Can someone send email as your business?
For most small businesses, yes. Here's why, and the three records that fix it.
The problem
Email was designed without any proof of who sent a message. Anyone can put billing@yourbusiness.com in the From line. Scammers use this to send fake invoices to your customers, or payment-change requests to your bookkeeper, and the email looks like it came from you.
The fix: three DNS records
- SPF lists the services allowed to send email for your domain, such as Google Workspace, Microsoft 365 or your email marketing tool.
- DKIM adds a digital signature to your real emails so inboxes can check they weren't forged or changed.
- DMARC tells inboxes what to do with email that fails those checks: nothing (
p=none), send it to spam (p=quarantine), or block it (p=reject).
A DMARC record set to p=none is a good first step because it lets you watch reports, but it doesn't stop anything. The goal is quarantine or reject once your legitimate senders are all covered.
Why do it now
Google and Yahoo now require SPF, DKIM and DMARC from bulk senders, and many cyber-insurance applications ask about email authentication. Setting it up also makes your own emails less likely to land in spam.
Check yours
Our free check reads your public DNS records and tells you where you stand in about 20 seconds. If something's missing, we can set it up.
Another guide: The 10-minute website checklist.