By Kyle Sutherland,
The scam, as your customer sees it
A regular customer gets an email from your business. Your name, your address, the same sign-off as always. It says the invoice is attached, or that your bank details have changed for the balance due this week. It reads like you because almost everything in it has been copied from you. The only thing that is not yours is the bank account.
By the time the real invoice is chased, the money is gone. The customer feels cheated, and fairly or not, some of that lands on your business. The uncomfortable part is that the criminal did not hack anything to pull it off. They just pressed send.
Why email lets this happen
Email is far older than the crime that now runs on it. The system was designed without any built-in check that a sender is who they claim to be, so at a technical level anyone can put your address in the from line of a message, the same way anyone can write your name on the back of an envelope.
The fix is a set of public records attached to your domain, the part after the at sign in your email address. Those records tell every receiving inbox, in advance, which servers genuinely send your email and what to do with anything that fails the check. If the records are missing or left loose, the world's inboxes have no reliable way to tell your invoice from a forgery, and plenty of small-business domains are set up exactly that way.
Check your own domain now, it takes seconds
You do not have to take my word for any of this. The free security check reads your domain's public records and grades them in plain English: whether the protection exists, how strong it is, and exactly what to ask for if something is missing. It is passive, so nothing touches your website or your inbox, and there is no sign-up.
If the email checks come back green, you can stop reading here with a clear conscience. If they do not, the three records below are what is missing.
SPF, DKIM and DMARC in plain English
SPF is the guest list. It is a public record naming the servers allowed to send email for your domain. When a message claiming to be from you arrives, the receiving inbox checks whether it came from a server on that list. No list, or a sloppy one, and a forgery sails through the check.
DKIM is the tamper seal. Your genuine email is signed with a cryptographic stamp as it leaves, and the receiving inbox uses your public record to confirm the stamp is real and the message was not altered on the way. A forger cannot produce that stamp, because they do not hold your key.
DMARC is the standing instruction. It tells inboxes what to do with messages that fail those checks: let them through anyway, put them in junk, or bin them outright. It also sends you reports on who is sending as your domain, which is how you hear about a problem before your customers do. Without DMARC, the other two records are opinions rather than rules.
What to do next
If you run your email through Microsoft 365 or Google Workspace, both publish step-by-step guides for adding SPF, DKIM and DMARC, and a careful afternoon in your domain's DNS settings will get you most of the way. Start DMARC in monitoring mode, read what the reports tell you, and only then tighten the policy, so genuine email never gets caught in the net. The plain-English DMARC guide walks through that rollout step by step.
If you would rather it were simply handled, this is part of what I do. Every website I build ships with all three records set up as standard, and the same setup is available on its own through the services page, whether or not I built your site. Either way, run the free check first: it is the quickest way to find out where you stand.