Cybersecurity · Email security
A step-by-step guide to SPF, DKIM and DMARC for Microsoft 365 and Google Workspace, including how to read reports and when to tighten the policy.
List every service that sends mail
Monitor first, then quarantine
Reach p=reject without lost mail
30 minutes of data collection, your report the next day, yours to keep with no obligation. Or pick a time now. Or call 954-539-5678.
To set up DMARC, publish a DNS TXT record at _dmarc.yourdomain.com with a value such as v=DMARC1; p=none; rua=mailto:[email protected]. Before you do, make sure every service that sends mail as your domain passes SPF or DKIM with your domain. Then read the daily aggregate reports, fix any legitimate sender that fails, and tighten the policy in stages: p=none, then p=quarantine, then p=reject. Microsoft’s own guidance recommends exactly this gradual rollout so you do not block real mail.
Done in that order, most small businesses can reach p=reject in a few weeks to a few months without anyone noticing, except the people trying to spoof you.
A message passes DMARC if either SPF or DKIM passes and aligns. That is why a newsletter tool can pass SPF with its own domain and still fail DMARC for yours.
Google requires anyone sending more than 5,000 messages a day to Gmail users to have SPF, DKIM and a DMARC record with at least p=none, plus alignment. Microsoft announced similar requirements for high-volume senders to Outlook.com, Hotmail and Live addresses starting in May 2025. Even if you send far less, DMARC at enforcement is what stops criminals from sending invoices that appear to come from your exact domain to your customers and vendors.
Most DMARC problems come from senders nobody remembered. Check for:
You may have only one SPF record per domain. A typical Microsoft 365 record looks like v=spf1 include:spf.protection.outlook.com -all, and Google Workspace uses include:_spf.google.com. Add an include for each other service that sends from your domain’s envelope address.
DKIM matters more than SPF for DMARC because it survives forwarding, which breaks SPF.
At your DNS host, add a TXT record with the host name _dmarc and a value like:
v=DMARC1; p=none; rua=mailto:[email protected]
In GoDaddy, for example, open your domain’s DNS records, choose Add, select TXT, enter _dmarc as the name and paste the value. Other hosts work the same way. Have only one _dmarc record. Use a shared mailbox or a DMARC reporting service for the rua address, not someone’s inbox. Skip the ruf (forensic) tag at first; Microsoft notes many receivers do not send those reports and they can be noisy.
Is your email domain easy to spoof today? Our free Technology Health Assessment takes about 30 minutes of data collection. The next day you get a plain-language report on your cybersecurity and IT operations, including email security, with a short list of next steps in order. It is yours to keep, with no obligation. Book your assessment.
Aggregate reports arrive as compressed XML files, typically once a day from each receiver. A reporting tool turns them into a table of sending sources. For each source, ask three questions:
Expect some failures from forwarded mail and mailing lists. Those are normal. Review reports weekly during rollout, then monthly once stable.
When every legitimate source passes and aligns for a few weeks, change the policy to p=quarantine. You can ramp with the pct tag, for example pct=10, then 25, 50 and 100, to apply the policy to a growing share of failing mail. Watch reports and listen for users who say a partner did not get a message.
After a stable period at quarantine, change to p=reject. Receivers that honor it will refuse spoofed messages outright. Microsoft suggests starting with low-volume subdomains and doing the main domain last.
If mail does start bouncing after a policy change, step back one stage, find the failing source in the reports, fix it and move forward again. A one-level rollback costs nothing.
Email security, including authentication, is part of JLB USA’s cybersecurity services. If you use Microsoft 365, pair this with the controls in our guide to Microsoft 365 security settings for small businesses.
Book it now
Choose a slot that suits you. We’ll confirm by email, collect the data with you on the call, and send your report the next day. It’s free, and the report is yours to keep with no obligation.
Prefer to talk first? Call 954-539-5678, or send the form and we’ll contact you.
Start with v=DMARC1; p=none; rua=mailto:[email protected] published as a TXT record at _dmarc.yourdomain.com. It changes nothing about delivery but starts sending you daily aggregate reports.
Long enough to see every legitimate sender pass and align, usually a few weeks of clean reports. Microsoft recommends a gradual rollout through p=none and p=quarantine before p=reject, rather than a fixed number of days.
Google’s DMARC requirement applies to bulk senders, but any business benefits. DMARC at quarantine or reject stops criminals from sending messages that appear to come from your exact domain.
Usually because of alignment. A third-party tool may pass SPF using its own domain, which does not match your From address. Have the tool sign DKIM with your domain or use your domain for its bounce address.
Open your domain’s DNS records, choose Add, select TXT, enter _dmarc as the name, paste your DMARC value and save. Make sure only one _dmarc record exists.
