Can someone send email pretending to be my business?
Worth sorting promptly
By default, yes — anyone can. Email was designed without any check on who a message claims to be from, and the “from” line is as easy to type as any other. SPF and DMARC are the two standard records that close that gap, and a great many small-business domains still have neither.
What SPF, DKIM and DMARC each do
SPF is a public list of which mail servers are allowed to send email for your domain. A receiving mail system can look it up and see whether the message it just got came from one of them.
DKIM adds a cryptographic signature to each message, so the receiver can confirm it genuinely came from your mail system and wasn't altered in transit.
DMARC is the instruction that makes the other two matter. It tells receiving systems what to do when a message fails those checks — nothing, put it in spam, or reject it outright — and, crucially, it asks them to send you reports about who is sending mail as you.
Without DMARC, SPF and DKIM are two locks with nobody told to check them.
Why this is the one Gus flags hardest
Because it's the mechanism behind the most common way small businesses get impersonated: an email to your customer or your supplier's accounts department, apparently from you, with new bank details.
Those emails succeed because they genuinely appear to come from your address. Not a lookalike domain — yours. Your customer has no reasonable way to tell.
Gus grades a domain that receives email but has neither record as needing attention rather than merely worth a look, because the risk lands on your customers rather than on you, and you'd never find out.
What a sensible rollout looks like
Don't start at the strict setting. A DMARC policy of “reject” applied on day one will silently bin legitimate email from your invoicing system, your booking tool and your mailing list provider — all of which send as you and all of which need listing in SPF first.
The standard approach is to publish DMARC at p=none, which changes nothing but starts the reports flowing, spend a few weeks finding every legitimate sender, then tighten to quarantine and finally reject.
This is a well-trodden job for whoever manages your domain, and usually takes under an hour of actual work spread over a few weeks of watching.
How to check this yourself
- You can check this from any computer without special access, using a free public DNS lookup site (search for “DNS TXT lookup”).
- Look up a TXT record for your domain — yourbusiness.co.uk. If SPF is set up, one of the results starts with “v=spf1”.
- Then look up a TXT record for _dmarc.yourbusiness.co.uk. If DMARC is set up, the result starts with “v=DMARC1”.
- Look up the domain itself, not the www address. These records live on yourbusiness.co.uk; www.yourbusiness.co.uk almost never has its own copy, so a lookup there comes back empty even when your records are properly in place.
- No results, or results without those prefixes, means the record isn't there. Note that DKIM can't be checked this way without knowing the selector name — Gus tries the common ones.
What to ask your web person
Copy this. It's phrased so you don't have to know the jargon to ask for the right thing.
Could you add SPF and DMARC records for our domain? I'd like to start DMARC at p=none with reports coming to us, make sure every legitimate sender (our mail provider, invoicing, booking system and mailing list) is covered by SPF, and then move to quarantine and reject once the reports look clean.
Want to know if this applies to your site?
Gus checks this and everything else in the free check-up, then explains what he found in plain English. It's free, there's no account, and it takes about a minute.