Email security · checked 13 October 2026
Can someone send email as your domain?
Email was built without proof of sender. Unless your domain publishes three DNS records, anyone can send a message "from" accounts@yourcompany.com, and your customers' inboxes will often accept it. That's how most fake-invoice fraud starts.
The three records
| Record | What it does | What good looks like |
|---|---|---|
| SPF | Lists the servers allowed to send your email | v=spf1 include:_spf.google.com -all (one record, ending in -all or ~all) |
| DKIM | Signs each email so receivers can check it wasn't forged or changed | A key published by your email provider at selector._domainkey |
| DMARC | Tells receivers what to do when SPF and DKIM fail, and sends you reports | v=DMARC1; p=quarantine; rua=mailto:dmarc@yourcompany.com, then p=reject |
SPF and DKIM alone don't stop spoofing, because they don't check the "From" address people actually see. DMARC does. A DMARC policy of p=none only watches; it's a starting point, not protection.
Why it matters more now
Google and Yahoo (since February 2024) and Microsoft Outlook (since May 2025) require bulk senders to have SPF, DKIM and DMARC. Without them your newsletters and invoices can land in spam or bounce, on top of the spoofing risk.
How to fix it, in order
- Make sure you have exactly one SPF record listing every service that sends mail for you (email provider, newsletter tool, invoicing app).
- Turn on DKIM in your email provider's admin panel (Google Workspace: Apps → Gmail → Authenticate email; Microsoft 365: Defender → Email authentication) and publish the key.
- Add DMARC with
p=noneand a report address. Read the reports for two to four weeks to find any legitimate senders you missed. - Move to
p=quarantine, thenp=reject.
Sources: RFC 7208 (SPF), RFC 6376 (DKIM), RFC 7489 (DMARC); Google, Yahoo and Microsoft bulk-sender requirements.