Email’s core protocol was never designed to verify who a sender really is, which is why anyone can technically put your domain in the From field. SPF, DKIM and DMARC are three DNS-based mechanisms that close this gap.
SPF lists the servers allowed to send for your domain. Keep a single record, stay within the ten-lookup limit and never use “+all”. DKIM adds a cryptographic signature to every message, published under a selector in DNS; use keys of at least 2048 bits and make every sending service sign with your domain. DMARC requires SPF or DKIM to pass in alignment with the visible From address, sets a policy of none, quarantine or reject, and sends you aggregate reports.
The safe rollout: inventory every sender (mail platform, website forms, newsletter tool, CRM, invoicing), fix SPF, enable DKIM everywhere, publish DMARC in monitoring mode, review the reports, then move gradually to quarantine and reject. Protect non-sending domains with “-all” and p=reject. Major mailbox providers now effectively require these records for bulk senders. Once the basics are in place, MTA-STS, BIMI and encryption reporting add further protection and visibility.
Talk to Racoun: we are based in Istanbul and work with brands across Türkiye. Message us on WhatsApp or email ekip@racoun.com.
