DMARC, SPF and DKIM explained for non-profits, and how to check yours free

SPF, DKIM and DMARC are three DNS records that work together to prove an email really came from your organization. SPF lists the servers allowed to send for your domain, DKIM adds a digital signature, and DMARC checks that the visible From address lines up with both and tells receiving servers what to do with fakes. Without them, anyone can send email that looks like it came from your Executive Director. You can check yours in about two minutes with our free Domain Security Scan.

Key takeaways

• SPF, DKIM and DMARC are three DNS records that prove an email genuinely came from your domain.
• Without all three in place, your domain is open to email spoofing: fake messages that carry your organization's name.
• DMARC is the only one of the three that checks the visible From address your donors and board actually see.
• Move your DMARC policy up step by step, from monitoring to quarantine to reject, so real email keeps flowing.

What are SPF, DKIM and DMARC?

These three records live in your domain's DNS settings, the public "address book" that tells the internet how your website and email work. Think of them as three layers of verification. Each one checks a different part of a message, and together they give receiving mail servers enough evidence to trust what lands in an inbox.

How does SPF work?

SPF (Sender Policy Framework) is a guest list. It lists the servers allowed to send email for your domain, such as Microsoft 365, Google Workspace or your newsletter platform. When a message arrives, the receiving server checks the sending server against that list, using the hidden envelope sender rather than the From address your reader sees. If the server isn't on the list, the message fails SPF.

How does DKIM work?

DKIM (DomainKeys Identified Mail) is a wax seal. Your mail system adds a digital signature to every message, and the receiving server checks it against a public key published in your DNS. A valid signature shows the message wasn't changed on its way.

How does DMARC tie them together?

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the rule book. It checks that the visible From address lines up with the domain that passed SPF or DKIM, and it tells receiving servers what to do when it doesn't: deliver, send to spam or block. It also sends you reports, so you can see who is sending email in your name. DMARC depends on SPF and DKIM, so all three need to be in place.

What happens when these records are missing?

Missing records leave your domain unprotected. Anyone can send a message that appears to come from your organization, a practice known as email spoofing. Donors receive fake fundraising appeals. Partners open phishing messages carrying your name. Your board treasurer gets an "urgent" payment request that looks like it came from the Executive Director.

Why does email spoofing hurt non-profits so much?

Trust is what keeps donors and members giving. When a spoofed email reaches a supporter, they rarely blame the criminal; they remember the name in the sender field. Some will simply stop giving, and they seldom call to explain why.

What happens to your real email without authentication?

Mail providers grow suspicious of domains that can't prove who they are. Your genuine newsletters, donation receipts and volunteer updates are more likely to land in spam or be rejected. A dmarc check shows you where you stand, but only if the records exist to report on. Without them, you have no visibility into who is using your domain.

How do the three DMARC policy levels work?

Your DMARC record includes a policy that tells receiving servers what to do with a message that fails authentication. There are three levels, and the safest approach is to move up them step by step.

What does the "none" policy do?

The none policy is monitoring only. Every message is still delivered, but you start receiving reports showing which services send email in your name. Start here. It's how you find the newsletter tool, donation platform or volunteer system you forgot was sending on your behalf.

What does "quarantine" do?

Quarantine tells mailbox providers to treat failed messages as suspicious, which usually means the spam folder. Your genuine email still reaches supporters, while spoofing attempts get sidelined where they're far less likely to fool a donor or volunteer. Move here once your reports show all your legitimate senders passing SPF or DKIM.

When should you move to "reject"?

Reject is the strongest level: failed messages are blocked outright. It's the only setting that stops a fake from ever reaching a recipient's inbox. Move to reject only after monitoring and quarantine confirm every authorized sender is set up correctly. Rushing it can quietly block real messages from your fundraising platform or member system.

Why should non-profits care about email authentication?

Non-profits rely on email to reach donors, members and volunteers. Email authentication protects that channel in two directions: it stops criminals from borrowing your name, and it helps your real messages get delivered. For an organization whose reputation is its most valuable asset, that's a lot of protection from three small DNS records.

WILDCARD's CORE package includes Domain Security (DNS security, registration and administration) and Email Security, which stops spam, phishing and malicious attachments before they reach your inbox. CORE costs $23 per user + $26 per device = $49 per seat per month, before applicable taxes, and our Fair Play™ pricing means no minimums, no long-term contracts and no hidden fees. Learn more about our domain security approach or how we support non-profits.

How can you check your records for free?

The free Domain Security Scan takes about two minutes and needs only a domain or email address. There's no card and nothing to install. It checks your SPF, DKIM and DMARC records and returns a plain-language report card on your email and website security, so an Executive Director or admin lead can understand the results without an IT background.

If the report raises questions, our team is happy to walk you through it. That's what we mean by Make IT Disappear: you get clear answers, and the technical work happens in the background.

FAQ

What are SPF, DKIM and DMARC?

Three DNS records that prove an email genuinely came from your domain. SPF lists approved sending servers, DKIM adds a digital signature, and DMARC checks the visible From address and tells receiving servers what to do with fakes.

How do I check my DMARC record for free?

Run the free Domain Security Scan at teamwildcard.ca/scan. It takes about two minutes and returns a plain-language report on your SPF, DKIM and DMARC records.

What happens if my non-profit is missing these records?

Anyone can send email that appears to come from your organization, and your genuine messages are more likely to land in spam.

Conclusion

Email authentication isn't a one-time fix; it's an ongoing practice that protects the trust your organization has spent years building. Set up SPF and DKIM, publish a DMARC record, and move from monitoring to quarantine to reject as your reports confirm everything is in order.

Start by seeing where you stand: run the free Domain Security Scan today, or call us at 1-888-274-3530 to talk it through.