What the three records do
SPF (Sender Policy Framework) lists which mail servers may send as your domain. DKIM signs the message so the receiver can see it was not altered. DMARC says what to do when SPF or DKIM fails: nothing (none), junk (quarantine), or reject — and optionally a report address.
Without those three, any server can put your domain in the From field. Receivers (Gmail, Outlook, customers) look at these records more often before they trust you. That is not a NIS2 duty for every SME; it is what buyers and filters now expect.
What you set in practice
Typical steps if you already sit in Google Workspace or Microsoft 365:
- check that SPF names your primary cloud path — and not a forgotten old host beside it with no agreement;
- turn on DKIM in the tenant and publish the key in DNS;
- start DMARC at p=none with a report address you (or your MSP) read, then quarantine or reject once reports look clean;
- put extra senders (newsletter, accounting tool, ticket portal) in SPF/DKIM, or have them mail from another domain.
What an MSP handles
You or your registrar keep the DNS login. For MSP customers with cloud admin (from Advanced), Floor ICT can check that the tenant has DKIM on, that records match what Google or Microsoft ask, and open a ticket if an extra tool sends as you. Academy does not teach DNS syntax; it does help people treat a “helpdesk” mail that is not from your domain as suspicious.
Go deeper
p=none is not the destination
Starting at p=none is sensible: you see whether legitimate mail fails before you reject. Staying on none forever is a half record. Plan a moment (for example after two weeks of reports) to move to quarantine or reject. This article does not set a legal deadline.
Several tools that send mail
An accounting package, a website form or a marketing tool that “sends from your domain” must be in SPF/DKIM or through the tenant. Otherwise DMARC fails once you tighten — or spoofing stays easy. List those tools; do not guess.
What this is not
SPF/DKIM/DMARC does not replace MFA, backup or awareness. It makes mailing as your domain harder, not impossible. This is not legal advice and not a promise that phishing stops.