--- title: "Does the Applicant employ SPF, DKIM, and DMARC?" url: https://insuranceposture.com/questions/email-security/applicant-employ-spf-dkim-dmarc category: "Email security and phishing" canonical_key: q_eml_004 evidence_state: verified updated: 2026-08-24 --- # Does the Applicant employ SPF, DKIM, and DMARC? URL: https://insuranceposture.com/questions/email-security/applicant-employ-spf-dkim-dmarc Section: Email security and phishing Evidence state: Verifiable from your tenant All three are usually present in some form. The question that matters is whether the DMARC policy actually does anything, because a policy of none is a monitoring configuration, not a control. ## What the carrier is actually asking The carrier is asking whether your domains publish the three email authentication records and whether they are enforced. Sender Policy Framework declares which servers may send for your domain, DomainKeys Identified Mail signs messages, and Domain-based Message Authentication tells receivers what to do when the first two fail. The third is where enforcement lives. ## Why it is underwritten Without enforcement, anyone can send mail that appears to come from your domain, which is the mechanism behind invoice fraud aimed at your customers and at your own finance team. Carriers care because that fraud generates claims on your policy and complaints from third parties, and because publishing an enforcing record is one of the cheapest controls on the form. ## Where the answer lives in Microsoft 365, Entra ID, and Azure These records are public, so this answer is verifiable from outside your tenant as well as inside it. Anyone, including the underwriter, can check it in seconds. | Platform | Where the setting lives | What has to be true | | --- | --- | --- | | DNS | The SPF record for each sending domain | A record that ends in a hard or soft fail rather than neutral, and that stays inside the ten-lookup limit | | Microsoft 365 | DKIM signing configuration per domain | Enabled and rotated for every domain that sends, not only the primary one | | DNS | The DMARC record policy value | `p=quarantine` or `p=reject` with a full percentage. `p=none` monitors and enforces nothing | | DNS | Records for parked and non-sending domains | Non-sending domains publish restrictive records too, since attackers prefer the domains nobody protects | | Microsoft 365 | Anti-spoof protection and the authenticated received chain configuration | Spoof intelligence tuned, and legitimate forwarding handled so enforcement does not break real mail | **Parked domains are the usual gap** Organisations protect the domain they send from and leave the brand variants, the acquisition domains, and the typo domains they registered defensively with no records at all. Those are the domains an attacker will use, precisely because they are unprotected and still look like you. ## What a defensible yes requires - All three records exist for every sending domain. - The DMARC policy is quarantine or reject at full percentage, not none. - Non-sending and parked domains publish restrictive records. - Aggregate reports are collected and reviewed, so legitimate senders are known before enforcement tightens. - The SPF record is within the lookup limit, since exceeding it causes silent failures. ## How this answer goes wrong The answer is yes because all three records exist, and the DMARC policy has been set to none since it was published three years ago during a migration that was never finished. That is a monitoring configuration. Anyone can still spoof the domain, and the control the carrier is asking about is absent. ## If this answer turns out to be wrong Business email compromise is the highest-frequency cyber claim, so the mail controls described on the application are among the first things an adjuster reads back against it. Whether anything follows from an inaccuracy depends on materiality, on the policy wording, and on the law of the governing state: [what counts as misrepresentation on a cyber application](https://insuranceposture.com/glossary/misrepresentation). The other consequence terms are collected in the [glossary](https://insuranceposture.com/glossary). ## Frequently asked ### Is p=none acceptable? As a temporary state while you inventory legitimate senders, yes. As a permanent answer to this question, no, because it instructs receivers to take no action. ### How do we get to enforcement safely? Publish none, collect aggregate reports, identify every legitimate sender, then move to quarantine at a partial percentage and increase. The reporting phase is what prevents breaking real mail. ### What about our marketing platforms? They are the senders that break enforcement, because they send as your domain from their infrastructure. They need to be in the SPF record and signing with DKIM, which the vendor supports and someone has to configure. ### Can the underwriter check this themselves? Yes, in seconds, from public DNS. It is one of very few application answers that can be independently verified before a quote, which is a reason to make sure it is right. ## Related questions - [Are external emails tagged as originating from an external source?](https://insuranceposture.com/questions/email-security/external-emails-tagged-as-originating-from-external-source) - [Is legacy email authentication (IMAP, POP, basic authentication) disabled?](https://insuranceposture.com/questions/email-security/legacy-email-authentication-disabled) - [What are the Applicant's websites / domains (main website, corporate email domains, subsidiary/franchise sites)?](https://insuranceposture.com/questions/governance-and-workforce/applicant-s-websites-domains) - [Is email filtering in place for inbound mail?](https://insuranceposture.com/questions/email-security/email-filtering-place-inbound-mail) --- Insurance Posture by SecValley. https://insuranceposture.com The question library is written in our own wording to reflect the control topics that recur across US cyber application and ransomware supplemental forms. No carrier form is republished. SecValley is not a law firm, an insurance broker, an agent, or a carrier, and holds no producer licence. Nothing here is insurance advice, legal advice, or a coverage determination, and no attorney-client relationship arises from reading it. Statements about what a party to a cited case did, knew, or intended are allegations drawn from court filings and contemporaneous reporting, not findings of fact. Your organization's authorized signer remains responsible for the accuracy of any application. Consult a licensed broker and qualified counsel before binding.