BitFlip Technologies
Get in touchContact
Menu
Security Notes

Stop criminals sending email as you

By Travis Baldwin, Founder & Principal ConsultantLast reviewed 2 min read

The short version

  • Anyone can send an email that claims to come from your domain, unless your domain's settings say otherwise.
  • Three records fix this: SPF lists who may send for you, DKIM signs your mail, and DMARC tells receivers what to do with fakes.
  • Start DMARC in monitoring mode, read the reports, then tighten it once your real email passes.
  • Domains you don't send email from need records too, so they can't be borrowed for spoofing.

Why this matters

Email was designed decades ago with no built-in way to prove who sent a message. Without the right records, a criminal can send an invoice "from" [email protected], and it may land in a customer's inbox looking completely genuine.

The big email providers now push hard on this. Since February 2024, Google requires anyone sending more than 5,000 messages a day to Gmail to have all three records in place, and Yahoo has similar rules. Even if you send far less, these records make your real email more likely to arrive and fake email more likely to be blocked.

The three records, in plain English

  • SPF (Sender Policy Framework) is a published list of the services allowed to send email for your domain, such as Microsoft 365, Google Workspace or your newsletter tool.
  • DKIM (DomainKeys Identified Mail) is a digital signature your email provider adds to each message. Receiving servers check it against a key published with your domain, so forged or tampered mail fails.
  • DMARC is your instruction to receiving servers: what to do with mail that fails those checks (nothing, send it to spam, or reject it) and where to send reports.

Setting them up

  1. List everything that sends email as your domain: your mailbox provider, website contact forms, newsletter and invoicing tools, and anything else that sends "from" your address.
  2. Publish one SPF record that includes every one of those senders. A domain should have exactly one SPF record; two of them cancel each other out.
  3. Turn on DKIM in your email provider's admin settings and add the records it gives you. Repeat for any other service that sends for you.
  4. Add a DMARC record in monitoring mode (a policy of "none") with an address for reports. For a few weeks, the reports show which services send as you and whether they pass.
  5. Tighten the policy once every legitimate sender passes: first to "quarantine," then to "reject." That last step is what actually stops spoofing.

Don't forget your other domains

If you own domains you don't send email from, such as an old business name or a common misspelling, publish records that say so: an SPF record that allows no senders and a DMARC policy of "reject." Otherwise criminals can borrow those domains instead of yours.

Check your work

Your email provider's admin console usually shows whether SPF, DKIM and DMARC are passing, and free online checkers will read your records for you. Check again whenever you add a new tool that sends email, and pair this with a payment rule for invoice scams, since no setting stops every fake.

More Security Notes