Anyone can put your domain in the From line of an email. Whether it reaches the inbox depends on three public DNS records. SPF lists the servers allowed to send for you. DKIM signs each message so it cannot be altered on the way. DMARC tells receiving servers what to do when a message fails both checks, and where to send reports about it.
Most small businesses have SPF, about half have DKIM, and very few have DMARC set to reject. The result is that a criminal can email your customers, your bank or your own staff as you, and it lands. This check reads your records, explains each one in plain words, and says what to change.
The fix is three DNS records and a few weeks of reports. We do it as part of email security, or on its own.
Click “Send this with the form below”, add your details, and we reply with the exact records to publish and a plan to move DMARC to reject without disrupting your mail.
Monitoring only. Receivers report what they see but still deliver messages that fail the checks. It is the right first step, for a few weeks, while the reports show which services really send mail for you. Then the policy moves to quarantine and finally reject.
Only if the service sending them is not authorised in SPF or signing with DKIM. The reports show every sender before you switch, so nothing legitimate is caught by surprise.
Microsoft signs your mail with DKIM once it is enabled for your domain and publishes the SPF include, but the DMARC policy is yours to publish. Many Microsoft 365 tenants still sit at p=none or have no DMARC record at all.
