Email anti-spoofing for small tax offices: SPF, DKIM and DMARC

A one-page plain-English guide. General information, not legal advice. Settings menus change over time; check your provider's current help pages.

Why it matters

Scammers send emails that look like they come from your office ("Please upload your W-2 here"). Three DNS settings help your clients' mailboxes tell real mail from fake: SPF (who may send as your domain), DKIM (a digital signature on your mail) and DMARC (what to do with mail that fails, plus reports to you).

Check yourself first

nslookup -type=txt yourdomain.com            → look for "v=spf1 ..."
nslookup -type=txt _dmarc.yourdomain.com     → look for "v=DMARC1; p=..."
nslookup -type=txt google._domainkey.yourdomain.com     (Google)
nslookup -type=cname selector1._domainkey.yourdomain.com (Microsoft 365)

Also list every service that sends mail as you: your tax software's client portal, e-signature, newsletter, invoicing, website contact form. Each must be covered by SPF or DKIM, or its mail may be blocked later.

Google Workspace

SPF: one TXT record at your domain: v=spf1 include:_spf.google.com ~all (add includes for other senders; keep only one SPF record).
DKIM: Admin console → Apps → Google Workspace → Gmail → Authenticate email → Generate new record (2048-bit) → add the TXT at google._domainkey → click Start authentication.
DMARC: see staged rollout below.

Microsoft 365

SPF: one TXT record: v=spf1 include:spf.protection.outlook.com ~all (plus other senders; only one SPF record).
DKIM: Microsoft Defender portal → Email & collaboration → Policies & rules → Threat policies → Email authentication settings → DKIM tab (direct link: security.microsoft.com/authentication?viewid=DKIM) → select your domain. If it shows "No DKIM keys saved for this domain", click Create DKIM keys. Add the two CNAME records shown under Publish CNAMEs (selector1._domainkey and selector2._domainkey) at your DNS provider. Copy the values exactly from the portal; they are different for every domain. Then turn on Sign messages for this domain with DKIM signatures. The status should change to "Signing DKIM signatures for this domain". DNS changes can take a while; if you see an error about missing CNAMEs, wait and try again.
DMARC: see staged rollout below.

DMARC: staged rollout

Stage	TXT record at `_dmarc.yourdomain.com`	How long
1. Monitor	`v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com`	2–4 weeks. Read reports; fix any legitimate sender that fails.
2. Quarantine	`v=DMARC1; p=quarantine; rua=mailto:...`	2–4 weeks. Fakes go to spam.
3. Reject	`v=DMARC1; p=reject; rua=mailto:...`	Ongoing. Fakes are refused.

DMARC reports are XML files; a free report viewer makes them readable. If real mail starts landing in spam, step back one stage, fix the sender, then move forward again. Once DMARC enforces, you can tighten SPF from ~all to -all.

These settings reduce spoofing of your domain. They do not stop look-alike domains or a hacked mailbox: use MFA on every mail account and train staff to verify unusual requests by phone.