Email authentication

Without DMARC at reject, anyone can send email as your business.

SPF, DKIM and DMARC are three DNS records that stop strangers sending mail as your domain to your clients and suppliers. Getting to p=reject safely takes a few weeks of watching reports. Here is how each works, the rollout, the mistakes to avoid, and a builder for your DMARC record.

Setup guidance from Microsoft Learn and Google, checked 31 October 2026.

Get us to p=reject Build your record 07 3114 2808

How each record works
Safe rollout
DMARC record builder

Reviewed by Blake Bath, General Manager, on 31 October 2026.

A cream envelope closed with a red wax seal on a timber desk beside a laptop — **The goal: p=reject**With every legitimate sender passing, and reports watched.

How it works

Three records, one job.

Stop others sending as your domain, and see who's trying.

SPF

Lists the services allowed to send as you. One record, 10 lookups maximum.

One record
Every sender
-all

DMARC record builder

Build the right DMARC record for today.

Works for the domains you send from and the ones you don't.

Build the DMARC record for where you are in the rollout. You get the exact DNS record and the next step.

Which kind of domain?

Where are you up to?

Subdomains

Where should reports go?

Your record

Host: _dmarc Type: TXT

v=DMARC1; p=none; rua=mailto:dmarc-reports@yourdomain.com.au;

Watch the reports for a few weeks. Find every service that sends as your domain and fix its SPF or DKIM.
When only your own services appear and they pass, move to quarantine.

Check our domain

Safely to reject

Getting to p=reject without blocking real mail.

1. List every senderMicrosoft 365 or Google, plus marketing, accounting, CRM, help desk and anything that emails as you. Microsoft suggests putting bulk mail services on a subdomain so their reputation stays separate.
2. Fix SPFOne record with every legitimate sender, under 10 lookups.
3. Turn on DKIM everywhereEach service signing with your domain.
4. DMARC at p=none, with reportsWatch for a few weeks.
5. Fix what failsAdd, sign or retire each failing source.
6. Quarantine, then rejectStep up when the reports are clean, and keep watching.

What breaks

Common mistakes.

Mistake	What happens	Fix
Two SPF records	SPF fails for everything	Merge into one record
Over 10 SPF lookups	SPF errors silently	Remove unused includes
Reject on day one	Real mail bounces	Stage the rollout
No report address	You can't see failures	Add rua=, ideally to a reporting service
Forgetting parked domains	Attackers use them	SPF -all and DMARC reject
A new service added later	Its mail starts failing	Set up SPF or DKIM before it sends

What it doesn't do

What DMARC doesn't stop.

Lookalike domainsrealbytess.com.au isn't your domain, so your DMARC doesn't cover it.
Compromised real mailboxesA hacked supplier's mail passes their DMARC.
Display-name tricksThe name can say anything; filtering and staff awareness help.

Pair DMARC with filtering, phishing-resistant MFA and phone checks on bank detail changes.

Our view

It's a few weeks of patience, then it just works.

The technical part takes an hour. The real work is finding every service that sends as you, from the accounting package to the website contact form, and getting each one to pass. Reports do that for you if you give them a few weeks.

Then reject, sub-domains covered, parked domains locked, and someone watching reports so a new service doesn't break quietly.

How we work

Our rollout in five steps.

Step 1Check
Current records and all domains you own.
Step 2Monitor
DMARC reporting at p=none.
Step 3Fix
Every legitimate sender passing.
Step 4Enforce
Quarantine, then reject.
Step 5Watch
Reports reviewed, new senders set up first.

Related guides

Email security in layers. DMARC is the first one.

What sits around email authentication.

Get help your way

Six ways to reach us. Pick whichever suits you.

Helpdesk hours are Monday to Friday, 8am to 5pm AEST. On Advantage and above, emergencies get a response within 1 hour and outages within 2, with 24/7 best-effort escalation.

Questions

What people ask about SPF, DKIM and DMARC.

What do SPF, DKIM and DMARC actually do?

SPF lists the servers allowed to send as your domain. DKIM signs each message so receivers can check it wasn't altered. DMARC tells receivers what to do when a message fails, and sends you reports on everything sending as your domain.

Can we go straight to p=reject?

Not safely. Start at p=none, read the reports, fix every legitimate sender, then move to quarantine and finally reject. Jumping straight to reject usually blocks real mail from a service nobody remembered.

Should SPF end in -all or ~all?

Microsoft recommends -all once DKIM and DMARC are in place, so DMARC can act on messages that fail SPF and have no DKIM signature. Get your sender list right first.

What about domains we own but don't use?

Publish an SPF record of v=spf1 -all and a DMARC record of v=DMARC1; p=reject; on them. Otherwise attackers can send as those domains.

Do the big mailbox providers require this now?

Google and Yahoo introduced requirements for bulk senders in 2024, and Microsoft followed for high-volume senders to Outlook.com in 2025: SPF, DKIM and DMARC. Even if you don't send in bulk, it improves delivery.

Does DMARC stop all email fraud?

No. It stops others sending as your exact domain. It doesn't stop lookalike domains or a compromised real mailbox. You still need filtering, MFA and phone checks on bank detail changes.

Next step