Email Security for Businesses: SPF, DKIM and DMARC Explained (+ Step-by-Step Plan)

Email Security for Businesses: SPF, DKIM and DMARC Explained (+ Step-by-Step Plan)

Email is still the most important communication channel for businesses, but it is also cybercriminals' favourite target. With the right email security through SPF, DKIM and DMARC, you protect your organisation and stop criminals from sending emails in your company's name. In this article, we explain the three protocols in plain English and give you a concrete step-by-step plan.

Key takeaways (TL;DR)

• 58% of Dutch businesses faced phishing by email - it remains the number-one attack vector
• Only 13% of Dutch organisations use DMARC correctly - the lowest percentage of all countries surveyed
• SPF, DKIM and DMARC together form three layers of email security that drastically reduce spoofing and phishing
• Google and Yahoo have required DMARC for bulk senders since February 2024 - without DMARC, your emails end up in spam
• Implementation takes 3-4 months from audit to full protection with the right plan
• DMARC reports show you who is sending emails on behalf of your domain

Why email is the number-one attack vector

Recent research shows that 58% of Dutch businesses faced phishing by email in the past year. In addition, 80% of the organisations surveyed say that email spoofing is holding steady or even increasing.

The reason is simple: the original email protocol (SMTP) dates from the 1980s and has no built-in authentication. Technically, anyone can send an email using any sender address they like. Without additional email security, a criminal can send a message that looks as if it comes from your CEO or a supplier.

This problem is made worse by AI-driven phishing attacks, which are becoming ever more convincing. Modern attacks are barely distinguishable from the real thing.

The Dutch DMARC problem

The Netherlands performs remarkably poorly on email security. Only 13% of Dutch organisations have a correct DMARC configuration - the lowest percentage of all countries surveyed. Even more worrying: 41.5% have no DMARC record at all.

That means almost half of all Dutch business domains are vulnerable to email spoofing. The NIS2 Directive sets stricter requirements for digital resilience, and email security explicitly falls within them. Waiting is no longer an option.

SPF explained: who may send email on behalf of your domain?

SPF (Sender Policy Framework) is the first line of defence. It works like a guest list: using a DNS TXT record, you specify which mail servers are authorised to send email on behalf of your domain.

An example SPF record:

v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all

This record says: only Microsoft 365 and Google Workspace may send email for this domain. The -all means that all other servers are rejected.

The limitation of SPF: it only checks the technical sender address (envelope-from), not the visible "From" address the recipient sees. That is why you need DKIM and DMARC as well.

DKIM explained: a digital signature for your email

DKIM (DomainKeys Identified Mail) adds a digital signature to every outgoing email. This lets the receiving server verify that the email really comes from your domain and has not been altered in transit.

DKIM uses a public-private key pair:

1. Private key - stored on your mail server, signs every outgoing email
2. Public key - published as a DNS record so recipients can verify the signature

DKIM proves two things: the email genuinely comes from your domain, and its content was not changed in transit. If you use Microsoft 365, you can enable DKIM through the Exchange admin center.

DMARC explained: the complete picture

DMARC (Domain-based Message Authentication, Reporting & Conformance) is the final piece of your email security. It combines SPF and DKIM and adds a policy layer that determines what should happen when authentication fails.

The three DMARC policy levels

An example DMARC record:

v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@yourdomain.com; pct=100

Reading DMARC reports

By setting the rua field, you receive daily XML reports from receiving mail servers. These show which servers are sending email on behalf of your domain and whether the SPF and DKIM checks pass. In the initial phase with p=none, you use these reports to identify legitimate services (marketing tools, CRM systems, ticketing software). That way, you avoid blocking legitimate email when you tighten the policy.

Step-by-step plan: from zero to full email security

A successful DMARC implementation does not happen in a day. Below is a proven roadmap.

Week 1: Audit your current status

• Check whether your domain already has SPF, DKIM and DMARC records
• Use free tools such as MXToolbox to analyse your current configuration
• Make an inventory of all services that send email on behalf of your domain

Weeks 2-3: Configure SPF and DKIM

• Set up a complete SPF record that includes all authorised mail servers
• Enable DKIM signing on your mail server or with your email provider
• Test both configurations with online validation tools

Week 4: Put DMARC into monitoring mode

• Set up a DMARC record with p=none
• Configure the rua address to receive reports

Months 2-3: Analyse and optimise

• Analyse the DMARC reports to identify all legitimate email sources
• Add any missing servers to your SPF record and fix DKIM issues

Month 4+: Tighten the policy

• Move up to p=quarantine and monitor the results
• After a stable period: switch to p=reject for maximum email security

Google and Yahoo require DMARC

Since February 2024, Google and Yahoo have required bulk senders (more than 5,000 emails per day) to have a valid DMARC record. Without DMARC, your emails may not be delivered or may end up in spam.

Even if you are not a bulk sender, DMARC is essential. More and more email providers use DMARC as a signal for domain reputation. Combine DMARC with multi-factor authentication on all your email accounts for an even stronger layer of security.

Beyond SPF, DKIM and DMARC: advanced email security

SPF, DKIM and DMARC are the foundation, but complete protection takes more:

• Advanced Threat Protection (ATP): scans attachments and links in real time for malware and phishing
• Sandboxing: opens suspicious attachments in an isolated environment to detect zero-day threats
• Security awareness training: teaches your employees to recognise phishing, including emails that pass every technical check

A sound cybersecurity strategy combines technical measures with awareness. Technology catches a lot, but the human factor remains the weakest link.

TRON Group: Email Security as Part of Your Managed IT

At TRON Group, we do not see email security as a standalone project but as an integral part of your complete managed IT. Our approach includes:

• A full audit of your current email security and DNS configuration
• Implementation of SPF, DKIM and DMARC following a proven step-by-step plan
• Continuous monitoring of DMARC reports and proactive adjustments
• Integration with Microsoft 365 Defender and advanced threat protection

We guide you from p=none to p=reject without losing any legitimate email.

How does your email security measure up?

Take the free TRON Quick Scan to have your current SPF, DKIM and DMARC configuration analysed.

Call us on +31 85 303 5869 for a no-obligation conversation, or book an appointment through our contact page. You can also read more about our team and our approach to discover why more than 200 businesses trust TRON Group with their IT security.