Last updated: 9 November 2026
Set up SPF, DKIM and DMARC correctly on your domain, then move DMARC to a strict policy once the reports show your genuine email is passing. Without them anyone can send email that appears to come from your company name. ABCOM manages this for UK businesses from £25 per domain per month plus VAT, and you can check your own domain free in seconds.
Why this matters
Anyone can type your company name into the From field of an email. Unless your domain publishes the right records, receiving systems have no way to tell a genuine message from a fake invoice sent in your name. Setting the records up properly also helps your real emails reach inboxes, because Gmail, Yahoo and Microsoft now expect them from larger senders.
SPF
Lists the servers allowed to send email for your domain.
DKIM
Adds a digital signature, so a receiver can see the message was not altered and came from you.
DMARC
Tells receivers what to do with email that fails, and sends you reports about who is using your domain.
Reports
Shows every service sending as you, including ones you forgot, such as invoicing or marketing tools.
Enforcement
Moving to quarantine, then reject, so fake emails are blocked or sent to spam.
Ongoing care
Records need updating when you add or remove a sender. Mistakes can stop genuine email arriving.
The DMARC policies
| Policy | What happens to failing email | When to use it |
|---|---|---|
| None | Delivered as normal, but you receive reports | First, to see who sends as you |
| Quarantine | Usually sent to spam | Once genuine senders pass |
| Reject | Refused by the receiver | The goal, when reports are clean |
How it is done safely
- Check what is published today, with a free domain scan.
- Publish DMARC in monitoring mode and collect reports for a few weeks.
- Fix every genuine sender that fails, usually by adding DKIM.
- Move to quarantine, then to reject.
- Keep monitoring, because new tools and suppliers appear all the time.
Check your domain now. It is free, takes seconds and changes nothing on your systems.
How ABCOM helps
We set up and manage SPF, DKIM and DMARC for your domains from £25 per domain per month plus VAT, read the reports and move you to a strict policy without stopping genuine email. See Email Domain Protection, or read why it also helps against invoice fraud.
Quick answers
What is the difference between SPF, DKIM and DMARC?
SPF lists who may send for your domain. DKIM signs each message. DMARC ties them together, sets the policy for failures and sends you reports. You need all three.
Will this stop all fake emails?
It stops criminals using your exact domain. It does not stop look-alike domains, such as a name with one letter changed, so staff training and email filtering still matter.
Could this stop our own email arriving?
Yes, if it is done carelessly, which is why we start in monitoring mode and fix genuine senders before enforcing.
Is it required by law?
Not for most private businesses, but the NCSC recommends it, many insurers and customers ask about it, and large mailbox providers expect it from bulk senders.
Not sure if your domain can be spoofed? Run the free check, or talk to us.
Related answers and guides
- Can ABCOM manage our domain names?
- Why DMARC, DKIM and SPF matter
- What is business email compromise?
- What do cyber insurers require?
- All ABCOM FAQs
Sources and further reading
Related questions
Want this sorted for you?
Talk to our Burgess Hill team about managed IT support. Free, friendly and no obligation.