Setting Up SPF, DKIM and DMARC: Protection Against Mail Fraud

Why email security is indispensable for your mid-sized business

Emails are the lifeline of business communication in the German Mittelstand, but at the same time they are the main gateway for cybercriminals. Many companies underestimate the devastating risk of email spoofing, where fraudsters fake messages in the name of your company in order to deceive customers, partners or staff. Phishing campaigns are becoming ever more professional and are visually barely distinguishable from genuine business emails. For managing directors and IT leads, a compromised email infrastructure is a business critical risk that not only leads to financial damage but also lastingly destroys the hard won trust in your brand.

That these are no abstract dangers is confirmed by current figures: the Verizon Data Breach Investigations Report 2026 traces 62 percent of all incidents examined back to the human factor, with 16 percent attributable specifically to phishing. This professionalisation of attacks makes clear why classic security measures often fail. Without complete verification of the sender identity, your domain remains an easy target for identity theft. Email security is therefore no longer an optional extra, it is the foundation of effective cybersecurity in a modern mid-sized business.

• Identity theft (email spoofing): criminals send fraudulent emails using your exact domain in order to divert payments or extort sensitive data.
• Targeted spear phishing: tailor made messages fake legitimate communication with business partners or public authorities.
• CEO fraud: attackers pose as the management and instruct staff to make urgent transfers.
• Malware distribution: phishing emails serve as carriers to smuggle malicious software into the company network and encrypt systems.

Alongside protecting your own brand, regulatory obligations are increasingly coming into focus. The European NIS2 Directive obliges the entities it covers to take appropriate risk management measures. It does not contain an explicit obligation to introduce SPF, DKIM or DMARC, but securing communication channels is part of the state of the art. The German Federal Office for Information Security (BSI) describes the technical target state in its Technical Guideline BSI TR-03182 for email services. With CAVRIX and our services in the areas of cybersecurity and compliance you secure your digital infrastructure. Via the Command Center you keep an eye on the status of your security measures at all times and can document your measures verifiably.

SPF (Sender Policy Framework): the digital guest list of your domain

Imagine unauthorised senders sending fraudulent emails to your customers or partners in your name. The Sender Policy Framework (SPF) is the first line of defence to prevent exactly that. Technically, SPF is a DNS TXT record in the zone of your domain. This record acts like a digital guest list: it defines in binding fashion which IP addresses and servers are allowed to send emails in the name of your domain at all. Receiving servers check this record on delivery and know immediately whether a mail comes from an authorised source.

During configuration, however, you quickly run into technical limits. The specification RFC 7208 permits a maximum of 10 mechanisms that trigger a DNS lookup when an SPF record is evaluated. If this limit is exceeded (for example because too many external services such as marketing or HR tools are pulled in via include), the evaluation ends with a permerror and the SPF check delivers no usable result. BSI TR-03182 therefore expressly recommends noting senders as IP addresses or network ranges instead of by name, so that this limit is never reached in the first place. For your IT leads, managing these lookups is a critical task in order to guarantee reliable deliverability. Our cybersecurity service supports companies in monitoring and resolving such limitations proactively.

• Soft fail (~all): emails from unauthorised servers are marked as not authorised, but are usually still delivered, often into the spam folder. This is suitable for the introduction and test phase.
• Hard fail (-all): the receiving server may reject unauthorised emails outright. How strictly it implements this is its own decision, because SPF is a statement by the sender and not a binding instruction to the recipient.

BSI TR-03182 accepts both variants. It merely requires that the all mechanism protects at all, meaning it is set either to SoftFail (~all) or to Fail (-all). Records that end in Pass (+all) or Neutral (?all) do not meet the requirements of the guideline. The choice of mechanism determines how consistently the defence against forged emails takes effect when it matters. An incompletely maintained SPF record, however, quickly leads to legitimate messages from your team disappearing into the digital void when a hard fail is in place. Careful planning is therefore indispensable before the protection is switched on for real.

DKIM (DomainKeys Identified Mail): the cryptographic seal

While SPF defines who may send emails in the name of your domain, DKIM (DomainKeys Identified Mail) goes one step further and secures the integrity of your messages. DKIM acts as a digital, cryptographic seal. Using an asymmetric key pair, this procedure ensures that the content of an email was not altered unnoticed on the way from sender to recipient. For you as a managing director or IT lead, this offers decisive protection against manipulation and identity theft.

Technically the procedure is based on a private and a public key. Your outgoing mail server signs every message with the private key in the email header. The recipient checks this signature with the public key that you have published in the Domain Name System (DNS) of your domain. On key length, BSI TR-03182 (version 1.0 of 24 January 2024) sets a clear range: RSA keys must not be shorter than 1024 bits and, for reasons of interoperability, not longer than 2048 bits. In practice this comes down to 2048 bits as the target value. RFC 8301 names the same order of magnitude, requiring at least 1024 bits for signers and recommending 2048 bits. In addition, the guideline requires the key material to be renewed at least every three months.

• Signing: the sending mail server calculates a hash value of the email content and encrypts it with your private key.
• DNS query: the receiving server reads out the DKIM header and queries the public key via a special TXT record in the DNS.
• Verification: the recipient decrypts the hash value and compares it with a newly calculated hash value of the email received. If both values match, the message is intact.

Setting up DKIM correctly not only protects against email fraud, it is also a building block for regulatory requirements. Under NIS2, companies have to demonstrate that they take suitable security precautions. CAVRIX supports you in implementing DKIM as part of our services in the areas of cybersecurity and compliance. That way your email infrastructure is reliably protected against attacks and stays legally compliant.

DMARC (Domain-based Message Authentication): the control authority

While SPF and DKIM deliver the tools for identification, DMARC (Domain-based Message Authentication, Reporting and Conformance) acts as the overarching control authority. The protocol gives receiving systems a clear instruction on how to handle emails that fail the SPF or DKIM checks. DMARC thereby closes the security gap of incomplete sender checks and forms the core of modern standards such as the Technical Guideline BSI TR-03182. Without an active DMARC policy your protection remains incomplete, because receiving servers often still deliver forged emails despite failed checks.

• "none" (monitoring): in this entry phase all emails are delivered as usual. It serves solely to collect detailed reports about your entire mail infrastructure and to identify legitimate sending sources without error.
• "quarantine": emails that fail authentication are moved by receiving servers directly into the spam folder. This reduces the risk of forged messages reaching the primary inboxes of your customers or partners.
• "reject": the safest level blocks unauthorised emails immediately at the recipient's server boundary. The forged message is discarded, which effectively prevents any misuse of your domain for phishing campaigns.

A decisive lever of DMARC is the feedback function via XML security reports. You publish the address for the aggregate reports in the rua tag, and you usually receive these reports once a day. Alongside it, the ruf tag exists for forensic individual reports. BSI TR-03182 requires at least one rua address and expressly advises against requesting ruf reports, because these contain personal content. Via the rua reports you see which servers worldwide are sending emails in the name of your company. That not only uncovers phishing attacks, it also reveals incompletely configured cloud services in your own departments.

A second lever is alignment. DMARC only counts as passed if the domain from the visible From header matches the SPF or DKIM checked domain. With relaxed alignment the same organisational domain is enough, with strict alignment the domain has to match exactly. BSI TR-03182 recommends strict alignment and allows relaxed only in exceptional cases, for instance when a service provider sends bulk mail in your name. Continuously analysing this XML data and gradually tightening the policy requires ongoing IT expertise. As part of our modular offerings for cybersecurity and Managed IT we take on this technical monitoring for you. We guide your email infrastructure safely from the risk free observation phase through to full enforcement of the DMARC policy, so that you meet regulatory requirements such as NIS2 or BSI standards effortlessly.

New requirements: why Google and Yahoo enforce DMARC

For companies in the German Mittelstand, reliable email delivery is business critical. Yet since 1 February 2024 tightened requirements have applied to sending emails to recipients at Google and Yahoo. Anyone sending more than 5,000 messages per day to Gmail accounts has to implement certain authentication standards. This measure is meant to curb spam and misuse, but in everyday business it also affects legitimate invoices, quotations and circulars. If the technical prerequisites are not met exactly, classification as spam looms.

• Authentication requirement: the protocols SPF and DKIM have to be set up completely so that the sender domain can be verified unambiguously.
• DMARC introduction: bulk senders are required to have a valid DMARC record in the DNS settings of the domain. Google expressly permits p=none here, so it does not require an enforcement level.
• Spam complaint rate: the spam rate reported in Google Postmaster Tools should stay permanently below 0.10 percent and must never reach 0.30 percent.
• Easy unsubscribe: promotional bulk mail has to support one click unsubscribe. Unsubscribe requests have to be processed within two days.

These strict thresholds show that email security has long since stopped being a purely technical option, it directly affects business operations. Anyone who does not protect their own company's sender address risks not only losing email deliverability but also opens the door to phishing attacks in their own name. For IT leads and managing directors in mid-sized businesses this is a clear signal to put the topic of IT security as a matter for the board right at the top of the agenda. As part of CAVRIX and our services such as Managed IT and cybersecurity, we support you in maintaining these complex standards in an audit proof and automated way, in order to secure the legal compliance and the reputation of your company for the long term.

Regulation in view: the standards BSI TR-03182 and NIS2

The European NIS2 Directive considerably tightens the cybersecurity requirements for the entities it covers. Among the obligations is the systematic protection of business communication. For the managing directors affected this means an urgent field of action, because failures can have legal consequences. The Technical Guideline TR-03182 on email authentication, published on 24 January 2024 by the German Federal Office for Information Security (BSI), describes the technical target state in Germany^[1]. It is addressed to email service providers and to operators of email services in organisations, who can have their conformity certified voluntarily. It does not create an immediate legal obligation for mid-sized companies to introduce DMARC. With a proactive service for cybersecurity and our expertise on the topic of NIS2 compliance, CAVRIX actively supports you in setting up your infrastructure fully compliant and secure.

In TR-03182 the BSI defines how SPF, DKIM and DMARC have to work together in order to make misuse of your sender address harder^[1]. A central aspect of the guideline is the transition from pure monitoring (p=none) to genuine enforcement. The guideline expects the recipient policy to be either quarantine (anything suspicious lands in the spam folder) or reject (unauthorised messages are turned away directly) and names reject as the long term goal. The guideline does not contain a calendar deadline for implementation. Without this protection your company remains vulnerable, and attackers can send fraudulent emails in the name of your brand.

1. Phase 1 (stocktaking): comprehensive analysis of your existing email infrastructure and a record of all systems and service providers that send in the name of your company. To do this, you first publish a DMARC policy with p=none and a rua address.
2. Phase 2 (authentication): full provision and error free configuration of SPF and DKIM for all active sending sources, including a check of the alignment between the From header and the checked domain.
3. Phase 3 (enforcement): raising the DMARC policy to quarantine and subsequently to reject, accompanied by continuous reporting^[1].

Implementing email protection with the cybersecurity services from CAVRIX

Configuring SPF, DKIM and DMARC without gaps requires deep technical expertise and continuous monitoring. For managing directors and IT leads in the German Mittelstand, CAVRIX offers a tailored solution for this. Through the seamless interplay of the services Managed IT, cybersecurity and compliance, your entire email infrastructure is secured according to strict standards such as the guideline BSI TR-03182. The experienced team takes on the error free setup of your DNS records and makes sure that legitimate messages arrive reliably while fraudulent senders are consistently blocked.

• Managed IT: CAVRIX configures and maintains your DNS records directly on your name servers in order to reliably rule out human error during SPF and DKIM setup.
• Cybersecurity: permanent monitoring of your outgoing and incoming email traffic protects your domains from unauthorised misuse and proactively fends off complex identity theft.
• Compliance: complete adherence to important regulatory requirements, such as those defined by the European NIS2 Directive or German BSI specifications, is documented automatically for audits.

In daily operations, the innovative Command Center provides maximum transparency and relief for your IT resources. Via this central, AI native interface you receive immediate real time security alerts directly in your preferred chat tools in the event of anomalies or attempted misuse of your sender address. That way you keep full oversight of the security status of your communication channels at all times, without having to work through confusing protocol data or log files yourself.

Reliably protecting your brand and your digital identity tolerates no further delay in modern business life. If you have questions about the optimal setup of your email authentication or need support with fast implementation, you can arrange a free consultation directly via contact or send your questions to info@cavrix.de.