Anyone can send an email that claims to come from your business address. It's called spoofing, and scammers use it to send fake invoices to your customers. Three settings on your domain help stop it: SPF, DKIM and DMARC.
They also help your real emails land in the inbox instead of spam.
What each one does
- SPF is a list of the services allowed to send email for your domain, like Google Workspace, Microsoft 365 or your newsletter tool.
- DKIM adds a digital signature to your emails, so the receiving server can tell they weren't changed on the way.
- DMARC tells other email servers what to do with an email that fails those checks: let it through, send it to spam, or reject it. It can also send you reports.
All three are text records in your domain's DNS settings. You set them up once.
How to tell if you have them
Many businesses have SPF but no DMARC, which leaves the door half open. You can look at your DNS settings with whoever manages your domain, or use a free checker. Deedbox checks SPF and DMARC as part of its free check and tells you which are missing.
How to set them up
- SPF: your email provider gives you the exact record to add. Make sure there's only one SPF record, listing every service that sends email for you.
- DKIM: switch it on in your email provider's admin settings, then add the record it gives you.
- DMARC: start with a gentle policy that only reports, such as
v=DMARC1; p=none; rua=mailto:you@yourbusiness.com.au. Once you're sure your real email passes, changep=nonetop=quarantine.
If DNS settings feel daunting, this is a ten-minute job for your web designer or IT person. Send them this article.
Check yours
Deedbox shows whether your domain has SPF and DMARC, alongside your domain ownership and renewals. Free, no sign-up.