SPF, DKIM and DMARC, explained
Three records on your domain that stop criminals from sending email that looks like it came from you, set up carefully and watched over time.
Request a QuoteEmail trusts the return address, so anyone can send a fake invoice or payment request that appears to come from your company. SPF, DKIM and DMARC fix that. Setting them up wrong can block your own mail, so the work is in reading the reports and tightening in careful steps.
We read your current records and see who is really sending mail as you.
We list every legitimate sender and authorize it properly.
DMARC reports show forged mail attempts and any real mail failing the checks.
We move the policy from watching to quarantine to reject, one step at a time.
A posted list of which mail carriers are allowed to deliver letters in your name. If a letter arrives from a carrier that is not on the list, the receiving mailroom knows to be suspicious.
Every real letter gets a seal only you can make. If the seal is there and unbroken, the letter is genuine and nobody changed it on the way. A forger cannot copy it.
Your standing note to every mailroom: "If a letter claiming to be from us fails the list or the seal, here is what to do with it," and "send us a report." It is the rule that turns the first two checks into protection.
The DMARC instruction has three settings. We do not jump to the top. We start by watching, read the reports, make sure your real mail passes, and then tighten.
Watch only. Reports arrive, nothing is blocked. Forged letters still get delivered.
Letters that fail are held back in the junk pile instead of reaching the inbox.
Forged letters are refused at the door. This is the goal for your domain.
What a DMARC report boils down to once we have read it for you. This is an illustration, not a real client.
| Who sent mail as example-business.com | SPF list | DKIM seal | Our call |
|---|---|---|---|
| Cloud email (staff mail) | Pass | Pass | Good. Leave alone. |
| Invoicing software | Fail | Fail | Real sender, not authorized yet. Fix before tightening. |
| Unknown server overseas | Fail | Fail | Forgery attempt. This is what reject stops. |
Email never checked who was really sending. Anyone can type your name and domain in the "from" line, and without these three checks the receiving mailroom has no way to say no. Criminals use that to send fake invoices, fake payment-change requests and fake messages "from the owner" to your staff and your customers. Small businesses are attractive because the mail looks routine and nobody is watching for it.
A rushed setup can block your own legitimate mail: invoices from your billing software, newsletters, a scheduling tool. Customers then never see them and nobody tells you. A half-finished setup can also look protected while still letting forgeries through. That is why we read the reports first and climb the ladder in order.
Most small-business IT providers skip it because it is fiddly and easy to break. But a forged email that looks like it came from you can cost a customer their money and cost you their trust. We are a security company before we are anything else, so we set it up properly, watch the reports on an ongoing basis, and explain what we see in plain English.
Email protection is not a switch we flip on day one. Done properly it moves in stages, because the goal is to block forged mail without ever blocking your real mail. Plan on about two weeks of careful watching before the first blocking step, and a month or more to reach the strictest setting.
We need access to the place your domain's settings live. Nothing can move without it.
We read your current records, fix what is missing or wrong, and start collecting reports.
Reports show who is really sending mail as you. We find every real sender and authorize it.
We begin holding failing mail back, starting with part of it and raising it as the reports stay clean.
After several clean weeks, forged mail is refused outright. We do not rush this step.
These are typical timings, not promises. Your access, and how many services send mail for you, set the real schedule.
Very little. You hear from us at each stage in plain English: what we found, what we are about to change, and what to watch for. Before every tightening step you get a heads-up, and your real mail keeps flowing the whole way.
A real example from our own work, and the patterns we see most often when we look at a business's email setup.
A plain-English summary of what the reports show, and a heads-up before any policy change.
Not if it is done in order. That is why we start by watching and read the reports before tightening.
The three work together. Each covers something the others do not.
Plan on about two weeks of watching before the first blocking step, and a month or more to reach the strictest setting. Your domain access is the biggest factor.
Tell us about your business and what you use. We will come back with a plan that fits. Deciphering all of your technology needs.
Request a Quote