Can someone send email as your business?

Email has no ID check

The "From" line of an email is just text the sender types, like the return address on an envelope. Without extra protection, anyone can send a message that appears to come from your address. Scammers use it to send fake invoices to your customers, or fake "change our bank details" requests to your vendors. The FBI ranks this kind of fraud, business email compromise, among the costliest cybercrimes, with losses in the billions of dollars every year.

The three records that fix it

• SPF is a public list of the mail servers allowed to send email for your domain.
• DKIM adds a digital signature to each message, so receivers can verify it really came from you and wasn't altered.
• DMARC ties the two together and tells Gmail, Outlook and Yahoo what to do with messages that fail: nothing (p=none), send them to spam (p=quarantine) or refuse them (p=reject).

A domain with no DMARC record, or one stuck at p=none, gives receivers nothing telling them to stop fake messages.

Check yours in two minutes

Look up your domain with a free DMARC checker (search "DMARC lookup"), or use our free email and website check. Both read only public DNS records, the same information every mail server checks when it receives a message from you. Nothing on your systems is touched.

Fix it without breaking your own email

Jumping straight to p=reject can block your own invoices, booking confirmations or newsletters if one of those tools isn't set up correctly. The safe order:

• List everything that sends email as your domain: your mailbox provider, website forms, invoicing, booking and newsletter tools.
• Make sure SPF includes each of them, and turn on DKIM in each one.
• Publish DMARC at p=none with a reporting address and watch the reports for a week or two.
• Move to p=quarantine, then p=reject, once only legitimate senders show up.

Why it matters even more now

Since 2024, Gmail and Yahoo require bulk senders to have SPF, DKIM and DMARC in place, and every sender needs at least SPF or DKIM. Fixing this protects your customers from impersonation and helps your own emails land in the inbox.

Want it handled? Tell us about your business and we'll take a look.