SPF, DKIM and DMARC for small businesses小さな会社のためのなりすましメール対策
Could someone be sending scam emails in your company's name right now? A few lines in your DNS usually stop it, yet most small businesses still haven't added them. Here's how the three checks work, how to set them up safely, and the mistakes to avoid.
22 October 2026 · 4 min read · 日本語
Why now
In Japan, the Council of Anti-Phishing Japan received 2,454,297 phishing reports in 2025, about 1.43 times the year before and a new record. Early in the year, a large share of those emails used real brands' own domains as the sender. The targets were domains with no DMARC record, or with a policy left at "none".
In September 2025, Japan's Ministry of Internal Affairs and Communications asked the telecom industry associations to adopt DMARC with a "quarantine" or "reject" policy. Google, meanwhile, requires SPF, DKIM and DMARC from anyone sending more than 5,000 emails a day, and SPF or DKIM from everyone else.
So without them, your domain is easier to impersonate, and your own legitimate emails are more likely to land in spam.
The three checks
SPF
A list of the servers allowed to send email for your domain, published as a DNS TXT record.
DKIM
A digital signature on each email. The receiver checks it with a public key in your DNS, proving who sent it and that nothing was changed.
DMARC
Combines the SPF and DKIM results, tells receivers what to do with failures (nothing, quarantine or reject), and sends you reports.
The key idea is alignment. DMARC checks that the domain people see in the From line matches the domain that passed SPF or DKIM. Passing SPF for some other domain doesn't count.
An example setup
A made-up company, example.com, uses Google Workspace for staff email and an email delivery service for notifications. The delivery service sends from a subdomain, send.example.com, to keep it apart from the main domain.
| Name | Type | Value (example) | What it does |
|---|---|---|---|
example.com | TXT | v=spf1 include:_spf.google.com ~all | SPF: allows Google's servers to send |
google._domainkey | TXT | v=DKIM1; k=rsa; p=MIIB… | DKIM: public key generated in the Google Admin console |
(selector)._domainkey | TXT / CNAME | Given by the delivery service | DKIM: the delivery service's public key |
send.example.com | TXT / MX | Given by the delivery service | SPF for the subdomain and bounce handling |
_dmarc | TXT | v=DMARC1; p=none; rua=mailto:dmarc@example.com | DMARC: monitor only for now, and send reports |
Domains that never send email (ones you only own to protect your name) are even simpler: v=spf1 -all and v=DMARC1; p=reject tell the world that any email from them is fake.
Rolling it out safely
- Start by watching (2–4 weeks). Set
p=nonewith aruaaddress for aggregate reports. Nothing changes for delivery, and you learn who is sending email as your domain. - Add every legitimate sender. The reports reveal the ones you forgot: invoices from accounting software, booking systems, newsletters, web forms, the office printer's scan-to-email. Give each one SPF and DKIM.
- Move to quarantine. When all real email passes, switch to
p=quarantine. Failures go to the spam folder. - Finish with reject. After a quiet period, set
p=reject. Fakes are refused outright. Usesp=to set the policy for subdomains.
Common mistakes
- Two SPF records. A domain may have only one. When you add a service, add an
include:to the existing record. - The 10-lookup limit. SPF may follow at most 10 DNS lookups. Too many
include:s and even real email fails. - Forgotten services. Jump straight to
p=rejectand your invoices or booking confirmations may vanish. Always start with monitoring. - Staying at
p=noneforever. Monitoring alone stops nothing; those were exactly the domains abused in 2025. - Forwarding breaks SPF. Forwarded mail often fails SPF, but the DKIM signature survives. That's why DKIM matters.
How to check
On Windows, in Command Prompt (on macOS or Linux, use dig TXT _dmarc.example.com):
nslookup -type=TXT example.com
nslookup -type=TXT _dmarc.example.comOr check a real email: send one to a Gmail address, open it and choose "Show original". If SPF, DKIM and DMARC all say PASS, you're done.
Why DMARC alone isn't enough
The 2026 report from the Council of Anti-Phishing Japan shows that by the end of 2025, about 75% of phishing came from look-alike domains the attackers registered themselves, set up so they pass DMARC. DMARC protects your exact domain, not every domain that resembles it.
So take DMARC all the way to reject, then add BIMI (your verified logo in the inbox), monitoring for look-alike domains, staff training, and multi-factor authentication on every account.
This site's own email follows the same steps, starting from the monitoring stage. Questions about your setup? Get in touch.