--- title: "IT Hygiene: SPF, DKIM, and DMARC Without the Jargon | TRNSFRM" url: https://trnsfrm.tech/blog/it-hygiene-spf-dkim-dmarc description: "SPF, DKIM, and DMARC in plain language: what each does, why it matters, and how to move to enforcement without blocking your own mail." lang: en --- Back to blog (https://trnsfrm.tech/blog) Image: IT Hygiene: SPF, DKIM, and DMARC Without the Jargon (https://trnsfrm.tech/blog-covers/ai-phishing.jpg) By Jeff Dennis (https://www.linkedin.com/in/jefferydennis), Founder & CEO November 6, 2026 # IT Hygiene: SPF, DKIM, and DMARC Without the Jargon IT Hygiene (https://trnsfrm.tech/blog?category=IT+Hygiene)#it-hygiene #email-security #dmarc #cis-controls Anyone can send an email that claims to come from your domain. Unless you have set up three records in your domain's DNS, receiving mail servers have no reliable way to tell your real messages from forgeries. That makes it easier for attackers to impersonate your business to customers, patients, vendors, and your own staff, and it can cause your legitimate mail to land in spam. The three records are SPF, DKIM, and DMARC. The names are technical, but the ideas are simple. This post explains them in plain language and walks through how to set them up safely. ## What each one does **SPF (Sender Policy Framework)** is a published list of the servers allowed to send mail for your domain. When a message arrives claiming to be from you, the receiving server checks whether it came from a server on your list. **DKIM (DomainKeys Identified Mail)** adds a digital signature to your outgoing messages. The receiving server checks the signature against a public key you publish in DNS. If the message was forged or altered, the signature fails. **DMARC (Domain-based Message Authentication, Reporting and Conformance)** ties the two together. It tells receiving servers what to do when a message claiming to be from your domain fails the checks: do nothing, send it to spam, or reject it. It also asks them to send you reports, so you can see who is sending mail as your domain. Think of SPF as the guest list, DKIM as the signature on the letter, and DMARC as your instructions to the doorman, plus a daily report of who tried to get in. ## Why it matters now - **Impersonation.** Attackers impersonate businesses to trick customers into paying fake invoices or sharing information. DMARC at an enforcing policy makes direct spoofing of your exact domain much harder. - **Deliverability.** Major mailbox providers, including Google, Yahoo, and Microsoft, have tightened sender authentication requirements, particularly for organizations that send in volume. Domains without proper authentication are more likely to have legitimate mail filtered. - **Frameworks.** CIS Controls v8.1 Safeguard 9.5 calls for implementing DMARC, and CISA's federal directive BOD 18-01 required it for federal agency domains. For businesses under HIPAA or the FTC Safeguards Rule, it is part of a reasonable defense against phishing and impersonation, which your risk analysis should address. ## Step 1: Find everything that sends mail as you This is the step that prevents problems later. Your domain probably sends mail from more places than you think: - Your main email platform, such as Microsoft 365 or Google Workspace - Your website contact forms - Marketing and newsletter platforms - Your CRM, DMS, or practice management system sending reminders or receipts - Billing and invoicing tools - Scanners and copiers that email documents - Ticketing or help desk tools Make a list. Every legitimate sender needs to be covered by SPF, DKIM, or both, or its mail will start failing once you enforce DMARC. ## Step 2: Set up SPF Publish one SPF record listing your legitimate senders. Most email platforms and marketing services tell you exactly what to add. A few cautions: - Have only one SPF record per domain. Multiple records break it. - SPF has a limit on how many DNS lookups it can trigger. Long lists of services can exceed it. If you are near the limit, your IT provider can help simplify. - End with a policy that tells receivers what to do with mail from servers not on the list. A soft fail is common while you are getting started. ## Step 3: Turn on DKIM Enable DKIM signing in your email platform and in each service that sends on your behalf. Each one will give you a DNS record to publish. Once published, confirm that signing is turned on in the service itself. Publishing the record alone is not enough. ## Step 4: Start DMARC in monitoring mode Publish a DMARC record with a policy of none and an address to receive reports. This does not change how your mail is handled. It just starts the reports. The reports are in a format meant for machines. A DMARC reporting service turns them into a readable view of who is sending as your domain and whether each source passes. ## Step 5: Fix what fails, then enforce Review the reports. You will see your legitimate senders, some that need SPF or DKIM fixes, and probably some forgeries. Fix the legitimate ones. When your legitimate mail consistently passes, move the policy to quarantine, which sends failing mail to spam. Watch the reports. When you are confident, move to reject, which tells receivers to refuse forged mail outright. DMARC also lets you apply a policy to a percentage of mail, which makes the transition gradual. How long this takes depends on how many senders you have. Do not rush to reject before the reports show your legitimate mail passing, or you will block your own invoices and appointment reminders. ## Step 6: Keep it current Every time someone signs up for a new tool that sends email as your domain, it needs to be added. Make that part of your vendor onboarding process and check the DMARC reports regularly. ## What DMARC does not do DMARC protects your exact domain. It does not stop lookalike domains, such as a misspelling of your name, or attacks from compromised real accounts. Those need other controls: MFA, user awareness, and payment verification procedures. Our MFA policy guide (https://trnsfrm.tech/blog/policy-guide-multifactor-authentication) and acceptable use policy guide (https://trnsfrm.tech/blog/policy-guide-acceptable-use) cover those. ## How we help TRNSFRM helps businesses across Cleveland and Columbus set up and monitor email authentication as part of broader email security. See our cybersecurity services (https://trnsfrm.tech/cybersecurity), our healthcare (https://trnsfrm.tech/industries/healthcare) and automotive (https://trnsfrm.tech/industries/automotive) pages, and the NIST (https://trnsfrm.tech/frameworks/nist) overview. Take the free compliance checklist (https://trnsfrm.tech/compliance-checklist), or book your free risk review (https://trnsfrm.tech/book). ## Related articles IT Hygiene ### IT Hygiene: Taking Local Admin Rights Away From Everyday Users Everyday accounts with admin rights make every bad click more dangerous. Why removing them matters, what the frameworks say, and how to roll it out without a revolt. Read article https://trnsfrm.tech/blog/it-hygiene-remove-local-admin-rights IT Hygiene ### IT Hygiene: Offboarding an Employee the Same Day Leftover accounts are an easy way in. A same-day offboarding checklist covering accounts, devices, shared credentials, vendor access, and the record you keep. Read article https://trnsfrm.tech/blog/it-hygiene-employee-offboarding-same-day IT Hygiene ### Stop ignoring device firmware updates Hackers rarely break into networks through the front door. They usually sneak in through forgotten office equipment running obsolete code. Read article https://trnsfrm.tech/blog/stop-ignoring-device-firmware-updates Call Now: +18777776855 ## Structured data ```json [ { "@context": "https://schema.org", "@type": "Organization", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "logo": "https://trnsfrm.tech/wp-content/uploads/2021/11/trnsfrm-logo.svg", "image": "https://trnsfrm.tech/og-image.png", "description": "Cybersecurity, compliance, and managed IT services for manufacturers, construction, automotive, and healthcare organizations.", "foundingDate": "2008", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "founder": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://trnsfrm.tech/", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ] }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "address": [ { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, { "@type": "PostalAddress", "addressLocality": "Columbus", "addressRegion": "OH", "addressCountry": "US" } ], "contactPoint": { "@type": "ContactPoint", "contactType": "customer service", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "areaServed": "US", "availableLanguage": "English" }, "knowsAbout": [ "CMMC", "NIST 800-171", "ISO 27001", "HIPAA", "FTC Safeguards", "ITAR", "Managed IT", "vCISO", "vCIO", "Cybersecurity", "Microsoft GCC High" ], "makesOffer": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Cybersecurity", "url": "https://trnsfrm.tech/cybersecurity", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Governance & Compliance", "url": "https://trnsfrm.tech/governance", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Managed IT", "url": "https://trnsfrm.tech/managed-it", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "vCISO", "url": "https://trnsfrm.tech/vciso", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Integration & Implementation", "url": "https://trnsfrm.tech/services/ai", "provider": { "@type": "Organization", "name": "TRNSFRM" } } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Microsoft GCC / GCC High", "url": "https://trnsfrm.tech/services/microsoft-gcc", "provider": { "@type": "Organization", "name": "TRNSFRM" } } } ], "aggregateRating": { "@type": "AggregateRating", "ratingValue": "5.0", "reviewCount": "177", "bestRating": "5", "worstRating": "1" }, "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@type": "WebSite", "name": "TRNSFRM", "url": "https://trnsfrm.tech", "publisher": { "@type": "Organization", "name": "TRNSFRM" }, "potentialAction": { "@type": "SearchAction", "target": "https://trnsfrm.tech/blog?q={search_term_string}", "query-input": "required name=search_term_string" } }, { "@context": "https://schema.org", "@type": "ProfessionalService", "name": "TRNSFRM", "legalName": "Bitboyz LLC", "alternateName": [ "TRNSFRM Technology", "Bitboyz", "Bitboyz LLC", "Bitboyz LLC DBA TRNSFRM" ], "url": "https://trnsfrm.tech", "image": "https://trnsfrm.tech/og-image.png", "telephone": "+1-877-777-6855", "email": "info@trnsfrm.tech", "address": { "@type": "PostalAddress", "streetAddress": "10143 Royalton Rd Suite J", "addressLocality": "North Royalton", "addressRegion": "OH", "postalCode": "44133", "addressCountry": "US" }, "areaServed": [ { "@type": "Country", "name": "United States" }, { "@type": "City", "name": "Cleveland", "containedInPlace": { "@type": "State", "name": "Ohio" } }, { "@type": "City", "name": "Columbus", "containedInPlace": { "@type": "State", "name": "Ohio" } } ], "priceRange": "$$", "sameAs": [ "https://www.linkedin.com/company/trnsfrmtech", "https://www.linkedin.com/in/jefferydennis", "https://clutch.co/profile/trnsfrm", "https://maps.google.com/?cid=0x8830ed5d3a6900c5:0xe344c24d13357f96", "https://www.goodfirms.co/company/trnsfrm", "https://www.bestitmsps.com/company/trnsfrm/" ] }, { "@context": "https://schema.org", "@graph": [ { "@type": "BlogPosting", "headline": "IT Hygiene: SPF, DKIM, and DMARC Without the Jargon", "description": "SPF, DKIM, and DMARC in plain language: what each does, why it matters, and how to move to enforcement without blocking your own mail.", "author": { "@type": "Person", "name": "Jeff Dennis", "jobTitle": "Founder & CEO", "url": "https://www.linkedin.com/in/jefferydennis", "sameAs": [ "https://www.linkedin.com/in/jefferydennis" ], "worksFor": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" } }, "datePublished": "2026-11-06T13:19:14.601918+00:00", "publisher": { "@type": "Organization", "name": "TRNSFRM", "url": "https://trnsfrm.tech" }, "image": "https://trnsfrm.tech/blog-covers/ai-phishing.jpg" }, { "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://trnsfrm.tech/" }, { "@type": "ListItem", "position": 2, "name": "Blog", "item": "https://trnsfrm.tech/blog" }, { "@type": "ListItem", "position": 3, "name": "IT Hygiene: SPF, DKIM, and DMARC Without the Jargon", "item": "https://trnsfrm.tech/blog/it-hygiene-spf-dkim-dmarc" } ] } ] } ] ```