How to configure MikroTik for a small business: a secure baseline step by step
Update RouterOS, replace the admin user, close management services, set up the firewall and a guest network — with ready-to-use commands.
Read articleWithout SPF, DKIM and DMARC anyone can send email that looks like it comes from your domain — and your real emails are more likely to land in spam. Setting them up takes about an hour, plus a few weeks of monitoring.
Before you start: you need access to your domain's DNS management (registrar or DNS provider) and to the administrator console of your mail service. Replace
example.am with your domain. List every service that sends email in your name: mail server, website forms, CRM, newsletter service, accounting software.Step 1. Publish one SPF record
SPF lists the servers allowed to send mail for your domain. There must be only one SPF record; add other senders with additional include: entries from their documentation.
; Microsoft 365
example.am. TXT "v=spf1 include:spf.protection.outlook.com -all"
; Google Workspace
example.am. TXT "v=spf1 include:_spf.google.com ~all"Step 2. Turn on DKIM in your mail service
DKIM signs every message. In Microsoft 365 open the Defender portal (Email & collaboration → Policies → Email authentication settings → DKIM), copy the two CNAME records into DNS and enable signing. In Google Workspace generate the key in the Admin console (Apps → Google Workspace → Gmail → Authenticate email), publish the TXT record and click Start authentication. Do the same for other services that send in your name.
Step 3. Start DMARC in monitoring mode
DMARC tells receivers what to do with mail that fails the checks, and sends you reports. Begin with p=none — nothing is blocked yet, you only receive reports.
_dmarc.example.am. TXT "v=DMARC1; p=none; rua=mailto:dmarc@example.am"Step 4. Move to quarantine, then reject
Review the reports for 2–4 weeks and fix any legitimate services that fail. Then switch to p=quarantine and, when everything is clean, to p=reject.
_dmarc.example.am. TXT "v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc@example.am"
; later:
_dmarc.example.am. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.am"Step 5. Check the records
Check that the records are visible, and send a test email to an external mailbox: in the message headers, SPF, DKIM and DMARC should show pass.
nslookup -type=txt example.am
nslookup -type=txt _dmarc.example.am
# Linux / macOS:
dig +short TXT _dmarc.example.amCommon mistakes
- Two SPF records — receivers treat this as an error.
- Forgetting the website or CRM that also sends email.
- Staying at
p=noneforever: it reports but does not protect.
Your domain is your signature. SPF, DKIM and DMARC make it hard to forge.
Need help with this? Contact CySec for a free consultation.
Frequently asked questions
Can SPF, DKIM and DMARC break our email?
Only if a legitimate sender is missing from SPF or DKIM is not enabled for it. That is why DMARC starts with p=none: you see problems in reports before anything is blocked.
Where do DMARC reports go and how do we read them?
To the address in rua=. They are XML files; a free or paid DMARC report service turns them into readable charts of who sends mail in your name.
Do we need DMARC if we only receive email?
Yes. Attackers can still send fake emails from your domain to your clients. A DMARC policy of reject protects your name even if you send very little mail.
How long until changes take effect?
DNS changes usually spread within minutes to a few hours, depending on the TTL of the records.