By default, anybody on the internet can send an email that appears to come from your domain. Not a lookalike domain — yours, exactly. Email was designed in an era that assumed good faith, and nothing in the protocol itself checks that a sender is who they claim to be.
What stops it is a small set of DNS records. Most small business domains have some of them, incompletely, and almost nobody has been told what they do.
Why this matters more than it sounds like it does
Two consequences, and the second surprises people.
The obvious one is impersonation. Somebody sends your customers an invoice with changed bank details, from your address. Your customers have no way to tell, because as far as their mail software is concerned it genuinely came from you. Invoice redirection fraud of exactly this shape is one of the most common frauds against UK small businesses.
The less obvious one is that missing records damage your own email. Receiving mail providers use these records to decide whether to trust a message. A domain with no SPF record and no DMARC policy is a domain they have no reason to trust, so your quotes and invoices are more likely to land in spam. Businesses often spend months trying to fix a deliverability problem that is actually a missing DNS record.
SPF: who is allowed to send as you
An SPF record is a line in your DNS listing the servers permitted to send email using your domain. Your mail provider is on it; so is anything else that sends on your behalf — a newsletter tool, an invoicing system, a booking platform, your website's contact form.
Two failure modes are worth knowing. Having no SPF record at all means nothing can be checked, so nothing is trusted. Having one that omits a service you actually use means that service's mail gets treated as forged — which is how a business ends up with its own invoicing system in customers' spam folders.
It is a single DNS record and most providers document the exact value to use.
What we check for this
DMARC: what to do about mail that fails
SPF says who may send. DMARC says what a receiving server should do when something fails the check, and — the part that makes it genuinely useful — asks for reports about what is being sent in your name.
The policy has three settings. 'None' means take no action but send reports, which is where everybody should start. 'Quarantine' sends failures to spam. 'Reject' refuses them outright.
Starting at 'none' is not timidity, it is the correct order. The reports tell you what is legitimately sending as your domain, and there is nearly always something you had forgotten — an old newsletter tool, a CRM, a printer. Moving straight to 'reject' before you know that list is how a business stops its own invoices being delivered.
What to actually do
This is a job for whoever manages your domain's DNS, and it takes minutes rather than days. If you do not know who that is, it is usually whoever you bought the domain from.
Publish an SPF record listing every service that sends mail as you. Publish a DMARC record set to 'none' with a reporting address. Read the reports for a few weeks, add anything legitimate you had forgotten, then move the policy to 'quarantine' and eventually 'reject'.
One warning: this is entirely invisible on your website. Nothing about your pages will change, no visitor will notice, and you will get no feedback that it worked other than the reports. That is exactly why it goes unaddressed for years — there is nothing to look at.
Find out where your site stands
Everything described above is something the scanner looks for, with the evidence for each result on your own pages. Free, no account, first findings in about twenty-five seconds.
Scan my siteThe checks behind this guide
- Email cannot be forged from your domain (SPF)There is no record saying which servers are allowed to send email as you. That means someone can email your customers from your address, and it also means your own legitimate email is more likely to land in spam.
- You are told when someone forges your email (DMARC)DMARC tells mailbox providers what to do with email that fails your other checks, and sends you a report when someone tries. Without it, impersonation attempts happen silently.
- Your DMARC policy acts on forged emailA DMARC policy of 'none' asks mailbox providers to report forgeries and then deliver them anyway. That is the right place to begin — the reports are how you find out which services legitimately send mail as you — but on its own it stops nothing. Most domains that publish DMARC never move past it, and monitoring is easily mistaken for protection.
- Forms submit over a secure connectionA form that posts to a plain HTTP address sends everything typed into it unencrypted, readable by anything between the visitor and your server. Browsers warn about it directly on the field when the form collects a password or payment details. A page can be served over HTTPS and still have a form that submits insecurely, which is why this is checked separately from the connection itself.