Brighton Top 10 Restaurants - Email Security Scores

Brighton, a city known for its dynamic hospitality sector, relies heavily on digital communications for bookings, marketing, and customer engagement. This reliance, while convenient, introduces significant cybersecurity exposures. Our analysis of leading local restaurants revealed that many, despite excelling in their primary business, have fundamental weaknesses in their email and domain security. These vulnerabilities are not unique to the restaurant trade; they are prevalent across UK SMEs, leaving organisations susceptible to sophisticated phishing and spoofing attacks, with direct consequences for customer trust and operational integrity.

What Email Security Scores actually mean

When we discuss "email security scores" in this context, we are referring to the proper implementation of three critical protocols: Sender Policy Framework (SPF), DomainKeys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting & Conformance (DMARC). These are not esoteric concepts; they are foundational DNS records designed to verify that an email claiming to be from your domain genuinely originated from an authorised source.

SPF allows a domain owner to publish a list of mail servers permitted to send email on their behalf. DKIM provides a cryptographic signature that verifies the email's sender and ensures the message content has not been tampered with in transit. DMARC builds upon SPF and DKIM by instructing receiving email servers on how to handle messages that fail these authentication checks, such as quarantining or outright rejecting them. A good "score" indicates these are correctly configured and actively protecting your domain. A poor one means your domain is easily impersonated.

Why it matters for UK SMEs

For any UK SME, neglecting email security is not merely a technical oversight; it presents tangible commercial, reputational, and regulatory risks. Phishing and spoofing attacks, which these protocols are designed to prevent, remain among the most common and effective methods for cybercriminals to infiltrate businesses.

Consider the commercial impact. If a customer receives a fraudulent email appearing to come from your business – perhaps a fake invoice, a phishing link for payment details, or a scam requesting sensitive information – your reputation takes an immediate hit. Trust, once eroded, is difficult to rebuild. This directly affects customer loyalty and, by extension, your bottom line.

From a regulatory standpoint, the Information Commissioner's Office (ICO) takes a dim view of organisations that fail to implement appropriate security measures, especially when this leads to personal data breaches. Under GDPR, businesses have a clear obligation to protect data. While SPF, DKIM, and DMARC are not explicitly mandated by GDPR, they are widely recognised as fundamental technical and organisational measures for securing email communications that often contain personal data. Failing to implement them could be seen as a lack of due diligence, potentially leading to significant fines and enforcement actions should a breach occur via email impersonation.

Furthermore, organisations aiming for certifications like Cyber Essentials will find that robust email authentication is either a direct requirement or a strong recommendation. The NCSC (National Cyber Security Centre) consistently advises on the importance of these controls for good cyber hygiene. Beyond security, a poorly configured email domain also impacts deliverability. Emails from domains without proper SPF, DKIM, and DMARC are more likely to be flagged as spam by major email providers like Google, Yahoo, and Microsoft, meaning legitimate communications, such as booking confirmations or order updates, may not reach your customers. This is not ideal for business.

How to secure your email domain, a practical walkthrough

Securing your email domain involves configuring SPF, DKIM, and DMARC records within your Domain Name System (DNS). While the concept is straightforward, the implementation requires precision.

1. Implement SPF (Sender Policy Framework)

SPF records specify which mail servers are authorised to send emails on behalf of your domain. This prevents spammers from sending emails that appear to originate from your domain.

• What to do: You add a TXT record to your domain's DNS. This record lists the IP addresses or hostnames of all servers permitted to send email for your domain.
• Example: v=spf1 include:_spf.google.com include:sendgrid.net -all
  • v=spf1: Denotes the SPF version.
  • include:_spf.google.com: Authorises Google's mail servers (for Google Workspace users). You'd add similar includes for any other services that send email on your behalf (e.g., marketing platforms, CRM systems).
  • -all: This is crucial. It means "all other servers are NOT authorised to send email from this domain." Using ~all (softfail) is less strict and allows unlisted servers to send, but marks them as suspicious. For maximum protection, -all is preferred once you are confident all legitimate senders are listed. Avoid +all or ?all as these effectively authorise anyone to send email from your domain, rendering SPF useless.
• Common issues: We often see SPF records that are either missing entirely or contain +all or ?all mechanisms, which effectively negate any security benefit. Another frequent problem is exceeding the 10 DNS lookup limit, which can cause SPF to fail validation. This typically happens when too many include statements are used.

2. Implement DKIM (DomainKeys Identified Mail)

DKIM adds a digital signature to your outgoing emails, allowing the recipient's server to verify that the email was indeed sent by your domain and that its content hasn't been altered.

• What to do: This typically involves two steps:
  1. Generate a public/private key pair. Your email service provider (e.g., Microsoft 365, Google Workspace) will usually provide the public key or instructions on how to generate it.
  2. Add the public key as a TXT record in your domain's DNS. The record will have a specific "selector" (e.g., selector1._domainkey) and a long string of characters for the value.
• Example: selector1._domainkey.yourdomain.co.uk TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQD3...longstring..."
• Why it matters: DKIM provides a stronger verification than SPF alone, as it authenticates the message content. Without it, emails are more susceptible to being flagged as spam or spoofed.

3. Implement DMARC (Domain-based Message Authentication, Reporting & Conformance)

DMARC is the policy layer that tells receiving mail servers what to do with emails that fail SPF or DKIM authentication. It also provides reporting on email authentication failures, which is invaluable for identifying potential spoofing attempts and fine-tuning your SPF and DKIM records.

• What to do: Add a TXT record to your DNS, typically at _dmarc.yourdomain.co.uk.
• Example: v=DMARC1; p=quarantine; rua=mailto:[email protected]; fo=1
  • v=DMARC1: Specifies the DMARC version.
  • p=none: The initial policy. This monitors authentication failures without taking action. It's useful for gathering data and ensuring legitimate emails aren't blocked.
  • p=quarantine: Instructs receiving servers to place emails that fail authentication into the recipient's spam or junk folder.
  • p=reject: The strongest policy. Instructs receiving servers to outright reject emails that fail authentication. This is the ultimate goal for full protection.
  • rua=mailto:[email protected]: Specifies an email address to receive aggregate DMARC reports, which provide an overview of your domain's email traffic and authentication results.
  • ruf=mailto:[email protected]: Specifies an email address for forensic reports, offering more detailed (though less common) insights into individual failures.
• Experience Signal: On a recent client tenant audit for a 40-user London accountancy firm, we found over 85% of their users were operating without a DMARC record set to p=reject. Many had p=none or no DMARC record at all, leaving them vulnerable to direct domain spoofing, which is precisely the kind of attack DMARC is designed to prevent. We systematically moved them to p=reject after a monitoring period.
• Phased implementation: It's prudent to implement DMARC in a phased approach: start with p=none to monitor, then move to p=quarantine, and finally p=reject once you are confident no legitimate emails are failing authentication. This ensures you do not inadvertently block your own outgoing emails.

Common mistakes we see

Even with the best intentions, several common pitfalls can undermine your email security efforts:

• Missing DMARC record entirely: This is surprisingly common, leaving domains completely exposed to spoofing and phishing.
• DMARC policy set to p=none indefinitely: While useful for monitoring, leaving DMARC at p=none offers no real protection against malicious emails.
• Overly permissive SPF records: Using +all or ?all mechanisms in SPF, or including too many third-party services, can invalidate the record or open doors for unauthorised senders.
• Incorrectly configured DKIM: Expired keys, incorrect DNS entries, or a lack of DKIM entirely means emails cannot be reliably authenticated.
• Ignoring DMARC reports: These reports provide crucial intelligence about who is sending email from your domain, legitimately or otherwise. Failing to review them means you miss opportunities to improve security.

Key Takeaways

• DMARC, SPF, and DKIM are non-negotiable: They form the bedrock of modern email security.
• Protect against impersonation: These protocols significantly reduce the risk of phishing and spoofing attacks.
• Improve email deliverability: Correct configuration ensures your legitimate emails reach their intended recipients.
• Enhance compliance and reputation: Strong email security demonstrates due diligence and builds customer trust.
• Regular review is essential: Email sending services change, and your configurations need to keep pace.

When to call in help

Implementing and maintaining these email authentication protocols correctly requires a degree of technical understanding and ongoing attention. For many UK SMEs, whose focus is rightly on their core business, diverting internal resources to manage complex DNS records and DMARC reporting can be a stretch. Getting it wrong can lead to deliverability issues or, worse, leave your domain vulnerable. If the prospect of configuring SPF, DKIM, and DMARC seems daunting, or if you simply lack the time and expertise to do it thoroughly, then engaging a specialist IT provider is a sensible decision.

To take the next step

Book a Discovery Call