Business email compromise is one of the most expensive claims insurers pay. Many attacks start with an email that looks like it came from the client's own domain. That's why applications ask about SPF, DKIM and DMARC, and why "we have SPF" is no longer enough.

What each record proves

  • SPF lists the servers allowed to send mail for the domain. For Microsoft 365 it includes include:spf.protection.outlook.com, plus any other service that sends as the client.
  • DKIM adds a digital signature to each message, so receivers can tell it wasn't changed and really came from the domain.
  • DMARC tells receivers what to do when a message fails those checks, and sends the domain owner reports on who is sending as them.

SPF and DKIM on their own only describe the domain's mail. DMARC is the record that tells the world to act on it.

What insurers want to see

Most forms ask whether all three are set up. The stronger answer is a DMARC policy that enforces:

  • p=none: receivers deliver a failing message anyway and report it. Insurers read this as monitoring only, not protection yet.
  • p=quarantine: receivers send it to junk. This is enforcing.
  • p=reject: receivers refuse it. This is enforcing, and the strongest.

Major mailbox providers now expect DMARC too. Google and Yahoo have required it for bulk senders since 2024.

Moving a client to enforcement

  1. Check every domain the client owns, including old and parked ones. An unused domain can still be spoofed.
  2. Fix SPF. Keep one SPF record per domain, list every real sender, and stay under SPF's limit of 10 DNS lookups.
  3. Turn on DKIM for each domain in the Microsoft Defender portal, and publish the two CNAME records it gives you.
  4. Publish DMARC at p=none with a reporting address, so you can see who sends as the domain.
  5. Review the reports for two to four weeks. Look for real senders you missed, such as invoicing, CRM or newsletter tools, and add them to SPF and DKIM.
  6. Move to p=quarantine, then p=reject, once the reports show only mail you expect.

For domains that never send mail, publish v=spf1 -all and a DMARC record with p=reject straight away.

Answering the form

If every domain has SPF, DKIM and an enforcing DMARC policy, the answer is yes. If DMARC is still at p=none, say it's being monitored and give the date you plan to enforce. That's an honest answer and a clear plan.

Check every domain at once. The Cyber Insurance Readiness Check reads the tenant's verified domains and reports SPF, DKIM and DMARC for each one.