Without Email Security, Anyone Can Be You: SPF, DKIM and DMARC for Small Businesses

The email system that every business runs on was designed in the early 1980s, and it has no built-in check that the name in the "From" field is telling the truth. Anyone with a mail server can put your domain on an outgoing message. Unless your domain publishes records that say otherwise, receiving servers have no way to know it is fake.

That is not a theoretical weakness. It is the mechanism behind the most expensive category of cybercrime reported to the FBI: business email compromise, which cost victims $2.77 billion across 21,442 reported cases in 2024 (FBI Internet Crime Report 2024). Phishing was the most reported crime of all, with 193,407 complaints. In the UK, the government's Cyber Security Breaches Survey 2025/26 found that 43% of businesses identified a breach or attack in the last year, and phishing was involved in 85% of them.

The attacks that start with a spoofed domain:

None of these requires the attacker to break into anything of yours. That is why the fix is not "better passwords"; it is telling the world's mail servers how to recognise the real you.

SPF, DKIM and DMARC are DNS records on your domain. Together they let any receiving mail server answer one question: "is this message really from this domain?"

The part most businesses miss: SPF and DKIM on their own do very little. They give receivers evidence; DMARC is the instruction to act on it. A domain with SPF and DKIM but no DMARC, or DMARC set to "none", is still spoofable, which is why our audit caps the overall score by the DMARC policy however good the other two records are.

The common mistakes

• SPF that lets everything through. A record ending in +all or ?all, which authorises the entire internet and which our audit scores as zero. Or one that has grown past the limit of 10 DNS lookups, at which point receivers ignore it entirely.
• Forgotten senders. The CRM, the invoicing platform, the newsletter tool and the website's contact form all send as your domain. If they are not in SPF and not signing with DKIM, DMARC will eventually block your own mail.
• DKIM never enabled. Microsoft 365 does not sign with your domain until the CNAME records are added and DKIM is switched on in the admin centre.
• DMARC at p=none forever. Reporting mode is the right place to start and the wrong place to stay.
• Unused domains left open. The old brand, the .com you bought defensively: if they can receive email, they can be spoofed. They need an SPF record that authorises nothing (v=spf1 -all) and DMARC at reject too.

Two things changed in the last two years.

The big mailbox providers now require it. Since February 2024, Google and Yahoo require anyone sending 5,000 or more messages a day to their users to have SPF and DKIM, a DMARC record (at least p=none) and aligned authentication. Microsoft followed on 5 May 2025 for senders of 5,000+ messages a day to Outlook.com, Hotmail and Live: non-compliant mail goes to junk, then gets rejected. Most small businesses do not send 5,000 a day, but the same providers apply the same signals to everyone's reputation, and every marketing platform you use is subject to the rules when it sends on your behalf.

Insurers, customers and Cyber Essentials ask about it. Cyber insurance questionnaires routinely ask whether DMARC is enforced. Supplier security questionnaires ask. It appears in the guidance for Cyber Essentials' email controls. Our own domain security audit is used by businesses checking their suppliers as much as by businesses checking themselves.

And the attackers moved first. Spoofing an unprotected domain costs nothing and is automated. A domain at DMARC reject is simply not worth their time; they move to the next one.

Run the free domain security audit. It looks up your SPF, DKIM and DMARC records, your mail provider, your SSL certificate, your registrar and domain expiry, and whether your domain appears on blocklists. The score out of 100 comes from the three email records only; the rest is reported alongside.

This is exactly how the score is built, taken from the tool's own logic, so you can read your result rather than guess at it.

The three records each earn up to a third

One honesty note on DKIM: selectors cannot be discovered from DNS, so the audit probes a list of common ones (including Microsoft 365's and Google's). If it finds nothing it reports "DKIM could not be verified" as a warning rather than a failure, because large brands often use custom selectors. Zero points are awarded either way, so if you know your selector and the audit shows a warning, that is a signal to check DKIM is actually enabled, not proof that it is broken.

Then DMARC caps the total

The three scores are added, and the total is then capped by your DMARC policy, because without enforcement SPF and DKIM are evidence nobody acts on:

So a domain with perfect SPF and a 2048-bit DKIM key but no DMARC record scores 30. The same domain at p=none scores 40. That is not the tool being harsh; it is the tool telling the truth about whether the domain can be spoofed today.

Reading a typical result

• Score in the 30s or 40s, SPF pass, DKIM pass: the records exist, DMARC is missing or at none. The fix is the DMARC ramp described below, and it is the single biggest jump available.
• Score around 60 to 80: DMARC is at quarantine. Forgeries go to spam. Moving to reject, once the reports are clean, takes you to the top.
• SPF warning with "DNS limits exceeded": too many includes; receivers ignore the record entirely. Consolidate the senders.
• DMARC score lower than expected at reject: check pct= and sp=; a pct=50 or a permissive subdomain policy halves the credit.

The audit is also available as an API for partners and CRMs that want to check many domains, and every scan is recorded so a domain's posture can be tracked over time.

The danger in fixing email security is that a DMARC reject policy applied to a domain with a forgotten sender blocks your own invoices. The sequence that avoids it:

1. Inventory every sender. Mail platform, marketing tool, CRM, accounting, helpdesk, website forms, printers and scanners, the third party that sends statements for you. This list is always longer than expected.
2. Fix SPF to include exactly those senders, within the 10-lookup limit, ending in ~all. (A strict -all is defensible but breaks legitimate forwarding, which is why our audit scores ~all as the standard configuration.)
3. Enable DKIM on the mail platform and on every third-party sender that supports it (most do). Use 2048-bit keys where offered.
4. Publish DMARC at p=none with reporting (the rua address) and wait. Two to four weeks of reports show every source sending as your domain, legitimate and not.
5. Fix what the reports show: the senders you missed, the platform signing with its own domain instead of yours.
6. Move to p=quarantine, optionally with pct= to ramp, then to p=reject. Apply the same to subdomains (sp=) and to unused domains.
7. Keep watching. New tools get added, keys rotate, a marketing agency starts sending. Without monitoring, a domain drifts back to broken in months.

Step 4 is where a plain DNS change becomes a project, because DMARC reports arrive as XML attachments, dozens a day, from every receiving provider. Nobody reads them by hand. That is what monitoring is for.

A DMARC record tells receivers what to do. DMARC reports tell you what is happening: which servers sent mail as your domain, how much, and whether it passed SPF and DKIM. They are the only view you have of attempted spoofing and of your own senders drifting out of alignment.

We run a DMARC monitoring service that receives those reports for your domain, parses them and turns them into something readable: every source sending as you, the volumes, pass and fail rates, and a flag when a new source appears or a known one starts failing. In practice that means:

• A safe path to reject. You can see exactly which legitimate senders would be blocked before you tighten the policy.
• Early warning of impersonation. A spike in failing mail from an unfamiliar country is a spoofing campaign in progress, and you find out from the report rather than from an angry customer.
• Catching your own drift. The new CRM someone signed up for, the newsletter platform that rotated its DKIM key: visible in the reports the day it starts, not when invoices start bouncing.
• Evidence. For insurers, auditors and Cyber Essentials, a report showing DMARC enforced and monitored.

Monitoring is included for our managed clients and available on its own for businesses that just want their email security looked after. The domain audit page explains how to point your reports at us.

SPF, DKIM and DMARC stop other people sending as your domain. They do not stop every email threat, and it is worth being clear about what else a business needs:

• Lookalike domains. Criminals register yourcompany-ltd.co.uk or replace an l with a 1. DMARC on your domain does nothing about that; staff awareness, Defender for Office 365's impersonation protection and, for some businesses, defensive registrations do.
• Compromised accounts. If an attacker steals a real password and sends from your real mailbox, every record passes. That is what MFA and Conditional Access are for; see our Microsoft 365 licensing and security guide.
• Inbound filtering. Your own records protect other people from fake you. Protecting your staff from fake everyone-else is inbound filtering: Exchange Online Protection on every plan, Defender for Office 365 on Business Premium.
• BIMI, the logo-in-the-inbox standard, requires DMARC at enforcement and a verified mark certificate. Nice to have; not a security control.

Email security is the first thing we fix for a new client, because it is the highest-impact change for the least money and it protects your customers as well as you. The engagement is short:

1. Audit. The free domain check, then a full inventory of senders and domains, including the ones you forgot you own.
2. Fix. SPF within limits, DKIM on every sender, DMARC published with reports coming to our monitoring.
3. Ramp. From none to quarantine to reject, on the evidence, without blocking your own mail.
4. Monitor. Ongoing DMARC reporting, alerts on new sources and failures, and a quarterly check that nothing has drifted.

We do this for businesses that are not otherwise clients, and it is often how the relationship starts. If you would rather see where you stand first, run the audit.