Email Authentication Checklist for Small Businesses (2026)

Most small businesses set up email once, when the domain was registered, and haven't looked at it since. Meanwhile Gmail, Yahoo and Outlook.com have turned authentication from a nice-to-have into a delivery requirement, and spoofed invoices sent "from" small companies are a routine fraud. This checklist puts everything on one page: what to publish, in what order, and how to confirm each item works. Most of it can be done in an afternoon. The DMARC rollout takes a few weeks.

AI Automation for Accounting Firms, Explained Step by Step · 3:03 Subscribe

Before you start: list everything that sends as you

Authentication fails most often because of a sender nobody remembered. Write down every system that sends email with your domain in the From: address:

• Your mailboxes (Google Workspace, Microsoft 365, or your host's email)
• Newsletter or marketing platform
• CRM and sales tools
• Help desk or ticketing system
• E-commerce platform (order confirmations, shipping notices)
• Invoicing, accounting and payment tools
• Website forms, booking plugins and WordPress notifications
• Office devices that email (scanners, printers)

You'll use this list for every step below. Once DMARC reports are flowing, they'll show you anything you missed.

Level 1: the essentials (every business)

1. One SPF record

• Exactly one TXT record on your root domain starting with v=spf1
• Includes every service on your list that uses your domain as the envelope sender
• 10 DNS lookups or fewer, counting nested includes
• Ends with ~all or -all, never +all

example.com.  TXT  "v=spf1 include:_spf.google.com include:sendgrid.net ~all"

Take include values from each provider's current documentation. Details: what an SPF record is and fixing too many DNS lookups.

2. DKIM for every sending service

• DKIM signing turned on in your mailbox provider (published and enabled)
• Each third-party sender set up to sign as your domain (look for "domain authentication" or "custom DKIM")
• 2048-bit keys where possible (1024 is the minimum Gmail and RFC 8301 accept)
• A reminder to rotate keys at least every six months, as M3AAWG recommends

google._domainkey.example.com.  TXT  "v=DKIM1; k=rsa; p=MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA..."

Details: what is DKIM.

3. A DMARC record with reporting

• TXT record at _dmarc.example.com
• Starts at p=none with a rua reporting address
• Reports going to a dedicated mailbox or a DMARC reporting service

_dmarc.example.com.  TXT  "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"

p=none meets the minimum DMARC requirement at Gmail, Yahoo and Outlook.com. It doesn't block spoofing yet, which is what Level 2 is for. Details: DMARC explained.

4. Verify with a real message

• Send a message from each service on your list to a Gmail address
• Show original reads SPF: PASS, DKIM: PASS with domain example.com, DMARC: PASS
• DKIM passes for your domain, not the vendor's

Or run a free audit: the Email section checks SPF, DKIM, DMARC, MTA-STS and BIMI in one scan and lists anything missing or broken in a prioritized fix list.

Level 2: stop spoofing (within a few weeks)

5. Read your DMARC reports

• Every legitimate source shows DKIM or SPF aligned pass
• Vendors failing alignment have been fixed, not just added to SPF
• Unknown sources failing both checks noted as likely spoofing

Details: how to read DMARC reports.

6. Move DMARC to enforcement

• p=quarantine once reports look clean
• p=reject after a few more weeks without problems
• np=reject to cover made-up subdomains (supported in the new RFC 9989 DMARC standard)
• Old pct values removed or left at 100. RFC 9989 replaces pct with t=y for testing

_dmarc.example.com.  TXT  "v=DMARC1; p=reject; np=reject; rua=mailto:dmarc-reports@example.com"

7. Lock down domains that never send email

Spoofers love parked and redirect-only domains because nobody watches them. For each one (Microsoft and the UK NCSC give this same recipe):

• SPF that authorizes nobody
• DMARC at p=reject
• Optional: a wildcard empty DKIM record, and a null MX if the domain doesn't receive mail

parked-example.com.                  TXT  "v=spf1 -all"
_dmarc.parked-example.com.           TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
*._domainkey.parked-example.com.     TXT  "v=DKIM1; p="
parked-example.com.                  MX   0 .

If the rua address is on a different domain from the parked one, that domain needs an authorization record (parked-example.com._report._dmarc.example.com TXT "v=DMARC1"). Otherwise reports for the parked domain are skipped.

Level 3: bulk senders (marketing email at volume)

If you send close to 5,000 messages a day to Gmail or more than 5,000 to Outlook.com, or any meaningful marketing volume to Yahoo, these are requirements, not suggestions. Full details: Gmail, Yahoo and Microsoft sender requirements.

• SPF and DKIM both pass (Outlook.com requires both)
• From: domain aligned with SPF or DKIM
• DMARC published (at least p=none)
• One-click unsubscribe headers on marketing mail:

List-Unsubscribe: <https://example.com/unsubscribe/abc123>
List-Unsubscribe-Post: List-Unsubscribe=One-Click

• Visible unsubscribe link in the body
• Unsubscribes processed within 2 days
• Spam complaint rate below 0.3% (Google recommends under 0.1%)
• Google Postmaster Tools set up; Microsoft SNDS and Yahoo's Complaint Feedback Loop considered
• Valid reverse DNS (PTR) on sending IPs, if you run your own servers

Level 4: extra protection and branding

8. TLS-RPT and MTA-STS

• TLS-RPT record to receive reports on encrypted delivery to your domain:

_smtp._tls.example.com.  TXT  "v=TLSRPTv1; rua=mailto:tls-reports@example.com"

• MTA-STS policy hosted at https://mta-sts.example.com/.well-known/mta-sts.txt, started in testing mode
• _mta-sts TXT record published with an id you change whenever the policy changes
• Switched to enforce after a clean testing period

Details: MTA-STS and TLS-RPT setup.

9. BIMI (optional)

• DMARC at quarantine or reject on the organizational domain
• Logo converted to SVG Tiny PS
• VMC (registered trademark) or CMC (prior logo use) if you want the logo in Gmail
• default._bimi TXT record published

Details: BIMI logo in Gmail.

Ongoing: keep it working

Authentication breaks quietly. Most problems come from changes, not from the original setup.

• New tool signed up? Add its DKIM before it sends, and check the SPF lookup count before adding an include.
• Tool cancelled? Remove its SPF include and DKIM records.
• DNS host or registrar migrated? Confirm every TXT and CNAME record came across. Missing DKIM records after a migration are common.
• Weekly or monthly: glance at DMARC reports for new failing sources, and check if your domain or sending IP is on a blacklist.
• Every six months: rotate DKIM keys.
• Certificates: the mta-sts subdomain certificate renews automatically, and BIMI certificates are renewed before expiry.

If you'd rather not remember, paid plans can re-scan your domain daily or weekly and email you the results, so a dropped record shows up quickly. See pricing for what each plan includes.

Frequently asked questions

How long does this checklist take?

Level 1, plus the TLS-RPT record from Level 4, can usually be done in an afternoon, depending on how many sending services you have. Moving DMARC to p=reject takes longer because you need a few weeks of reports to confirm nothing legitimate fails.

What order should I do things in?

SPF and DKIM first, then DMARC at p=none, then enforcement once reports are clean. MTA-STS and BIMI come last. BIMI won't work until DMARC is enforced anyway.

I only have five employees. Do I really need DMARC?

Yes. Small businesses get spoofed in invoice and payment fraud precisely because attackers expect them to be unprotected. A DMARC record costs nothing, and p=reject stops others from sending as your exact domain to receivers that check DMARC.

Will these changes affect my website?

No. These are DNS records that only affect email, apart from the mta-sts subdomain, which is a separate small site. Your main website, its DNS records and its SSL certificate are untouched.

What to do next

Work through Level 1 today, starting with the list of everything that sends as your domain. Then set a calendar reminder two weeks out to read your first DMARC reports and plan the move to enforcement. An audit report from step 4 makes a good before-and-after record as you work through the list.

Related reading

• Automate DMARC Report Monitoring: Free Tools and Alert Rules: Automate DMARC aggregate report monitoring with free tools like parsedmarc, Postmark's digest or Cloudflare, set useful alerts and move from p=none to reject.
• DMARC Fail: What It Means and How to Fix It Quickly: DMARC fail means neither SPF nor DKIM passed for a domain matching your From address. Learn how to read the headers, find the cause and fix it safely.

Sources

• Google: Email sender guidelines
• Yahoo Sender Hub: Sender best practices
• Microsoft Learn: Set up SPF for your Microsoft 365 domain
• NCSC: Protecting parked domains
• RFC 9989: DMARC
• RFC 8461: SMTP MTA Strict Transport Security