# E-mail security — SPF, DKIM, DMARC setup and domain protection | RootCore LLC

> If anyone can send mail in your domain's name, it costs you your customers' trust. SPF, DKIM and DMARC setup, authentication chain audit, deliverability monitoring.

Page: https://cyber-security.rootcr.com/en/email-security/
Updated: 2026-08-20

---

# E-mail security and domain authentication

> **In short:** SPF, DKIM and DMARC together tell the receiving mail system whether a message really came from your domain. If those three are not in order, anyone can send mail in your company's name, while your own mail disappears into the spam folder. Setting them up is a one-off job, and the benefit shows immediately in deliverability.

## Why does this matter even if you do not send newsletters?

Because the attack is not aimed at your mailbox — it is sent in your name. The most common case: someone writes from your company domain to your accountant or your customer about a changed bank account number. The recipient checks the sender, and the sender looks right.

Missing authentication also punishes your own mail. The large providers have been tightening for years: without authentication a message first lands in spam, and then stops arriving at all.

## What are these three records?

| Record | What it states | What happens without it |
|---|---|---|
| SPF | Which servers may send mail for the domain | Anyone can send in your name |
| DKIM | The signature that proves the message was not altered | Mail can be modified or forged in transit |
| DMARC | What the recipient should do when the first two fail | The recipient guesses — usually it lets the mail through |

DMARC also asks for reports: it shows who is sending mail in your domain's name. For most clients, that first report is where the surprise turns up.

## What exactly do we do?

1. **Inventory.** We find out which systems legitimately send mail for the domain: mail provider, web shop, invoicing, newsletter tool, CRM.
2. **Fixing SPF.** One valid record with the senders that are needed — without the usual mistakes (multiple records, too many lookups, a catch-all soft ending).
3. **Enabling DKIM** on every sending system, with its own key.
4. **Rolling out DMARC in stages:** monitoring mode with reports first, then tightening to quarantine and finally to reject based on what the reports show.
5. **Verification.** Test messages to the major providers, headers measured back, and a written summary of where everything stands.

## How long does it take and what will I see?

Setting the records up is typically one or two days, with a few hours of DNS propagation. Tightening DMARC is deliberately slower: the monitoring phase runs until every legitimate sender has appeared in the reports — typically two to four weeks. Skipping that step would throw away your own invoicing mail.

## Frequently asked questions

### My hosting provider already set this up — is that not enough?

Hosting providers typically add a basic SPF record for their own server. That works if all your mail leaves from there — but the shop, the invoicing tool and the newsletter system usually send from elsewhere. The missing senders are exactly the ones that get stuck.

### Will DMARC throw away my own mail?

It can, if we set it to reject straight away. That is why we start in monitoring mode: nothing changes in delivery, we only receive reports. Tightening comes only once every legitimate sender shows up in them.

### How do I know somebody is abusing my domain?

From the DMARC reports. They show which servers sent mail in your name and which ones failed authentication. We set the reporting up and show you how to read it.

### Do you see the contents of my mail?

No. The work touches DNS records and the configuration of sending systems, not mailboxes. A DMARC report contains aggregated data about sending, not message text.