...

Ekim IT Solutions

Schedule a Fit Call
Blog / DMARC, SPF, and DKIM for Dental Offices in 2026
All Dental

DMARC, SPF, and DKIM for Dental Offices in 2026

Ekim IT Solutions guide to DMARC, SPF, and DKIM setup for dental offices in 2026

Your dental practice’s email address can be impersonated even when nobody has stolen a password.

SPF, DKIM, and DMARC help receiving mail systems determine whether a message is authorized and whether its authenticated domain matches the address patients and vendors see.

The challenge is configuring these protections across every legitimate sender, including practice email, appointment reminders, billing platforms, and third-party services.

Authentication Is Not the Same as Protection Having SPF and DKIM records does not automatically prevent someone from spoofing your dental practice’s domain.

DMARC checks whether SPF or DKIM passes with a domain aligned to the visible From address. A monitoring-only policy, such as p=none, helps identify problems but does not request that receiving servers block failing messages. Move toward enforcement only after legitimate senders have been identified and tested.

Two Layers of Email Authentication

SPF checks the sending source. DKIM checks a digital signature.

Both help authenticate email, but they work differently and do not automatically prove the visible From domain is aligned.

SPF

Is the sending server authorized?

Sending mail server
↓
SPF DNS record authorizes the source for the envelope domain
↓
SPF authentication passes

SPF checks whether the sending source is authorized for the domain used in the SMTP envelope. It does not, by itself, ensure the visible From address matches.

DKIM

Does the message have a valid signature?

Sender applies a cryptographic signature
↓
Recipient retrieves the public key from DNS
↓
Valid signature verifies

DKIM verifies a signature associated with a signing domain and helps detect changes to signed message content. The signing domain must also align for DKIM to satisfy DMARC.

DMARC connects these authentication results to the domain visible in the From address. Either an aligned SPF pass or an aligned DKIM pass can satisfy DMARC.

Authentication + Policy

DMARC needs one aligned authentication path to pass.

An authenticated sender is not enough if its domain does not align with the visible From address.

SPF passes Envelope domain aligns with the From domain
OR
DKIM passes Signing domain aligns with the From domain
p=none

Monitor

Request no special treatment for DMARC failures. Use reports to identify legitimate and unfamiliar senders.

p=quarantine

Increase enforcement

Ask receiving systems to treat DMARC-failing mail as suspicious, potentially placing it in spam or applying extra scrutiny.

p=reject

Request rejection

Ask receiving systems to reject messages that fail DMARC, reducing successful direct-domain spoofing.

Before raising enforcement, fix legitimate sending services that fail authentication or alignment. Receiving systems ultimately determine how to handle messages under their own policies.

Mailbox secured but domain not? We configure SPF, DKIM, and DMARC so your practice domain is harder to spoof.
Check Your Domain Security →
Before Turning On DMARC Enforcement

Find the hidden systems sending email for your practice.

These services are often overlooked when administrators configure SPF, DKIM, and DMARC.

01

Microsoft 365 or Google Workspace

Everyday employee email and shared mailboxes.

02

Practice Management System

Patient statements, appointments, and other PMS-generated email.

03

Appointment and Recall Tools

Reminders, confirmations, and recall campaigns.

04

Website Forms and Scheduling

Contact-form notifications and online booking messages.

05

Billing and Payment Platforms

Invoices, receipts, statements, and payment notices.

06

Marketing and CRM Platforms

Newsletters, promotions, and automated campaigns.

07

Copiers and Scanners

Scan-to-email devices and multifunction printers.

08

Other Third-Party Integrations

Forms, portals, support tools, and automated notifications.

Identify which systems actually send using your domain, verify their SPF or DKIM setup and alignment, then review DMARC reports before enforcing quarantine or reject.

The DMARC alignment lab

Flip authentication and alignment separately for SPF and DKIM, then change the DMARC policy. See why a pass is not always enough.

Live authentication simulator

SPF path

Pass, not aligned

DKIM path

Pass + aligned
Published DMARC policy (example)
Combined DMARC evaluation DMARC PASS

DKIM provides the aligned pass

DKIM passes and aligns with the visible From domain. SPF passes but does not align, so DKIM carries DMARC.

The published DMARC failure policy is not triggered by this passing result. Other mail filtering can still apply.

Educational simulation only. Assumes a valid DMARC record and simplified alignment. This does not look up DNS, send email, or predict a provider’s final delivery decision.

Frequently Asked Questions

DMARC is not specifically mandated by HIPAA, but it is a valuable email-security control for a dental practice of any size that uses its own domain. DMARC helps receiving mail systems evaluate whether messages using the practice’s visible From domain are properly authenticated, can reduce successful domain spoofing, and provides reporting that helps the practice identify systems sending email on its behalf.
No. DMARC, SPF, and DKIM are email-authentication controls, not a complete HIPAA compliance solution. They help recipients verify sending domains and reduce spoofing, but they do not by themselves encrypt ePHI or replace HIPAA requirements involving access control, transmission security, risk analysis and management, workforce safeguards, business associate agreements, and other administrative, physical, and technical protections.
Yes. Legitimate email can fail DMARC if a third-party sender is not configured so that SPF or DKIM properly aligns with the domain shown in the From address. Before moving to stricter quarantine or reject policies, the practice should inventory legitimate sending services, review DMARC reports, configure appropriate SPF and DKIM authentication, and correct alignment problems for systems such as patient communication platforms, billing tools, marketing services, or other authorized senders.
SPF identifies which sending infrastructure is authorized to send email for a domain, while DKIM uses a cryptographic signature that receiving systems can verify. DMARC then evaluates whether an authenticated SPF domain or DKIM signing domain aligns with the domain shown to the recipient in the visible From address. A message can pass DMARC when at least one of those authentication methods both passes and meets the required domain alignment.
Securing every mailbox while attackers can still impersonate your practice domain?

Ekim IT Solutions works exclusively with dental practices, supporting offices across all 50 states remotely. We configure SPF, DKIM, and DMARC correctly so your domain can’t be spoofed and your legitimate email keeps reaching patients.

Email authentication that stops domain spoofing.
Get an email authentication review →

Related Posts

Ekim IT Solutions guide on the HIPAA risks of auto-forwarding dental office PHI to personal email
All Dental

Can Dental Offices Auto-Forward PHI to Personal Email?

Ekim IT Solutions guide to stopping invoice scams and payment fraud at dental offices
All Dental

Dental Office Invoice Scams: How to Stop Payment Fraud

Ekim IT Solutions guide to HIPAA compliance for dental website contact forms
All Dental

Dental Website Contact Forms and HIPAA: What to Know