Does the Applicant employ SPF, DKIM, and DMARC?
All three are usually present in some form. The question that matters is whether the DMARC policy actually does anything, because a policy of none is a monitoring configuration, not a control.
What the carrier is actually asking
The carrier is asking whether your domains publish the three email authentication records and whether they are enforced. Sender Policy Framework declares which servers may send for your domain, DomainKeys Identified Mail signs messages, and Domain-based Message Authentication tells receivers what to do when the first two fail. The third is where enforcement lives.
Why it is underwritten
Without enforcement, anyone can send mail that appears to come from your domain, which is the mechanism behind invoice fraud aimed at your customers and at your own finance team. Carriers care because that fraud generates claims on your policy and complaints from third parties, and because publishing an enforcing record is one of the cheapest controls on the form.
Where the answer lives in Microsoft 365, Entra ID, and Azure
These records are public, so this answer is verifiable from outside your tenant as well as inside it. Anyone, including the underwriter, can check it in seconds.
| Platform | Where the setting lives | What has to be true |
|---|---|---|
| DNS | The SPF record for each sending domain | A record that ends in a hard or soft fail rather than neutral, and that stays inside the ten-lookup limit |
| Microsoft 365 | DKIM signing configuration per domain | Enabled and rotated for every domain that sends, not only the primary one |
| DNS | The DMARC record policy value | p=quarantine or p=reject with a full percentage. p=none monitors and enforces nothing |
| DNS | Records for parked and non-sending domains | Non-sending domains publish restrictive records too, since attackers prefer the domains nobody protects |
| Microsoft 365 | Anti-spoof protection and the authenticated received chain configuration | Spoof intelligence tuned, and legitimate forwarding handled so enforcement does not break real mail |
Organisations protect the domain they send from and leave the brand variants, the acquisition domains, and the typo domains they registered defensively with no records at all. Those are the domains an attacker will use, precisely because they are unprotected and still look like you.
What a defensible yes requires
- All three records exist for every sending domain.
- The DMARC policy is quarantine or reject at full percentage, not none.
- Non-sending and parked domains publish restrictive records.
- Aggregate reports are collected and reviewed, so legitimate senders are known before enforcement tightens.
- The SPF record is within the lookup limit, since exceeding it causes silent failures.
How this answer goes wrong
The answer is yes because all three records exist, and the DMARC policy has been set to none since it was published three years ago during a migration that was never finished. That is a monitoring configuration. Anyone can still spoof the domain, and the control the carrier is asking about is absent.
Frequently asked
Is p=none acceptable?
As a temporary state while you inventory legitimate senders, yes. As a permanent answer to this question, no, because it instructs receivers to take no action.
How do we get to enforcement safely?
Publish none, collect aggregate reports, identify every legitimate sender, then move to quarantine at a partial percentage and increase. The reporting phase is what prevents breaking real mail.
What about our marketing platforms?
They are the senders that break enforcement, because they send as your domain from their infrastructure. They need to be in the SPF record and signing with DKIM, which the vendor supports and someone has to configure.
Can the underwriter check this themselves?
Yes, in seconds, from public DNS. It is one of very few application answers that can be independently verified before a quote, which is a reason to make sure it is right.
Related questions
Stop answering this from memory
Connect Microsoft 365, Entra ID, and Azure read-only. Insurance Posture reads the live configuration behind each application answer and shows you which ones you can prove before you sign.
Assess your posture