When we onboard a new client, checking email authentication is one of the first things we look at, and it’s wrong — missing entirely, or configured incorrectly — more often than almost anything else we check. That gap is exactly what makes convincing phishing and invoice-fraud emails possible: without these records, anyone can send email that appears to come from your domain.
SPF: who’s allowed to send
An SPF record is a DNS entry listing which mail servers are authorized to send email on behalf of your domain. Without one, a receiving mail server has no way to tell your real mail server apart from an attacker’s. The catch: SPF breaks quietly when you add a new marketing tool or CRM that sends email on your behalf and nobody updates the record — it’s one of the most common "we didn’t know that broke" issues we find.
DKIM: proving the message wasn’t altered
DKIM adds a cryptographic signature to outgoing email, so the receiving server can verify the message actually came from your server and wasn’t modified in transit. SPF checks the sender; DKIM checks the message itself. Both matter, and having only one is a common half-measure we see.
DMARC: what happens when a check fails
DMARC ties SPF and DKIM together and tells receiving servers what to do when a message fails both — reject it, quarantine it, or just report it. This is the piece most businesses skip entirely, because getting it wrong can silently block legitimate email. Our approach is to roll it out in monitor-only mode first, review the reports for a few weeks to catch anything legitimate that would fail, and only move to enforcement once we’re confident nothing real gets blocked.
Why this is worth doing properly
Business email compromise — an attacker sending a convincing invoice or wire-transfer request that looks like it’s from your domain — is one of the most financially damaging attack types for small businesses, and correctly enforced DMARC is one of the more effective, low-cost defenses against it. It won’t stop every phishing attempt, but it closes off the specific technique of impersonating your own domain, which is the version of the attack that’s hardest for an employee to spot on their own.