Two email settings you’ve probably never looked at — and why they decide whether your customers see your invoices or a scammer’s.
Right now, somewhere on the internet, it’s possible for someone to send an email that looks like it came from your company — same domain, same name — and your customers have no easy way to tell the difference. Not because your team did anything wrong, but because most business email was never built to prove who really sent it.
That’s the gap SPF and DKIM exist to close. Here’s what they actually do, in plain English, with no jargon left unexplained.
The problem: email was never designed to prove who sent it
When email was invented, nobody built in a way to check that the “From” address was genuine. Anyone can type any sender name into an email and hit send. This is why a scammer can send a fake invoice that appears to come from your finance director, or a phishing email that looks like it’s from your own domain — because technically, nothing was stopping them.
SPF and DKIM are the two main tools that fix this. Both work quietly in the background, inside your domain’s DNS settings, and most business owners never see them — until something goes wrong.
SPF: your official list of approved senders
SPF stands for Sender Policy Framework. Think of it as a guest list you publish for your domain, telling the internet exactly which mail servers are allowed to send email on your behalf.
In practice, it’s a line of text (called a DNS TXT record) added to your domain’s settings. It might list your office email provider, your accounting software, your CRM, and your email marketing tool — anything that legitimately sends mail as “yourcompany.com.”
When another mail server receives an email claiming to be from you, it checks that guest list. If the email came from a server on the list, it passes. If it came from somewhere else — a scammer’s server, for instance — it fails, and the receiving server can flag or block it.
The catch: SPF only checks where an email came from, not whether its content was tampered with in transit. That’s what DKIM is for.
DKIM: a tamper-proof seal on every email
DKIM stands for DomainKeys Identified Mail. Where SPF is a guest list, DKIM is closer to a wax seal on a letter — proof that what arrived is exactly what was sent, and that it genuinely came from your domain.
Here’s how it works: your mail server holds a private digital key that only you control. Every time it sends an email, it uses that key to attach an invisible digital signature to the message. The matching public key sits in your DNS settings, freely available for any receiving server to check.
When an email arrives, the receiving server uses that public key to verify the signature. If it matches, the receiving server knows two things for certain: the message really did come from your domain, and nothing in it was altered along the way. If the signature doesn’t match — or isn’t there at all — that’s a red flag.
Why you need both, not just one
SPF and DKIM check different things, which is exactly why relying on just one leaves a gap. SPF confirms where an email came from. DKIM confirms the message wasn’t altered and really was signed by your domain. A scammer can sometimes work around one or the other — but getting past both, on a domain properly protected by a third layer called DMARC, is a different story entirely.
That third layer is what ties SPF and DKIM together and tells receiving mail servers what to actually do when a message fails these checks — quarantine it, reject it outright, or let it through. Without DMARC, SPF and DKIM can be in place and still leave the door open, because nothing is enforcing the result.
Where most businesses actually stand
Setting up SPF and DKIM correctly — and layering DMARC enforcement on top — is the kind of task that’s easy to postpone because it doesn’t feel urgent, right up until a customer calls asking why they got a fake invoice “from” your company, or your own emails start landing in spam.
The good news is that checking where you currently stand takes under a minute, and it’s completely free.
Check your domain’s SPF, DKIM and DMARC status now →
You’ll get a plain-English score out of 5 and a clear picture of exactly what — if anything — needs fixing.
Want to go deeper on the enforcement side? Read our companion piece: What Does p=reject Mean (and Why It’s the Goal).
- Cyber Essentials vs Cyber Essentials Plus: What’s the Difference and Which Do You Need? - 13 October 2026
- What Is Payment Diversion Fraud? How It Works and How to Stop It - 6 October 2026
- Recruitment Firm Loses £90k to Phishing Email - 21 September 2026
