A convincing fake email sent in your company’s name can do more damage than a badly timed outage. It can send a client’s payment to the wrong bank account, persuade a colleague to share a password, or quietly erode trust in your business. Email authentication setup is the work that makes it far harder for criminals to impersonate your domain - while helping genuine messages reach inboxes rather than junk folders.
For a small business, this is not a nice technical extra. Google, Microsoft and other major providers increasingly expect senders to prove who they are. If your business relies on Microsoft 365 for client correspondence, invoices, appointment reminders or marketing, getting the basics right protects both your reputation and your ability to communicate.
What email authentication actually does
Email authentication is often described in language that makes it sound more complicated than it needs to be. In practical terms, it places checks around your domain name, such as yourcompany.co.uk, so receiving email systems can assess whether a message really came from an approved sender.
The three main controls are SPF, DKIM and DMARC. They work together, but they do different jobs.
SPF is a published list of systems allowed to send email using your domain. This might include Microsoft 365, your website contact-form service, a finance platform that sends invoices, or a marketing system. When an email arrives, the recipient’s provider can check whether it came from one of those approved sources.
DKIM adds a digital signature to outgoing emails. The receiving server checks that signature against a public record held in your domain settings. If the email was altered in transit, or the sender cannot prove it has the correct signing key, the check fails.
DMARC tells receiving providers what to do when SPF or DKIM does not line up with your domain. It also gives you reporting, so you can see who is attempting to send as your business. This is the policy layer that turns separate technical checks into a meaningful defence against spoofing.
None of these controls makes every malicious email disappear. Criminals can still send messages from lookalike domains, such as swapping one letter in your company name. However, they make direct impersonation of your real domain much more difficult and give receiving systems a stronger reason to trust legitimate mail.
Email authentication setup: get the groundwork right
The records for SPF, DKIM and DMARC sit in your DNS, which is the public directory for your domain. That may be managed through your domain registrar, website host, Microsoft 365 partner or another provider. Before changing anything, establish who has access and make a record of the current settings.
This matters because DNS is not a place for trial and error. One incorrect character can stop a service sending mail, and replacing an existing SPF record instead of updating it can accidentally remove permission for a critical platform.
Start by listing every service that sends email as your domain. Do not just think about staff sending from Outlook. Check your website forms, CRM, accounts package, recruitment tool, booking system, copier or scanner, marketing platform and any outsourced provider that sends on your behalf. A business may believe it only sends through Microsoft 365, then discover that monthly statements or website enquiries come from somewhere else.
The goal is simple: every legitimate sender is known, and every unknown sender is treated with suspicion.
Set up SPF carefully
A domain should have one SPF record, not several. That single record can include multiple approved senders. Multiple SPF records often cause a ‘permerror’, meaning the recipient cannot reliably validate the message.
The common mistake is to add each new supplier’s suggested SPF record as a separate entry. Instead, its authorised sending mechanism normally needs to be incorporated into the existing record. The precise wording depends on the supplier, which is why copying values from an online forum is a poor substitute for checking the provider’s current instructions and your existing configuration.
SPF also has a technical lookup limit. If you keep adding services without reviewing the record, it can become too complex to evaluate. For smaller businesses this is usually manageable, but it is one reason the sender inventory should be maintained rather than forgotten.
Enable DKIM for Microsoft 365 and other senders
For Microsoft 365, DKIM generally involves creating DNS records provided by Microsoft, then enabling signing in the Microsoft 365 admin settings. Once active, emails sent through the platform carry a signature that recipient systems can verify.
Other services may require their own DKIM records. Marketing platforms commonly do this, and it is worth completing properly. Sending a newsletter from your own domain without authentication can harm deliverability, particularly if recipients rarely engage with it.
DKIM is not a switch you set once and never revisit. If you change email platforms, domain providers or third-party senders, check that signing still works. A domain migration can leave old records behind or remove records that were doing useful work.
Introduce DMARC in stages
DMARC is where many businesses either stop too early or go too hard, too quickly. A DMARC record can ask providers to take no action, quarantine suspicious messages, or reject them outright.
Starting with a monitoring policy is sensible. It allows you to receive reports and identify genuine services that have not yet been included in your SPF or DKIM setup. This is especially useful where older systems send automated emails and no one remembers they exist.
Once the reports show that legitimate mail is passing authentication, the policy can be tightened. Quarantine is a cautious next step, directing failed mail towards junk handling. Reject is the strongest setting and tells receiving providers not to accept messages that fail the checks.
The right pace depends on your business. A company with a straightforward Microsoft 365 setup may progress quickly. A business with several legacy applications, external marketing support and specialist finance software needs more observation first. Rejecting fraudulent mail is the aim, but rejecting your own invoices or client updates is not a success.
Common problems that undermine good work
Forwarding can cause confusion. When a message is forwarded from one mailbox to another, SPF may fail because the forwarding server is not on the original sender’s approved list. DKIM can often still validate, provided the message was not modified. This is one reason SPF alone is not enough.
Another issue is the ‘From’ address. DMARC checks alignment: the domain visible to the recipient should align with the domain validated by SPF or DKIM. A supplier may technically send a message, but if it uses a mismatched domain arrangement, DMARC can fail. This needs resolving at source rather than simply weakening your policy.
Website contact forms deserve particular attention. Poorly configured forms sometimes pretend to send from the person completing the form, even though that person uses a Gmail or Outlook.com address. This can fail authentication and increase the chance that a genuine enquiry lands in junk. A better arrangement sends from an address on your own domain and uses the visitor’s address as the reply-to field.
Finally, do not confuse authentication with complete email security. SPF, DKIM and DMARC help prove identity. They do not scan a malicious attachment, block every phishing link or stop an employee approving a fraudulent request. You still need sensible spam filtering, multi-factor authentication, controlled access, backups and staff who know how to question an unusual payment request without feeling daft for asking.
Who should own the ongoing checks?
This work crosses several suppliers: whoever manages your domain, Microsoft 365, website and business applications. That split responsibility is where gaps appear. One provider says the records are not theirs; another says the mail platform is working; meanwhile, a director finds out a key client has not received an email.
Assign clear ownership. Keep a short record of your domain registrar, DNS access, authorised sending services, DMARC policy and the person responsible for approving changes. Review it when you add a new platform, launch a marketing campaign, change website hosts or move email providers.
For businesses without an in-house IT team, this is the kind of practical housekeeping a managed provider should handle without turning every adjustment into a surprise invoice. At DS Business Hub, the focus is on explaining what has changed, checking it works and leaving the business with a setup that is secure without becoming fragile.
A well-configured domain will not make your business invisible to fraudsters. It does make it much harder for them to borrow your name. That is a worthwhile safeguard every time a client decides whether to trust the email in front of them.