to recognize phishing and how companies protect themselves.
Learn More
EMAIL & MICROSOFT 365
More on
This Topic.
- PDF
MFA in Microsoft 365
Security defaults or Conditional Access, emergency access accounts, choice of methods, rollout in report-only mode and Microsoft’s mandatory MFA: roll out MFA without locking yourself out.
View - PDF
Microsoft 365 Security Checklist
The most important security settings per service to check off: accounts and roles, email, protection against malware, sharing, Teams, and logs, based on CISA SCuBA and Microsoft Learn.
View - PDF
Securing Exchange Online
What Exchange Online always protects, what Defender for Office 365 Plan 1 and 2 add, which values Microsoft recommends, and which exceptions undermine protection.
View
YOUR NEXT STEP
From Paper
to Practice.
We review with you what is already implemented in your environment and put the rest into practice: as a project with EXPERTS or as ongoing operations with GRID.