Stop scammers sending emails that look like they come from you

Why it matters to a small business

• Scammers can pretend to be you.A fake invoice “from” your address, with new bank details, is far more convincing to your customers than one from a stranger.
• Your real emails can end up in spam. Google, Yahoo and Microsoft have been tightening their rules since 2024. Email that fails these checks is more likely to be filtered or rejected, and businesses that send a lot of email must now have all three.
• It is free. They are a few lines of text added to your web address’s settings.

The three settings, in plain English

SPF: the guest list

A list, published with your web address, of the services allowed to send email for you: your email provider, your newsletter tool, your booking system. Receiving mail servers check that an email came from a service on the list.

DKIM: the wax seal

A digital signature added to every email you send. The receiving server checks it against a key published with your web address. If it matches, the email really came from your system and nobody changed it on the way.

DMARC: the instructions

Your instructions to the world for emails that claim to be from you but fail the checks: let them through and just tell me (p=none), put them in spam (p=quarantine), or refuse them (p=reject). It can also send you reports, so you can see who is sending email in your name.

All three are text records in your domain’s DNS settings, which live wherever your web address is managed: often your web host or the company you registered it with.

Check yours in two minutes

• Use a free checker.The National Cyber Security Centre’s Email Security Check (search “NCSC email security check”) or MXToolbox (mxtoolbox.com) will look up your web address and show what is missing.
• Or look at a real email.Send an email from your business address to a Gmail account, open it, click the three dots, and choose “Show original”. You want to see PASS next to SPF, DKIM and DMARC.

First, list everything that sends email for you

This is where most set-ups go wrong. As well as your normal mailbox, think about:

• your website’s contact or booking forms
• a newsletter tool, such as Mailchimp
• accounting software that emails invoices, such as Xero or QuickBooks
• a booking or appointment system, or a till that emails receipts

Each one needs to be covered by SPF or set up to sign with DKIM, or its emails will start failing once DMARC is strict.

What good looks like

• SPF: exactly one SPF record, including every service on your list, ending in ~all or -all. For a business using Google Workspace it can be as simple as v=spf1 include:_spf.google.com ~all. Two separate SPF records break it, and +all lets anyone through.
• DKIM: switched on with your email provider (Microsoft 365 and Google Workspace each have a setting for it, and many web hosts do it for you) and with each other service that sends for you.
• DMARC: start with v=DMARC1; p=none; rua=mailto:you@yourbusiness.co.uk so you get reports without anything being blocked. When the reports show all your genuine email passing, usually after a few weeks, move to p=quarantine, and later to p=reject.

Who should set it up

Whoever manages your web address: your web designer, your IT person, or you, through your registrar’s control panel. Changes take a few minutes. A mistake can stop your email arriving, though, so write down the existing records before you change anything, and change one thing at a time.

What these settings cannot do

They protect your exact web address. Scammers can still register a lookalike, such as yourbusiness-uk.co.uk, and send from that. Two habits help: tell customers that your bank details will never change by email, and check any change to a supplier’s bank details by phoning a number you already have.