SPF, DKIM and DMARC are three DNS settings that help receiving mail systems decide whether a message really came from your domain. The FTC recommends them for small businesses to help prevent scammers from spoofing the sending address. Set them up in a careful order, watching reports before you enforce.
What each one does
SPF is a list of servers allowed to send mail for your domain. A receiver checks whether the sending server is on that list.
DKIM adds a signature to each outgoing message. The receiver checks the signature against a public key you publish.
DMARC tells receivers what to do when SPF or DKIM checks fail, and where to send reports about it. It is the part that ties the other two to the address people see.
The FTC's small business guidance describes using all three to help stop scammers spoofing your domain, and lists steps to take if spoofing occurs.
Why a nonprofit should care
Donors trust your name. A fake "urgent donation receipt" or "grant update" that appears to come from you damages that trust, even if your systems were never breached.
Schools face the same problem with fake notices to parents.
A safe order of work
- List every service that sends mail as your domain: your main mail platform, the newsletter tool, the donation system, the ticketing tool, the volunteer scheduler. Missed senders are the usual cause of broken delivery.
- Publish SPF covering those services.
- Turn on DKIM signing in each service that supports it.
- Publish DMARC in monitoring mode first, with a reporting address.
- Read the reports for a few weeks. Fix legitimate mail that fails.
- Move to a stricter policy once the legitimate mail passes.
Check each tool's own help pages for exact DNS records, since they differ and change.
Common mistakes
Stopping at monitoring forever. Monitoring tells you about spoofing but does not stop it.
Forgetting a sender. Your fundraising platform may send receipts in your name. If it fails DMARC after enforcement, receipts bounce.
Having no one own DNS. Many small organizations cannot say who controls the domain registration and DNS. Find out now, and put the login in a safe place with two named people.
Quick check
Do SPF, DKIM and DMARC stop phishing aimed at my staff?
Not by themselves. They help stop others from spoofing your domain. You still need training and multi-factor authentication for incoming phishing.
Sources
Last reviewed: 19 October 2026.
