Who is allowed to send email as you?
Email was built without any check on who is sending. Unless you have said otherwise, anyone can send a message with your company's address in the From line: an invoice with new bank details, a password reset, a note from the managing director.
There is a way to say otherwise. It is three short records published alongside your domain name, and between them they answer one question for every mail server in the world: who is allowed to send email as you?
Getting them right does two jobs. It makes your business harder to impersonate, and it keeps your own genuine email out of the spam folder. The second is usually what gets noticed first, when quotes and invoices quietly stop arriving.
The three records
All three live in DNS, the public address book for your domain. Whoever manages your domain name (your IT provider, your web agency, or you) can add them. The NCSC's email security and anti-spoofing guidance covers each in detail. In plain terms:
SPF (Sender Policy Framework) is the guest list. It lists the servers allowed to send mail for your domain: your email provider, and any other service that sends on your behalf.
DKIM (DomainKeys Identified Mail) is the seal. Your email service adds a digital signature to each message. The receiving server checks it against a key you have published, which proves the message came from your domain and was not altered on the way.
DMARC (Domain-based Message Authentication, Reporting and Conformance) is the instruction. It tells receiving servers what to do with a message that fails the other two checks, and it asks them to send you reports about who is sending mail in your name.
The first two are checks. The third is the one that turns a failed check into a consequence.
Why DMARC is the one that matters
SPF and DKIM on their own leave the decision to the receiving server. DMARC lets you make it. There are three settings:
- none: do nothing, but send me the reports
- quarantine: put failing mail in the spam folder
- reject: refuse it
DMARC also closes a gap the other two leave open. It requires that the domain that passed the check matches the address the recipient sees in the From line. Without that, a criminal can pass SPF for a domain they own while showing your name to the reader.
Many businesses publish a DMARC record set to "none" and stop there. That gives you reports and no protection. It is the right place to start and the wrong place to finish.
The reason your own email goes missing
This stopped being optional when the big mailbox providers began enforcing it. Google's email sender guidelines require every sender to Gmail accounts to have SPF or DKIM in place. Anyone sending more than 5,000 messages a day needs all three, and has done since February 2024.
Most small firms send nowhere near 5,000 a day. They still get caught, because of everything else that sends email in their name:
- the accounting package that emails invoices
- the newsletter tool
- the website contact form
- the booking or CRM system
- the scanner that emails documents
Each one sends "from" your domain through somebody else's servers. If it is not on the guest list and not signing with your seal, its messages fail. That is how a business with perfectly good email ends up with invoices in customers' spam folders.
What to do
- Check where you stand. The NCSC runs a free email security check. Enter your domain and it tells you whether anti-spoofing is set up correctly.
- List everything that sends as you. Go through the systems above and add anything else that emails customers. This list is the real work. The records are easy once you have it.
- Set up SPF and DKIM for each one. Every reputable email service publishes instructions for this. If a supplier cannot sign mail for your domain, that is worth knowing before you renew.
- Publish DMARC at "none" and read the reports. Within a couple of weeks they show which services are passing, which are failing, and whether anyone else is sending as you.
- Then tighten it. Once the genuine senders pass, move to "quarantine" and then "reject". This is the step that actually stops impersonation, and the step most businesses never take.
- Cover the domains you do not send from. Spare domains you own but never email from can be spoofed too. They need a record saying nothing is allowed to send.
If someone else manages your domain, the question to ask is short: "Do we have SPF, DKIM, and DMARC, and is DMARC set to reject?" A good provider will answer in one line.
How Steelwise can help
Working out everything that sends email in your name, and getting from no policy to "reject" without losing genuine mail on the way, is a small and well-defined piece of infrastructure advisory work. Get in touch if you would like help with it.