SPF, DKIM and DMARC: Stop Criminals Sending Email as Your Business

Here’s an uncomfortable experiment: if your domain doesn’t have email authentication set up, a criminal can send an invoice to your customers from what looks exactly like your address — and many mail systems will deliver it. The fix isn’t a product. It’s three DNS records that most SMBs have either never set, or set once, wrongly, in 2019.

The three records, in plain English

• SPF lists the servers allowed to send mail for your domain — like a guest list for your name.
• DKIM adds a cryptographic signature to each message proving it really left your systems unaltered — a wax seal.
• DMARC is the enforcement policy: it tells receiving mail systems what to DO with messages that fail the first two checks (nothing, quarantine, or reject) and sends you reports about who is sending as you.

Why this protects more than your inbox

Email authentication is outward-facing protection: it defends your customers and suppliers from criminals wearing your name — the exact mechanics of invoice fraud. It also improves deliverability (Google and Microsoft increasingly distrust unauthenticated senders) and it’s a standard question on cyber-insurance forms and supplier reviews. An unauthenticated domain quietly fails all three tests.

The safe rollout order

• Inventory every legitimate sender first: Microsoft 365, your newsletter tool, accounting software, website forms. Missing one is how businesses accidentally block their own invoices.
• Set SPF covering that list, and enable DKIM signing in each service (Microsoft 365 makes this a few clicks).
• Add DMARC in monitoring mode (p=none) and watch the reports for a few weeks — they show every source sending as your domain, legitimate and otherwise.
• Tighten to quarantine, then reject, once the reports are clean. Reject is the goal: mail that fails simply doesn’t arrive.

The mistake to avoid

Don’t jump straight to p=reject on day one — that’s how a business blocks its own marketing platform mid-campaign. And don’t stop at p=none forever, which is monitoring without protection; a surprising number of “compliant” domains sit there indefinitely. This whole exercise is an hour of specialist work plus a few weeks of watching reports — one of the highest-leverage hours in all of small-business security.