Here is a test. Right now, could someone send your customers an email with your name, your logo and your exact email address, plus a link to a payment page on a website one letter off from yours? For a lot of small businesses, the honest answer is yes.
How the scam works
Nobody breaks into anything. Email was built so the "from" line is just text, and unless your domain tells receiving mail servers what to do with a message that fails a check, many of them deliver it anyway. The customer sees your name and pays an invoice. The money goes to the scammer, and a couple of billing cycles can go by before anyone notices.
The lookalike payment link matters, because the "from" address can be made to look exact, but the link has to point somewhere the scammer controls. That is where a domain one letter off from yours comes in.
What three short records do
Three records in your domain settings answer one question for the receiving server: is this message really from this company, and what should I do if it is not?
SPF lists the servers that are allowed to send mail for your domain. DKIM puts a signature on each message that proves it was not altered and came from a sender you authorized. DMARC ties the two together and tells the receiver what to do when a message fails: watch only, quarantine it, or reject it.
When the records are missing, or DMARC is set to "just watch," the answer for a fake message is to deliver it anyway. That is the setting on a lot of small-business domains.
Are you getting a daily DMARC report?
A DMARC report is a short daily summary of every server that sent email using your name, the real ones and the fake ones. If you have never seen one, nobody is watching. Getting the reports is how you find out which of your own tools send as you, and which senders you never authorized.
What setting it up properly looks like
You start by watching, so you can see every legitimate sender and not block your own invoices or newsletters. Once the real senders are authorized, you move the policy to quarantine and then reject. It is a short job, and nobody on your team will ever notice it is there. That is the point. It is protection that only shows up on the day it is needed.
The big mailbox providers have also raised the bar for senders. Google and Yahoo began requiring authentication for bulk senders in 2024, so a domain with no records can have legitimate mail filtered too.
Check your own domain
Our free email protection check takes your web address and tells you in plain words whether your domain is protected, partly protected or not protected. It looks only at public records and stores nothing about what you checked. If you want a person to look at the result with you, we will check your domain for free, even if you never work with us. We think email security matters that much.
This is also the kind of thing a managed IT partner should be watching for you. A related habit: who owns your technology decides whether anyone notices when these records are wrong.
If you would like a second set of eyes on this, call or text (316) 347-7630, or send us a note.