Incident PreventionInformational 6 min read Last reviewed: 2026-10-17
SPF, DKIM and DMARC Explained: How to Stop Criminals Spoofing Your UK Business Domain
If your domain lacks a strict DMARC policy, anyone can send emails pretending to be your Managing Director or Finance team. Learn how to move safely from p=none to p=reject.
Written by Callum Vance (Principal Security Architect, HackGuardX UK)
Primary Topic: spf dkim dmarc setup uk
Executive Key Takeaways
- A DMARC policy set to p=none only monitors spoofing—it does not block fake emails from reaching your clients' inboxes.
- SPF hard-fail (-all) combined with 2048-bit DKIM keys is required before enforcing p=quarantine or p=reject.
- Google, Yahoo, and Microsoft now require bulk and business senders to maintain valid SPF, DKIM, and DMARC records.
1. Why p=none Gives Business Owners a False Sense of Security
When we inspect UK SME domains through HackGuardX's Free Exposure Check, over 60% either have no `_dmarc` TXT record at all or leave it set to `v=DMARC1; p=none;`. While `p=none` collects XML aggregate reports, receiving mail servers are instructed to deliver spoofed emails straight into the recipient's inbox.
Official UK & International Standards Referenced
Put This Guide Into Practice
Run Free DNS & DMARC CheckCheck your domain's SPF and DMARC policy in 10 seconds
Start with a free, non-destructive external exposure check in under 15 seconds.