DMARC, SPF, DKIM, S/MIME
Comprehensive support to secure your email
Secure email is the foundation of secure communication
Making email secure
Hardly any tool is as much taken for granted in everyday business as email – and hardly any is so easy to misuse. The technology behind it dates from a time when everyone involved knew each other and nobody would have thought of forging a sender. To this day, anyone sending a message is free to write in it whoever they claim it comes from. An envelope with someone else's return address – only free of charge, created in seconds and sendable millions of times.
This is exactly where attacks begin. They rarely arrive in spectacular fashion, but as an invoice with a changed account number, as an urgent request from management just before closing time, as a familiar-looking login page. The vast majority of successful attacks on companies begin with a message in the inbox – not with a gap in the firewall.
The good news: the answers exist, are standardised and have been proven for years. SPF, DKIM and DMARC close the sender loophole, an upstream mail gateway keeps malicious content away from the mailbox, and S/MIME protects the content itself. They just need to be set up correctly – and operated properly.
Your sender is your reputation
A domain is more than an address. It is the promise that a message really comes from you. If this promise is abused, others suffer the damage first: your customers, your suppliers and your partners receive mail in your name – and believe it, because your name is on it. The loss of trust sticks with you, even if your own systems were never touched.
There is a second, underestimated consequence: deliverability. Large providers assess every incoming message according to how well a domain is secured. Since 2024 Google and Yahoo, and since 2025 Microsoft as well, have explicitly required correct authentication from bulk senders – anyone who does not provide it ends up in the spam folder or is rejected outright. This affects not only newsletters but also order confirmations, quotations and payment reminders.
A secured domain therefore works in two directions: it prevents others from writing in your name, and it ensures that your own mail arrives reliably. Sender protection is customer protection in practice – and a prerequisite for being heard at all.
Three layers of security
Secure email is not created by a single product, but by three layers that answer different questions.
The first layer establishes origin. SPF defines which servers may send in your name. DKIM gives every message a cryptographic signature. DMARC brings the two together, checks them against the visible sender and determines what happens to forgeries. This layer lives entirely in your domain's DNS – invisible to users, decisive for the effect.
The second layer controls incoming mail. An upstream mail gateway checks every message for spam, viruses and phishing before it even reaches a mail server or device. Rules apply there in one place for all mailboxes, on every device, without any action by your staff.
The third layer protects the content. S/MIME signs and encrypts individual messages end to end, so that really only the intended recipient can read them.
Only together do the three layers create a complete picture: proven origin, a clean inbox and confidential content.
Send and receive email securely and without errors
SPF – who may send in your name?
The Sender Policy Framework answers a single but crucial question: which servers may send emails on behalf of your domain? You publish the answer in the DNS – as a short text record listing your own mail servers, the newsletter service, the ERP system and every other authorised sender. The receiving server reads this record with every delivery and compares it with the IP address from which the message actually originates. If that address is not on the list, the email is considered unauthorised and, depending on the policy, is flagged or rejected.
As simple as the principle is, the details are tricky. SPF does not check the sender your recipients see in their mail program, but the technical return address of the transport – a difference that attackers deliberately exploit. In addition, the standard only allows ten DNS lookups per check; if you include several services via “include”, you exceed this limit faster than you might think, and the check fails. Forwarding can also defeat an otherwise correct record.
That is why SPF belongs in expert hands. walkingtoweb manages your DNS zones completely: we record all sending systems, keep the record lean and valid, and update it as soon as a new service is added.
DKIM – the signature that travels with the message
While SPF checks the route a message takes, DKIM secures the message itself. When sending, your mail server calculates a cryptographic signature over the content and the most important headers and attaches it invisibly to the email. The matching public key is stored in your domain's DNS. The receiving server retrieves it from there and recalculates: if the signature matches, the message demonstrably comes from one of your systems – and has not been altered in transit.
Its advantage over SPF lies in its mobility. The signature travels with the message because it is not tied to an IP address; it survives forwarding and intermediate hops. If, on the other hand, a mailing list changes the subject or adds a footer, the check fails. SPF and DKIM therefore do not replace each other – they complement each other, each covering the other's weakness.
In practice, care is what counts: 2048-bit keys, clean separation using selectors, regular rotation, and each service that sends in your name gets its own key. walkingtoweb sets up DKIM on your Kerio Connect server and in all connected services, stores the keys in the DNS and handles key rotation during live operation.
DMARC – the policy that brings both together
SPF and DKIM deliver check results, but no consequences. They do not say what should happen to a message that fails – and they do not look at the sender your recipients actually read. DMARC closes exactly this gap. The record requires the visible sender domain to match what SPF or DKIM have confirmed, and specifies how the receiving server should handle deviations: just monitor (p=none), quarantine (p=quarantine) or reject outright (p=reject).
The feedback channel is at least as valuable. Via a specified reporting address, you receive daily reports on who is sending with your domain worldwide – legitimate services as well as forgers. Only this picture allows a gradual path from monitoring to enforcement without losing your own invoices or newsletters along the way.
Since 2024, DMARC has no longer been optional: Google and Yahoo, and since 2025 Microsoft as well, require bulk senders to have a valid record. walkingtoweb accompanies you all the way – inventory of all senders, setup, analysis of the reports and controlled tightening up to p=reject.
Mail gateway – a filter in front of the mailbox
Authentication proves who wrote a message. It says nothing about whether the content is harmless. This task is performed by a mail gateway: an upstream instance between the open internet and your mail server, comparable to an attentive reception desk that checks every delivery before it enters the building. Your MX record no longer points directly to the server but to the gateway – every message passes through this one point first.
There, analysis takes place in fractions of a second: sender reputation, SPF, DKIM and DMARC, then text, links and attachments. Wanted mail passes through cleanly, while spam, viruses and phishing are rejected or quarantined – and that happens before the queue, so that unwanted load never even reaches your network.
The decisive difference from local virus scanners: the rules apply at one point for all mailboxes and every device, including smartphones and webmail. For this, walkingtoweb operates Proxmox Mail Gateway as a maintained, monitored service on Swiss infrastructure – with ClamAV, SpamAssassin, searchable quarantine and complete message tracking.
S/MIME – end-to-end confidentiality
SPF, DKIM and DMARC protect your domain, and a gateway protects your inbox. The content of a message, however, generally remains readable – on every server it passes through on its way. Anyone exchanging truly confidential information therefore needs the third layer: S/MIME, the encryption and signing of the individual message.
It is based on a personal certificate with a key pair. The private key stays protected with you, while the public key is contained in the certificate and may be shared freely. The digital signature proves beyond doubt that an email comes from you and has not been altered in transit; encryption ensures that only the intended recipient can read the content – not the provider, not an intermediate server, nobody else.
The certificate is set up directly in the mail program – in Outlook, Apple Mail or Thunderbird; after that, a single click is all it takes. S/MIME makes particular sense wherever legally sensitive information is exchanged: in law firms, fiduciary offices, healthcare and senior management. walkingtoweb supplies the appropriate certificates from DigiCert Thawte – Class 1 for individuals, Class 2 with verified company name – including setup and automatic renewal.
DNS management – the invisible foundation
SPF, DKIM and DMARC have one thing in common: they are not software that you install, but records in your domain's DNS. That is what makes them so effective – every receiving server in the world can query them – and at the same time so error-prone. One typo, a duplicate SPF record, a forgotten selector or a TTL set too short, and the protection no longer works or blocks your own mail.
To make matters worse, the landscape is constantly changing. A new accounting program sends invoices, marketing books a newsletter service, an online shop is added – each of these systems must be authorised and signed, otherwise its messages silently disappear into spam. Conversely, old records often remain in place for years and open precisely the doors you wanted to close.
That is why walkingtoweb provides DNS management as a service in its own right: complete zones in our hands, clean documentation of all sending systems, controlled changes with short waiting times and regular checks of the records. You tell us about the new service – we make sure it delivers.
Kerio Connect – secure email server
If you want to secure your email, you should know where it is stored. With large international platforms, this can often only be answered approximately: data is stored in data centres outside Europe, is subject to foreign laws and can be used for analysis. With Kerio Connect on Swiss servers, this relationship is reversed – you know the location, the jurisdiction and your contact person.
For security purposes, a dedicated, clearly defined mail server is worth its weight in gold. It is the one place where DKIM signatures are created, where TLS encryption is enforced, where filter and forwarding rules take effect centrally and where it is possible to trace what was actually sent. A manageable number of known sending systems is also the prerequisite for setting SPF and DMARC strictly at all.
walkingtoweb has been operating Kerio Connect as groupware hosting in Switzerland for many years – email, calendars, contacts and tasks in one solution, compliant with the FADP and GDPR, properly authenticated and protected behind a mail gateway. We handle the migration from your previous provider.
Five steps to a secured domain
The path to a protected email domain can be planned. It begins with an inventory: which systems send in your name today? Mail server, accounting, shop, newsletter, ticketing system, website forms – experience shows that there are considerably more than expected, and it is precisely the forgotten ones that cause trouble later.
In the second step, a clean SPF record is created that reflects exactly these systems and respects the limit of ten lookups. In the third, each sending system is given its own DKIM key. The fourth step initially sets DMARC to monitoring; over several weeks, the daily reports show who is actually sending – and regularly uncover both forgotten in-house services and misuse by third parties. Only when the picture is consistent does the fifth step follow: tightening the policy to quarantine and finally to reject.
walkingtoweb takes this path with you – from the analysis, the DNS records and the upstream mail gateway through to S/MIME certificates for particularly confidential correspondence. One contact, one point of responsibility, with clear documentation.
Managed email security with walkingtoweb
Notes on prices
The price shown is per domain and month, or per S/MIME certificate and year.
All prices are net prices; for Swiss customers, statutory VAT will be added to the invoice. EUR / USD prices are for information only; the CHF price, converted at the current daily rate, always applies. We will be happy to quote for further services on request.
Our General Terms and Conditions apply.
This price list is valid from 1 July 2026.
