By default, there is nothing stopping someone sending email that claims to come from your domain. The sender address in an email is as trustworthy as the return address written on an envelope — it is simply text, chosen by whoever sent it.
This is why invoice fraud works. The message appears to come from your finance team, to your customer, with your signature block. Three DNS records exist to close that gap, and they only work together.
A Sender Policy Framework record lists the mail servers authorised to send on your domain's behalf. A receiving server checks whether the connecting server appears on that list.
The common failure is drift. Marketing signs up for a mail platform, someone adds a helpdesk tool, an ERP starts sending invoices — and each addition either goes unrecorded, or pushes the record past the ten-lookup limit that causes SPF to fail silently. Audit what actually sends as your domain before writing the record; the list is almost always longer than expected.
DomainKeys Identified Mail adds a cryptographic signature to outbound messages. The receiver retrieves your public key from DNS and verifies the signature, which confirms both that the message came from an authorised system and that its content was not modified in transit.
SPF alone breaks when mail is forwarded — the forwarding server is not on your list. DKIM survives forwarding, which is why both matter.
DMARC ties the two together. It tells receiving servers what to do with mail that fails authentication, and — critically — it requires alignment: the domain that passed SPF or DKIM must match the domain the user actually sees.
DMARC has three policies:
Only p=reject actually stops domain spoofing. A great many domains publish p=none, consider the work finished, and remain fully spoofable.
The reason organisations stall at monitoring is a legitimate fear: move to reject too early and real business mail disappears. The path is incremental.
Most domains can reach enforcement in six to eight weeks. The work is inventory and coordination rather than technical difficulty.
An enforced DMARC policy means an attacker cannot send mail that appears to originate from your domain. It does not stop lookalike domains, and it does not stop a compromised mailbox — but it removes the cheapest, most convincing impersonation route, and it improves deliverability of your genuine mail as a side effect.
We take clients from audit through to p=reject as a fixed-scope engagement. Contact us if you would like your domain assessed.