This month we ran the same check on every site we build and host, and on a few dozen local businesses that asked for an audit. The single most common finding was not a hacked site. It was a domain that anyone could send email from, with nothing telling Gmail or Outlook to reject it.
That sounds abstract until it happens: a customer gets an invoice from your address with someone else's bank details, pays it, and calls you. Or the quiet version: your real emails land in spam, and you never find out why the quotes stopped getting answered.
The three records, in plain English
- SPF is a list of who is allowed to send mail for your domain: your email provider, your website's contact form, your newsletter tool. It lives in a DNS record on your domain. Mail from anywhere else fails the check.
- DKIM is a signature. Your email provider signs each message with a private key; the matching public key sits in your DNS. A mailbox that receives the message can prove it was not altered and really came from a sender your domain trusts.
- DMARC is the instruction. It tells the receiving mailbox what to do when a message fails SPF and DKIM: do nothing (p=none), send it to spam (p=quarantine), or refuse it (p=reject). Without DMARC, the other two are advice nobody has to follow.
What we find on local domains
Most domains have SPF, because the email provider's setup wizard adds it. Fewer have DKIM, because that step is a separate screen nobody goes back to. And most that have DMARC have it set to p=none, which is the default Google and Microsoft hand you. None means: watch, but let everything through.
A domain with SPF only, or with DMARC at none, can be forged. The forged message might land in spam at a careful mailbox, or it might land in the inbox. Your customers' mailboxes are not all careful.
Check yours in a minute
- Run the free checkType your website into the free website check. The Security section reports SPF and DMARC for your domain and says plainly whether forged mail is rejected.
- Or look it up by handAny DNS lookup tool can show the TXT records for your domain and for _dmarc.yourdomain.com. You want a line starting v=spf1 on the first, and v=DMARC1 with p=quarantine or p=reject on the second.
- Find your DKIMYour email provider's admin area has a page called something like Authenticate email or DKIM. It shows whether signing is on and gives you the record to add if it isn't.
What to fix, in order
- Turn on DKIM at your email provider first. Google Workspace, Microsoft 365 and most hosted mail have a one-page setup that gives you a record to add to DNS. Until this is on, enforcing DMARC can send some of your own mail to spam.
- Make sure SPF names every service that sends as you: the mail provider, the website's forms, the newsletter tool, the invoicing app. A service you forgot will fail the check the moment you enforce.
- Then set DMARC to p=quarantine. Forged mail goes to spam; your real mail, signed and listed, goes through. After a few weeks with no problems, p=reject.
- Put the domain in the business owner's name and account. Half the broken email we see traces back to a domain that still belongs to a former web designer or a former employee.
Why it matters more than it sounds
Google and Yahoo now require DMARC for anyone sending real volume, and they treat unsigned mail from unknown domains with suspicion. The practical effect for a small business is simple: the three records on, your quotes and invoices reach the inbox; the records off, some of them don't, and you never see which.
It is also the cheapest security fix that exists. No software, no subscription. Three DNS records, set once, checked occasionally. We check them every five minutes on every site we run, and once a month for everything we look after.
Written by Nikita Huttenlocher, founder and lead engineer at Huttenlocher Technologies, a web design and software company in Myrtle Beach, South Carolina.