If your domain has no email authentication, anyone can send messages that appear to come from your addresses, and receiving servers have no reliable basis to reject them. Invoices, payment-detail changes, and password resets can all be spoofed convincingly. The fix is DNS configuration rather than software, and it is one of the highest-value afternoons available to a small business.

What each record does

  • SPF lists which servers are permitted to send mail for your domain.
  • DKIM adds a cryptographic signature so recipients can verify a message was not altered and came from an authorised sender.
  • DMARC tells receivers what to do when a message fails those checks, and asks them to send you reports about it.

Inventory before you enforce

The common failure is enabling enforcement and discovering a week later that invoices, marketing mail, or booking confirmations have stopped arriving. Before changing anything, list everything that sends mail as your domain: your mail provider, CRM, invoicing tool, marketing platform, helpdesk, website contact forms, and any application notifications. Each one needs to be authorised.

Roll out in stages

Publish SPF and DKIM first. Then publish DMARC in monitoring mode, which changes nothing about delivery but produces reports showing everything sending as you. Read those reports for a few weeks, authorise the legitimate senders you find, then move to quarantine, and finally to reject. Skipping the monitoring stage is what causes the outages that give this work a bad reputation.

What enforcement actually prevents

DMARC at reject stops exact-domain spoofing. It does not stop lookalike domains — an attacker registering a similar-looking name can still send mail that passes their own checks. Pair enforcement with monitoring for registrations resembling your domain, and with the procedural control that matters most: verifying payment-detail changes by phone, regardless of how authentic a message appears.

While you are in there

Set an external-sender banner so staff can see at a glance when a message originated outside the organisation, and alert on new mailbox forwarding rules. Those two additions cost nothing and address the mechanics behind most business email compromise cases we see.