DMARC, SPF, DKIM & ARC: How to Protect Your Domain and Mailboxes from Abuse for Good

Email is still the most important means of communication for businesses. But without protection mechanisms, domains are easy targets for spam, phishing and identity theft. The consequences range from damage to your image and lost revenue to legal problems.

The good news: With the right settings – SPF, DKIM, DMARC and ARC – plus complementary standards such as MTA-STS or BIMI, you secure your domain reliably and boost the credibility of your brand at the same time.

1) Email security – explained simply

Think of your domain as a digital ID card.
Without protection, anyone on the internet can theoretically pretend to be you – and send emails in your name.

• SPF is the bouncer’s guest list: Only the servers you list are allowed to send mail.
• DKIM is the digital stamp: Every email is signed so that nobody can alter it along the way.
• DMARC is the rule: What should happen when someone tries to spoof you – block, flag or let it through?
• ARC is the forwarding label: Even when emails are forwarded, it stays clear that the message is genuine.

It quickly becomes clear: This technology is not a luxury, but basic protection for every domain.

2) Why does this matter?

If your domain is abused for spam or fraud, this is what happens:

• Your genuine emails land in your customers’ spam folders.
• Google, Microsoft & co. rate your domain as unsafe.
• In the worst case, you are blocked completely.

A bad reputation online is like in real life: It arrives quickly – but is very hard to get rid of.

3) Expert knowledge: the basic technology

• SPF (Sender Policy Framework): DNS record that defines which servers may send on your behalf.
• DKIM (DomainKeys Identified Mail): Digital signature in the email header that prevents tampering.
• DMARC (Domain-based Message Authentication, Reporting & Conformance): Controls how recipients handle emails that fail SPF/DKIM.
• ARC (Authenticated Received Chain): Preserves authentication even for forwarded emails and mailing lists.

Large mailbox providers such as Gmail and Yahoo have required SPF, DKIM and a DMARC policy from bulk senders since 2024 – a must for newsletters and marketing emails.

4) Step by step: how the pros implement it

SPF (TXT record)

v=spf1 include:spf.protection.outlook.com include:_spf.google.com -all

• List only permitted servers
• Block everything else with -all

DKIM (TXT selector._domainkey)

v=DKIM1; k=rsa; p=MEgC...AB

• Use a separate key for each sending route
• Rotate regularly

DMARC (TXT _dmarc)

Phase 1 (monitor):

v=DMARC1; p=none; rua=mailto:dmarc@domain.de

Phase 2 (quarantine):

v=DMARC1; p=quarantine; rua=mailto:dmarc@domain.de

Phase 3 (reject):

v=DMARC1; p=reject; rua=mailto:dmarc@domain.de

ARC

• Enable on the mail server/relay
• Especially important for mailing lists and forwarding

5) Securing transport: MTA-STS & TLS-RPT

• MTA-STS forces email servers to accept only encrypted connections.
• TLS-RPT delivers reports on encrypted deliveries – ideal for monitoring.

6) Bonus: strengthening your brand with BIMI

With BIMI, your logo is displayed right in the inbox – provided your emails pass DMARC and SPF/DKIM.
This increases trust and brand recognition.

7) Holistic protection for mailboxes

• Enable strong passwords & 2FA
• No access via old protocols (POP3 without TLS, old IMAP clients)
• Enable DNSSEC to prevent tampering in DNS
• Monitoring: evaluate DMARC reports, check spam rates
• Training: educate employees about phishing regularly

Common mistakes

Checklist: go-live in 10 points

1. Set up SPF cleanly
2. Enable DKIM for each sending route
3. DMARC on “none”, review reports
4. After 2–4 weeks: quarantine
5. Later: reject for full security
6. Enable ARC
7. Set up MTA-STS & TLS-RPT
8. Turn on DNSSEC
9. 2FA for all mailboxes
10. Optional: BIMI for visible brand trust

How I adjust the DNS records

For BIMI (and also SPF, DKIM, DMARC) to work, the corresponding records must be stored in the DNS of your domain. That sounds complicated, but it is set up similarly at most hosts.

1. Log in to your customer account

• Log in with the provider where your domain is registered (e.g. IONOS, Strato, ALL-INKL, HostEurope, GoDaddy, Cloudflare).

2. Open DNS management

• The section is usually called “DNS settings”, “Manage domain” or “Edit zone file”.
• There you will see existing records (A, MX, TXT, etc.).

3. Create a new TXT record

• Click “Add record”.
• Choose TXT as the type.
• Under “Name”, enter the appropriate prefix (e.g. _dmarc, default._bimi).
• In the “Value” field, paste the complete record you have prepared (e.g. a DMARC or BIMI record).

4. Save and wait

• Save the change.
• DNS changes take up to 24 hours, but they are often active after just a few minutes.

Examples for common hosts

• IONOS: Menu item Domains → DNS. Add the TXT record here.
• Strato: Domain management → DNS settings → TXT records.
• ALL-INKL: Domain management (KAS) → DNS Settings.
• HostEurope: Domain Administration → DNS → Resource Records.
• GoDaddy: Domain → Manage DNS → Add TXT.
• Cloudflare: DNS → Records → Add Record.

Tip: Take a screenshot of the existing DNS records before making changes – that way you can always go back in an emergency.

Conclusion

With SPF, DKIM, DMARC and ARC, you protect your domain from abuse, keep spam away from your customers and secure your brand for the long term. Complementary standards such as MTA-STS, TLS-RPT and BIMI complete your setup.

This way you make sure your communication arrives reliably, your domain stays credible – and your customers can trust you.

Realmaker – creative agency for film & web supports you not only with design, film and web projects, but also with the technical foundation of your digital communication.