A customer says they never received your invoice. Someone else reports a suspicious email that looks as though it came from your company. Neither problem automatically means your email authentication is broken, but both are good reasons to understand the controls on your sending domain.
Blue Tree Technology® has documented service work checking SPF, DKIM, and DMARC configuration for multiple legitimate sending domains and verifying that authentication reporting was active. The lesson from that work is that publishing records is only part of the job: the team must also verify the senders and the resulting reports.
Three controls, three different jobs
SPF (Sender Policy Framework) identifies which mail servers are authorized to send mail for a domain used in the envelope sender. Think of it as an approved-sender list.
DKIM (DomainKeys Identified Mail) adds a cryptographic signature so a receiving system can verify that a message was signed by a domain and certain contents were not altered after signing.
DMARC (Domain-based Message Authentication, Reporting, and Conformance) checks whether SPF or DKIM passes in alignment with the visible From domain. It also lets a domain owner publish a policy and receive aggregate reports.
Why “we use Microsoft 365” is not the complete answer
Email may also come from your CRM, accounting platform, newsletter provider, appointment tools, or a website contact form. Those services must be inventoried before enforcing a stricter policy. Otherwise, legitimate messages can be affected when receiver systems apply DMARC policy.
A safer rollout sequence
- Identify every legitimate source of mail for the business domain.
- Configure and verify SPF and DKIM for those systems, following vendor-specific instructions.
- Publish DMARC with reporting and review the results to understand legitimate versus unauthorized senders.
- Fix alignment problems, including third-party sending services, before tightening enforcement.
- Move deliberately toward a suitable enforcement policy and keep monitoring as vendors change.
What DMARC does not do
DMARC does not guarantee that every genuine email lands in the inbox. It also does not stop a criminal from using a different, lookalike domain or a compromised legitimate mailbox. Email filtering, user awareness, and account security still matter.
A completed DNS change should be followed by verification, not a declaration that spoofing or phishing is impossible.
Common questions
Should we start immediately with p=reject?
Not without checking legitimate senders and alignment first. Organizations commonly use reporting to understand the impact before enforcing a more restrictive policy.
Does DMARC fix spam placement?
It can help establish domain authentication, but deliverability also depends on sending practices, content, reputation, and recipient filtering.
Plan the next step
Want to know whether your domain is configured correctly? Start with Blue Tree Technology®’s email-deliverability assessment or ask for a reviewed authentication plan.